FORWARD CARERS C.I.C.

iCASPAR

iCASPAR is a secure, cloud-based Software as a Service (SaaS) platform enabling carers to complete a Carers Assessment and create a personalised Support Plan. It provides self-service access to a 'What If' contingency plan, Carer-Friendly ID Card, documentation library, and resources, supporting efficient, compliant and secure carer engagement and support.

Features

• Online Carer Assessment and Support Planning tools.
• Wellbeing tracking with mood and progress monitoring
• Safeguarding alerts and configurable escalation workflows
• Secure remote access from any device.
• Real-time reporting and analytics dashboards.
• "What If” emergency and contingency planning module.
• Digital and Physical Carer-Friendly ID cards.
• Combined documentation and personalised resource library.
• AI-driven chatbot for instant support.
• Predictive analytics providing AI-enhanced insights.

Benefits

• Tracks carer outcomes and demonstrates service impact
• Enables self-service access anytime, anywhere.
• Reduces administrative workload through automation.
• Supports proactive safeguarding and early intervention.
• Provides real-time insights for decision making.
• Delivers personalised content and guidance to carers.
• Enhances engagement via integrated AI chatbot.
• Improves forecasting through predictive analytics.
• Scales easily across organisations and regions.
• Evidences compliance and measurable public-sector value.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Anna.Smith@forwardcarers.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

503847546265817

Contact

Anna Smith
07738398294
Anna.Smith@forwardcarers.org.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Adult Social Care
  • Children's Social Care
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: None.
• System requirements:
  • No local installation or specialist software licences required.
  • Accessible via any modern web browser
  • Supports Chrome, Edge, Safari, and Firefox browsers
  • Stable internet connection of at least 2 Mbps recommended

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: 3 working days
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: No
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: ICASPAR’s web chat uses the Tidio platform, which has been tested for accessibility with assistive technology users. Tidio supports compatibility with screen readers such as NVDA, JAWS, and VoiceOver, and is fully operable via keyboard navigation. Testing confirmed compliance with WCAG 2.2 AA standards for contrast, focus, and text scaling. Feedback from users with visual and motor impairments informed adjustments to prompts, ARIA labels, and message clarity. Ongoing updates are reviewed using Tidio’s accessibility features and independent testing to maintain compliance with the Public Sector Bodies Accessibility Regulations (2018) and ensure inclusive access for all carers and professionals.
• Onsite support: Yes, at extra cost
• Support levels: Forward Carers provides structured, office-hours support for the iCASPAR platform, ensuring timely assistance and continuity of service.; Standard Support is included in all subscriptions and covers access to our online helpdesk and email ticketing system during Monday–Friday, 9am–5pm (UK time). A chatbot provides 24/7 assistance for common queries, troubleshooting. Support requests are acknowledged within one working day, with patches and system updates provided at no additional cost.; Enhanced Support offers a more personalised experience within office hours, including a named contact for escalation, faster response times (typically within four working hours), and priority scheduling for technical reviews or service queries. This option is charged at 10% of the annual subscription fee.; A dedicated Technical Account Manager is available for larger contracts, offering quarterly service reviews, user training sessions, and continuous improvement planning.; All support activity is logged in a secure tracking system with clear SLAs, escalation routes, and audit trails. The combination of AI assistance and human expertise ensures responsive, efficient, and user-friendly support aligned to public-sector service expectations.
• Support available to third parties: No
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Forward Carers provides a structured onboarding programme to help users get started with iCASPAR efficiently and confidently.; New buyers receive:; Online onboarding sessions and walkthrough demonstrations tailored to user roles (administrators, practitioners, and carers).; Access to a comprehensive digital user guide and step-by-step documentation in PDF format.; Optional onsite or virtual training workshops for teams and partner organisations.; Dedicated onboarding support to assist with initial setup, user configuration, and data migration (if applicable).; All training materials are accessible through the iCASPAR portal and designed to meet WCAG 2.2 AA accessibility standards, ensuring inclusivity for all users.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: At the end of the contract, Forward Carers provides buyers with a complete export of their data in open, non-proprietary formats (such as CSV, JSON, or XML) to ensure continued accessibility and interoperability.; Data extraction can be initiated by the buyer through the administration interface or requested via the support desk. Exports include all carer records, assessments, support plans, and audit logs.; Forward Carers offers assistance during data transfer to ensure accuracy and integrity. After confirmation of successful extraction, all buyer data is securely deleted from the iCASPAR environment using cryptographic erasure, in accordance with UK GDPR and NCSC data sanitisation guidance.; Data retention beyond contract termination can be arranged under mutual agreement if needed for statutory or audit purposes.
• End-of-contract process: At the end of the contract, Forward Carers follows a structured offboarding process to ensure data security, continuity, and transparency.; Before contract expiry, buyers receive formal notice and guidance outlining available options — renewal, extension, or termination. Buyers are supported to extract their data in open formats (CSV, JSON, XML) as part of the standard service, at no additional cost. Forward Carers provides step-by-step assistance to ensure data integrity and completeness.; After the buyer confirms successful data retrieval, all records are securely deleted from the iCASPAR environment using cryptographic erasure in compliance with UK GDPR, Cyber Essentials Plus, and NCSC data disposal standards.; If the buyer requests extended access, bespoke data transformation, or migration support to another system, these services are available as chargeable options under a mutually agreed statement of work.; This approach guarantees a controlled, auditable, and fully compliant contract closure.
• Documentation accessibility standard: WCAG 2.2 AAA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: ICASPAR is designed using a responsive, mobile-first approach and works consistently across mobile, tablet, and desktop devices. Core functionality is the same on all devices; differences are limited to layout and interaction to optimise usability. On mobile devices, content is presented in a simplified, single-column layout with touch-friendly controls and step-by-step form progression. On desktop devices, wider screens allow multi-column layouts, side-by-side views, and enhanced navigation for completing longer or more complex tasks. All versions meet WCAG 2.2 AA accessibility standards, with no features restricted by device type.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: ICASPAR is accessed through a secure, web-based service interface available via standard modern web browsers. The interface is responsive and adapts automatically for mobile, tablet, and desktop devices. Users interact with role-based dashboards tailored for carers, practitioners, and administrators, enabling tasks such as registration, assessments, support planning, reviews, and reporting. Navigation is simple and task-focused, with clear headings, progressive disclosure of information, and guided workflows to support users completing statutory social care activities. No specialist software or browser plugins are required to use the service.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility has been embedded into the design and development of iCASPAR from an early stage. The service interface has been tested using common assistive technologies and accessibility tools to ensure compatibility with WCAG 2.2 AA requirements. This includes testing with screen readers (such as NVDA and VoiceOver), keyboard-only navigation, focus management, colour contrast analysis, and text resizing up to 200% without loss of functionality. Forms, error messages, and interactive components have been reviewed to ensure they are perceivable, operable, understandable, and robust. Feedback from users with varying digital confidence levels, including unpaid carers and practitioners, has informed interface improvements such as simplified layouts, clearer labels, and step-by-step task flows. Accessibility testing is repeated as part of ongoing development and prior to major releases.
• API: Yes
• What users can and can't do using the API: ICASPAR includes a secure, limited-access API designed for integration with approved third-party systems such as local authority databases, CRM platforms, and reporting tools.; The API supports push and pull data exchanges for authorised partners, enabling import of assessment data, updates to carer records, and export of outcomes or performance metrics.; API access is not open by default — it is provisioned and configured per client following security and governance approval. All API connections use TLS 1.2+ encryption, token-based authentication, and strict rate limiting.; Users cannot directly alter platform configuration or bypass workflows through the API. All integrations are controlled, auditable, and aligned with NCSC secure integration standards to maintain platform integrity and data protection.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: ICASPAR can be customised within defined configuration parameters to meet each buyer’s operational requirements. Buyers can tailor:; Assessment templates, support plan forms, and question sets; Branding, logos, and local authority identifiers; User roles, permissions, and approval workflows; Reporting dashboards and performance indicators; Resource libraries and help content; Core system functionality and architecture remain standard to maintain security, stability, and compliance.; Customisation is achieved through admin configuration tools, not code-level modification, ensuring ongoing compatibility with updates and support.; This approach provides flexibility while retaining the integrity of a managed, secure SaaS environment.

