SQEPTECH LTD

eSQEP Competency Management SaaS Solution

eSQEP is a competency management and assurance system. It enables organisations to understand the competency, skills and qualifications of its workforce; supports allocation of roles to employees with the appropriate level of competency to undertake those roles; provides an assurance process.

Features

• Competency management and assurance processes
• Visualisation and management dashboards
• Can integrate with Core HR systems
• Can integrate with Learning Management System
• Workflow driven
• Remote access (SaaS)

Benefits

• See competency profiles of your workforce
• Identify competency and skills gaps
• Help the organisation align employees with the best-fit role
• Management information aggregated at various organisational unit levels
• Encourage internal mobility and reduce recruiting and training costs
• Seamless data from HR system when integrated
• Match your team to roles they have skills for

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at roberta.king@sqeptech.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

483793332196888

Contact

Roberta King
+447734112102
roberta.king@sqeptech.com

About your service

• Service categories:

  Applications

  Collaborative

  • Enterprise community
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: It can be integrated with HR and learning management systems.
• Cloud deployment model: Public cloud
• Service constraints: None, eSQEP is a Software-as-a-Service (SaaS). Users can access the application at any time and from anywhere through the internet.
• System requirements:
  • Access to internet connectivity as the solution is SaaS/Cloud based
  • Safari, Google Chrome, Firefox, IE11 and above

User support

• Email or online ticketing support: Yes
• Support response times: Business working hours Mon-Friday 9.00 - 17.00; slower response during the weekend. Typical support responses times: • Priority 1 - 1 working day • Priority 2 - 3 working days • Priority 3 - 10 working days
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Customers can contact the SQEPtech support team via support@sqeptech.com indicating issues and their estimated level of priority as follows: • Priority 1 - fail in operations • Priority 2 - reported bug or issue without a workaround in place • Priority 3 - reported bug or issue with a workaround in place SQEPtech will endeavour to apply fixes to the reported issues in line with the reviewed priority level as follows: • Priority 1 - 1 working day • Priority 2 - 3 working days • Priority 3 - 10 working days Managed services support level can be put in place, costs varying on number of users. Account Manager and/or Client Success Support available depending on type of contract.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: ESQEP is designed to be intuitive to use. The following services are available: * 1-2-1 user training and shadowing (at additional cost)
• Service documentation: No
• End-of-contract data extraction: Data can be exported via excel files, csv files, or can provided directly from the database in html format or other formats required by individual clients.
• End-of-contract process: We work with the client to ensure a smooth off boarding process. Exact details will depend upon the client and the system or service provider they are moving onto, with data being provided in excel or csv formats. Dependent upon the detail of the off boarding required costs are typically 50% of last annual cost.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Whilst there is no app that can be downloaded the solution is designed as a responsive web app and will adjust to any screen size automatically. It can be used from a tablet or mobile phone when in an area where internet access is available.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: The look and feel of the application can be customised with customer specific branding. Access to specific functions can be added/removed on a per customer basis. We undertake the customisation work.

Scaling

• Independence of resources: Information concerning future usage of key services is collected as part ; ; of the regular our SaaS service review process. SaaS customers are asked to highlight any known increases or decreases in the usage of existing services and any other business events likely to impact on the effective provision of service. Data regarding the current usage of technical resources is collected via several monitoring tools and is analysed quarterly to identify trends. Currently the application resources are sized to support the existing customer base at peak times. Work is in progress to enable auto horizontal scaling.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Physical access control, complying with another standard ISO27001/27002, SOC 1, SOC 2. Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Standard reporting available in the portal; reports can be exported via csv, excel or pdf type files.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Excel
  • PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats: Excel

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: Data in transit is secured end to end using TLS 1.2 or higher. All calls to service API are authenticated and validated against multiple permission criteria.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Ensuring the product is legislatively compliant. First point of call for answering Data Protection Queries. Conduct annual training. ; ; Adherence to General Data Protection Regulations.

