Blue Lights Digital

Secure Events Platform as a Service - Capacity Building - Digital Investigation & Intelligence

Capacity Building – Baseline communication, presentation, workshop, discovery, maturity measurement, skills & competence assessment platform. .

Discovery provides a platform as a service for secure training & events, analytics through discovery, refinement development, delivery and post-project analysis across skills, functions. business-change requirements needed for reporting to watchdogs, commissions and inspectorates.

Features

• Create from template or bespoke requirements
• Quality assured standards and qualitative workflows with SyOps
• Identity Access Managed through highly secure Azure tenancy
• Secure events presentation Platform as a Service using MS TEAMS
• Pre-production and Production team for broadcast and post edit
• Self managed content or a managed service content build
• XLS, JSON or CSV exports
• Role Based Access controlled for reporting and GDPR compliant output
• Pay per module, presentation, event or on a subscriber model
• Fully comprehensive managed service from end to end

Benefits

• Pre-built workflows & configuration for rapid deployment
• Experienced production team for virtual events and online workshops
• Network, Cloud tenancy &infrastructure, support desk & broadcast equipment supplied
• Platform access granted by authorisation, necessity or time orientated
• Identity Access Management is built in for increased security posture
• Connect to TEAMS via HTTPS or App using SSL/TLS/PSN/PNN
• All procedures and standards supplied as a fully. managed service
• All data managed by security cleared and GDPR competent team
• Improve your communication, presentation, event experience
• Manage capabilities training, CPD and assessments in one portal.

£1,995.00 to £100,000 a unit a day

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at claire.stanley@bluelightsdigital.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

498327802755836

Contact

Claire Stanley
07847258384
claire.stanley@bluelightsdigital.com

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: Available as a web service in Azure. Any white label requests will need an azure tenancy.
• System requirements:
  • Enterprise edition requires subscription
  • IP Addressing and Identity Access permissions
  • Desktop browser for Web Services

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Toolset is Fresh Service.; ; SLA's available are 1 hr - 8hr - next business day response. ; ; We have dedicated e-mail and chat channels available 24/7.; ; Service options include 24/7 human support available Service Desk or remote. ; ; - Mon - Fri 9-5 Service Desk or remote support ; ; - Automated bot support available on chat channels only
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is on a reasonable endeavour basis and is included in our pricing. ; Dedicated 'operational' support can be provided under our standard day rates for an investigating officer. ; ; Technical developers can be provided to assist with data modelling, Data integration, Data Parsing, Data migration, API build, software integration, Network integration and automation under our standard day rates.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Training is provided by the app itself. The UI and UX are designed for self provisioning. Content is navigated by breadcrumbs and visual pointers. The app has been UX tested for systems usability. With all versions of Discovery the 'About Discovery' module will demonstrate how to use the system. ; ; Training can be provided for Administration purposes where administrators are required to manage cohorts, manage reporting metrics, report on currency and compliance and award credentials. ; ; Training can be provided in design, build and operation of discover modules.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Data is deleted by Blue Lights Digital only. Note that any data downloaded to a container on a mobile device will remain at rest on that device. Therefore, clients are recommended to use MDM to manage access to the enterprise edition of the Discover App.
• End-of-contract process: A subscription will lapse and no further updates will be provided to that user. Access to the web service will also be denied. The app, its content and workflow will remain at rest until deleted by the user or via an MDM function.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: Yes
• Description of customisation: Modules can be updated through admin access portal by Web Services only. Access is via HTTPS with Identity Access Management applied. ; ; Customer managed content can be updated and published to web and mobile users.

Scaling

• Independence of resources: Load balancing, Clients can be allocated reserved instances for on demand scaling.

