CPOMS SYSTEMS LIMITED

CPOMS (Software for Safeguarding, Pastoral, and Wellbeing Management)

CPOMS is the market leader in digital safeguarding solutions, with more than 20,000 clients globally. CPOMS offers an intuitive system designed to streamline safeguarding management, Child Protection, and pastoral concerns. Reporting enables comprehensive data analysis, quickly identifying data trends and identify patterns, subsequently sharing insights with stakeholders.

Features

• Enhancing secure exchange of confidential data across settings reliably
• Secure data sharing using UPN’s e.g. attendance, safeguarding, wellbeing data
• Customised editable categories designed to suit users specific requirements
• Customise user permissions, restrict user access, create elevated user access
• Efficiently produce reports with intuitive, real-time reporting for insightful analysis
• Instant alerts for Children Missing Education ensure staff vigilance
• Remote system access for seamless work from any location securely
• Secure 2 factor authentication with enhanced system security
• Share sensitive information to authorised recipients with secure collaborative chronologies
• Allow approved email domains for user address whitelist security

Benefits

• Transfer data securely between CPOMS systems for protected information exchange
• Access CPOMS securely via your unique URL from anywhere online
• Generate insightful reports highlighting data patterns and emerging trends effectively
• Create customisable fields to suit individual needs for versatile functionality
• Seamlessly capture information on safeguarding concerns for comprehensive data analysis
• Quickly address concerns remotely to effectively manage incidents
• Our software interfaces adapt to different screen sizes and resolutions
• Facilitate effective communication among multiple agencies for seamless information sharing
• Enhances safety protocols, streamlines processes, and centralises safeguarding efforts efficiently
• Receipts confirm policy delivery and staff acknowledgment for accountability tracking

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at procurement@cpoms.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

490292944725783

Contact

Richard Gardner
01756797766
procurement@cpoms.co.uk

About your service

• Service categories:

  Applications

  Content workflow and management

  • Capture
  • Document

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: We only guarantee support for the major web browsers (Google Chrome, Microsoft Edge, Safari, and Firefox) and only to the last two major versions.
• System requirements:
  • CPOMS, an internet based system, requires an active internet connection
  • We recommend Google Chrome or Microsoft Edge.

User support

• Email or online ticketing support: Yes
• Support response times: Responses are provided within 48 hours Monday to Friday. Does not include Bank Holidays.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: CPOMS use a 3rd party application for Live Chat. All testing is completed via the vendor.
• Onsite support: Yes
• Support levels: 1st Line Product Support,; 2nd Line Technical Support,; 3rd Line Engineering Support,; Dedicated Customer Success Manager.; ; All support is included as part of the annual licence subscription fee.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Implementation meetings are held once a customer orders the product. a Welcome email is sent to the customer with training videos and help sheets. Other training includes a 1:1 train the trainer session and webinars to further embed user knowledge. More training meetings can be made to meet the needs of the buyer and are not restricted to a set number. This support is included in the costs.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • Emails
  • Knowledgebase Website
  • Online webinars
• End-of-contract data extraction: The customer will receive a copy of their data back in a JSON format.
• End-of-contract process: The customer will receive a copy of their data back in and JSON format. Once CPOMS receives confirmation that the customer is in receipt and accessed their data we will either a) delete the data from our side or b) hold a copy if the customer has asked us to (following an agreed period).
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Our onboarding and offboarding documentation is compatible with adaptive technologies like screen readers, magnifiers, and voice recognition software. We offer flexible formats, accessible facilities, and a feedback mechanism for continuous improvement. Training ensures everyone supports accessibility effectively.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Our web developers have created a responsive design that adapts to different screen sizes and resolutions. This is achieved using flexible grids and layouts, and other techniques. Responsive design allows the content to rearrange and resize itself dynamically based on the device's screen size. Functionally it is the same. The only differences are visual.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: This is a web based application with a user interface.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: None to date.
• API: Yes
• What users can and can't do using the API: The public facing REST API is limited to fetching and posting of a subset of data (primarily around creation of incidents). Permissions are granted via an API token that is specific to a user, and via user group and category permissions.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Our Microsoft Azure infrastructure will automatically scale up to meet demand during busy periods or heavy usage. This is continually monitored by our engineers to ensure optimal performance.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Built in CPOMS reporting tools allows customers to pull their data off from within the system at any time by creating a report from within the platform. If the customer decides to leave, the in-house technical team will run and export the customer's data as a JSON format. This is password protected and the password is provided at the same time. There is no additional cost.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Excel
  • PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Excel
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Our SLA states uptime of 99% per annum. In reality, this is > 99.95%.
• Approach to resilience: We use two Azure regions, a "Primary" and "Secondary". We have live database replication between the two. In the event of a "disaster" we are able to deploy infrastructure (via code - Terraform) to the secondary region quickly. More details available on request. Logical backups are taken daily from the primary database nodes. Backups are transferred from the DB servers to a separate instance in our cloud provider and are kept for 28 days. This is not configurable by the client.; For disaster recovery we have active replication of all database nodes between our primary and secondary regions.; Our process is set out in our backup policy, which is reviewed and tested every 6 months.
• Outage reporting: We have a public facing service operation status page, and we would communicate via email in the event of a high priority incident.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access is only granted on a least privileged basis in accordance with our Access Control policy. All access to our systems are via 2FA.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We have internal Information Security Management policies, governed by our Information Governance Committee (IGC). This includes policies on, but not exclusively; Access Control, Change Management, Secure Development, Disaster Recovery.; ; Changes to CPOMS systems are subject to strict change control processes, with role-based access, multi-factor authentication, and detailed activity logging. All modifications are reviewed and tested before deployment, ensuring that operational changes do not introduce security exposures, and that configuration integrity is preserved
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Our Change Management policy defines the steps we take as part of our software development lifecycle. This includes, but not exclusively, controls for security vulnerabilities, code quality, peer review, access control, monitoring and auditing. All changes are graded and approved by our internal Change Advisory Board (CAB). More information is available on request.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: CPOMS employs a rigorous vulnerability management process, including regular penetration testing, continuous automated vulnerability scanning (both internal and external), and a public bug bounty programme. Patch-level security scanning for dependencies and static code analysis are integrated into our secure development lifecycle, ensuring vulnerabilities are detected and addressed promptly.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have a WAF configurated in Microsoft Azure and monitor anomalies regularly. Any potential compromises are dealt with by our DevSecOps team as soon as is practicable, and dependent on the severity. We have a multitude of monitoring services (Sentry.io, NewRelic, etc) that are constantly monitored by engineers, and any issues dealt with in accordance with our SLO's which are defined by the severity rating. A P1 issue will be resolved within 24 hours, A P2 issue within 2 weeks, A P3 within 3 months.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We use a Major Incident process, with clearly defined roles. All issues are triaged by the Incident Commander and dealt with accordingly. Incidents are either triggered manually by any member of staff, via our incident email address, or automatically via any anomaly detected via our monitoring. All incidents are recorded and Post-mortems carried out.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 20%
• Between £250,000 and £500,000: 20%
• Between £500,001 and £1,000,000: 20%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: ISO/IEC 27001:2022 Certificate No. 00042475-ICT-ENGUS-UKAS, issued by LRQA.
• ISO/IEC 27001 accreditation date: Monday 11 December 2023
• What the ISO/IEC 27001 doesn’t cover: All the deliverables are covered by our ISO 27001 certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at procurement@cpoms.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.