Availability and resilience

• Guaranteed availability: Save during routine maintenance and upgrades, we will use reasonable endeavours to ensure that eSQEP is available at least 98% of the time within each calendar month between the hours of 8.00 am and 8.00 pm.
• Approach to resilience: Production information is not physically hosted on any SQEPtech premises, and is managed (together with disaster recovery, failover and information security continuity) by Microsoft Azure (https://azure.microsoft.com/en-gb/overview/trusted-cloud/compliance/). Backups are taken regularly within the Azure hosted subscription to provide contingency if any of the supplier mitigations fail. Code configuration is controlled within version control. In the highly unlikely event of disaster recovery failing for any supplier, environments can be created through recreating these replicable environments via infrastructure-as-code scripts.
• Outage reporting: Outages are reported via email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: Password and Authentication Policy: This policy describes the authentication requirements for accessing internal computers & networks and includes those working in-house as well as those connecting remotely. Every person, organisation, or device connecting to internal IT resources and networks must be authenticated as a valid user before gaining access to SQEPtech's computer systems, networks, and information resources.
• Access restrictions in management interfaces and support channels: There are various levels of user which controls what they have access to: • Superuser-Full access • Admin-Full access to a specific subset of data • User-Limited ability to edit user data but below the level of the admin role Reader-Primarily read access, can't generally make changes. Users require a unique username and password to access the application. Authentication is typically performed against Active Directory
• Access restriction testing frequency: Less than once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials.
• Information security policies and processes: A comprehensive information policy is backed by specific, detailed polices applied company-wide. Commitment to the delivery of information security is led from the top of the organisation, with the senior team holding monthly information security reviews. Top management ensure that systematic reviews of performance of the programme are conducted to ensure that information security objectives are being met. Cyber Essentials principles underpin this practice. The policy and supporting policies are endorsed by Management at all levels. Policies are reviewed annually as part of the ongoing security improvement program and documented in the Information Security Management System Policy (ISMS) aligned with ISO27001. Policies cover ISMS, access control, passwords, software development, cryptography, data protection and data privacy, anti-malware and patching, monitoring and logging, incident management, business continuity, the use of media, data retention, suppliers, HR security, change management, remote working, back-ups, social media and internet use, cloud computing and risk assessment and treatment.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The change management process controls changes to IT services and associated components are recorded and then evaluated, authorised, prioritised, planned, tested, implemented, documented and reviewed in a controlled manner. A change review board, whose membership includes the Chief Technology Officer and Chief Executive Officer, assesses the impact of all system and software changes. Assessment include information security impacts on a risk-based approach. Once approved, all changes are monitored for a period after deployment.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are identified via suppliers, Microsoft, NCSC and similar bodies. Regular vulnerability scans/pen tests are also carried out. The assessment is carried out in-house or by an external company, and typically covers: -assessment of the security of all routes into the internal network from the Internet; -Externally-facing web servers; - Business critical servers on the internal network. Where configuration changes are recommended, these are actioned through the change management process so that appropriate controls are in place for testing, risks assessment and backout. Patching is performed on a regular schedule and applied centrally. Hardening activities are performed per guidelines.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Various monitoring and alerting tools are used primarily within the Azure Security Centre Regular reviews are performed of the dashboards and audit logs and any identified incidents investigated and if appropriate actioned. Alerts are investigated immediately. Other flagged incidents are reviewed on an at least weekly basis
• Incident management type: Supplier-defined controls
• Incident management approach: SQEPtech has a set of pre-defined processes for managing and recovering from common events. These are regularly tested via incident management exercises. The steps: • event occurrence • event detection and notification; logging • event correlation and filtering; actions as needed • action review • incident close Event types: informational, warning or exception. Informational events are logged for audit trail purposes. Warning events are investigated prior to responding to the incident. Exception events trigger the appropriate incident response procedure. Users are able to report incidents. Incident reports are issued via email
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 69e6f95f-dbf8-401d-b4f8-cee5d471e62a
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at roberta.king@sqeptech.com. Tell them what format you need. It will help if you say what assistive technology you use.