Analytics

• Service usage metrics: Yes
• Metrics types: Transaction by user, client to domain.
• Reporting types: Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Any data that is managed on behalf of the client can be extracted and sent to the client in a format of there choosing.
• Data export formats:
  • CSV
  • ODF
  • Other
• Data import formats:
  • CSV
  • ODF
  • Other

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Availability of less than 99.95% but equal to or greater than 99.0% is guaranteed by a 10% service credit for failure to meet SLA. ; ; Availability less than 99.0% is guaranteed by a 30% service credit for failure to meet SLA.
• Approach to resilience: We utilise elastic load balancing, computing clusters, autoscaling and cloud flaring (DNS obfuscation) to add resilience to our cloud environments.
• Outage reporting: Email alerts to users.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to the Decypher system is limited by identity Access Management to known and vetted users only. Three factor authentication is required via a RSA key, Password and Username.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Username or password
  • Other
• Description of management access authentication: IP White Listing

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: 18 September 2015
• What the ISO/IEC 27001 doesn’t cover: Detailed technical specifications or solutions; Specific software or hardware configurations; Compliance with other standards not directly related to information security; Non-information security-related processes or procedures within BLD Group
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • Cyber Essentials
  • JOSCAR
  • RICOH

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Through Cyber Essentials and NCSC cloud principles.
• Information security policies and processes: We use a shared responsibility model between customers and Blue Lights Digital. We operate, manage, and control the components at the operating system layer down to the physical security of the servers in which the services are provided (including updates and security patches), other associated application software, as well as the configuration of firewalls. , ; ; It is possible to enhance security and/or meet more stringent compliance requirements by leveraging technology such as host-based firewalls, host-based intrusion detection/ prevention, and encryption which can be requested by our clients at additional charges.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Any changes to our systems are first managed by impact and risk assessment. Any changes to architecture, software or network access is tested within a development environment before release to production. A production snapshot is available for roll back. ; ; Security assessment is managed through in house pentesting an testing procedures. External pen testing is subject to additional charges.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: As part of our Cyber Essentials programme we practice identifying, classifying, remediating, and mitigating vulnerabilities. ; ; We use vulnerability scanners to identify known vulnerabilities, such as open ports, insecure software configuration, and susceptibility to malware. For unknown vulnerabilities, such as a zero-day attacks we relay on updates to our vulnerability scanners such as OWASP ZAP. Vulnerability testing is also part of our test automation processes.; ; Correcting vulnerabilities involves the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.; ; We are active members of OWASP, CISP and Black Hat communities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We license SiteLock TrueCode Static Application Security Testing (SAST) for source code analysis. Also known as "white-box" testing, TrueCode finds common vulnerabilities by analysing 100% of the source code in our applications without actually executing them, and adds critical layer of security by protecting our web applications.; ; Our SAST is automated to send alerts if a breach or malware is detected.
• Incident management type: Supplier-defined controls
• Incident management approach: The activities within our incident management process include:; Incident detection and recording; Classification and initial support based upon known errors and new events; Investigation and analysis; Resolution and record; Incident ownership, monitoring, tracking and communication; ; We report on incidents with a full disclosure policy to ensure any impact can be contained and a resolution is satisfactory to the end user. ; ; Incident reports are provided by e-mail to the end user.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Police National Network (PNN)

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  The delivery of solutions and software from BLD can significantly contribute to fighting climate change through various means. Implementing BLD Secure Events Platform Services can optimise law enforcement resources which can lead to reduced carbon emissions. Additionally, integrating smart technologies to replace the transportation of physical devices to and from crime scenes facilities reduces fuel consumption and greenhouse gas emissions. Furthermore, software solutions that facilitate remote work and virtual meetings can help reduce the need for unnecessary travel for data recovery, thus lowering carbon footprints.; ; The social value of these contributions can be measured by quantifying the reduction in carbon emissions resulting from the implementation of BLD Secure Events Platform Services . This can involve calculating the energy savings achieved by optimising processes and systems, as well as estimating the reduction in vehicle and airmiles travelled due to the adoption of Secure Events Platform Services technologies.

  Covid-19 recovery

  The delivery of solutions and software as a systems integrator plays a crucial role in supporting post-Covid-19 recovery efforts, particularly in addressing the multifaceted challenges individuals encounter upon returning to work. This includes skills attrition and experience leaving public service for new roles in the third sector. Beyond health concerns, there is also a pressing need to mitigate the negative outcomes exacerbated by the pandemic, such as increased vulnerability to crime. During the lockdown periods, many individuals were targeted by fraudulent schemes exploiting the uncertainties and disruptions caused by the pandemic. These were often manifested through breaches of privacy and then obfuscation of activities within social media and corporations and their technology providers. ; ; The social value of BLD Secure Events Platform Services can be measured by assessing the effectiveness of enhanced skills in detection and prevention measures delivered as conferences and sensitive equity webinars through BLD Secure Events Platform Services that reaches beyond the local community. This involves quantifying the reduction in fraudulent activities targeting individuals returning to work, as well as evaluating the efficiency of response mechanisms in addressing reported cases. Additionally, feedback from affected individuals and stakeholders can provide insights into the perceived impact of these initiatives on restoring trust and confidence in economic activities post-pandemic.

  Tackling economic inequality

  The delivery of Secure Events Platform Services from BLD can contribute to tackling economic inequality by enhancing access to essential services and opportunities for marginalised communities. For example, implementing digital platforms for government services can streamline processes and reduce barriers to access for individuals with limited mobility or internet connectivity. If these online services are corrupted or attacked, then harm is often amplified on the most vulnerable in the community. Additionally, providing training and support for digital literacy can empower underserved populations to participate more fully in the digital economy. BLD provide access through level 4 Apprenticeships in Digital Forensics Examiners that include skills and competences in BLD Secure Events Platform Services systems. An example of the fusion between these two services is the Proceeds Of Crime Act that has recovered significant value back to government through professionalised crypto asset Investigation. ; ; The social value of these contributions can be measured by assessing the extent to which they contribute to reducing disparities in the use of government services development of new roles of employment in the investigation and intelligence marketplace, educational opportunities for new workforce entrants, and economic recoveries among different police forces.

  Equal opportunity

  The delivery of Secure Events Platform Services from BLD can contribute to tackling economic inequality by enhancing access to essential services and signposting for public sector workers in the support of marginalised communities. For example, implementing digital platforms for Policing services can streamline processes and reduce barriers to access for individuals with limited mobility or internet connectivity. With the lack of provision of training and support for digital literacy, Secure Events Platform Services solutions can empower underserved public sector workers to participate more fully in the digital economy. BLD provide access to Secure Events Platform Services as a service wide enterprise SaaS solution or through in house development through a level 4 PCSO and Level 4 Fraud Investigator apprenticeship that includes skills and competences that are automated within workflow within the BLD Secure Events Platform Services SaaS portfolio. ; ; The social value of these contributions is explicitly measured by assessing the extent to which they contribute to reducing disparities in public sector contributions to the local community, support for interagency services, employment support, educational opportunities for new workforce entrants, along with poorly measured however essential economic resources between police forces (mutual aid benefits realisation).

  Wellbeing

  Implementing the automation of Secure Events Platform Services , prioritises professional reach back and lawfulness along with work-life balance and flexibility. This supports emotional wellbeing by reduces stress and burnout associated with overwork and excessive job demands. These services are highly technical and need collaborative working environments to develop and iterate new solutions and drive effectiveness. The tools and services provided through BLD saves significant time and effort in this endeavour. The wellbeing of officers and the wellbeing of the public is enhanced by faster results in deduction of fact. SEPS events improves relations with government organisations and in the community with the enhanced optics that crime, hate and fraud is being tackled. ; ; The social value of these contributions can be measured by assessing their impact on key indicators of individual wellbeing, such as physical health, mental health, work-life balance, trust from the community in recovery of trust in public services along with overall satisfaction with life. SEPS is an underpinning tool of events and communications hubs that adds to disruption to organised crime and hate based narratives that are destructive to the wellbeing in society.

Pricing

• Price: £1,995.00 to £100,000 a unit a day
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: SEPS includes all AV, Security Cleared operators and producers. Media development, digital signage and supply of AV for sponsors and attendees. All networks and streaming can be highly secured for sensitive equities and events. Team accommodation and travel expenses are not included.

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at claire.stanley@bluelightsdigital.com. Tell them what format you need. It will help if you say what assistive technology you use.