Scaling

• Independence of resources: ICASPAR is hosted on Microsoft Azure, ensuring scalable, high-performance service delivery. Each client operates in a securely partitioned environment, preventing performance impact from other users. Azure’s auto-scaling and load balancing dynamically allocate resources based on real-time demand, maintaining consistent responsiveness. Continuous performance monitoring through Azure Application Insights enables proactive optimisation before issues arise. All environments are hosted in UK-based Azure data centres, providing resilience, reliability, and compliance with ISO 27001 and NHS DSPT standards. This guarantees stable performance and service continuity regardless of concurrent user activity or overall platform demand.

Analytics

• Service usage metrics: Yes
• Metrics types: User behaviour data.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: ICASPAR provides users with secure, self-service options to export data directly through the administration interface. Authorised users can generate exports of carer records, assessments, support plans, and reporting data in open formats such as CSV, JSON, or XML.; For larger or bespoke data extractions, users can request assistance via the support desk, where exports are securely prepared and transferred through encrypted download links or secure file transfer (SFTP).; All exports are fully auditable and comply with UK GDPR and NCSC data protection principles, ensuring data integrity and confidentiality during transfer.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: ICASPAR is hosted on Microsoft Azure, which provides a resilient, high-availability infrastructure across UK data centres. The service is designed for 99.9% uptime, excluding scheduled maintenance, in line with public-sector standards for critical SaaS platforms.; Availability is continuously monitored through Azure’s status management tools and internal alerting systems. Maintenance windows and updates are scheduled outside normal business hours to minimise disruption.; If uptime falls below the guaranteed level, affected clients are credited a proportion of their monthly service fee, calculated according to the severity and duration of the outage. Service credits or equivalent remedial measures are agreed within the customer contract.; Forward Carers maintains full business continuity and disaster recovery plans, including daily encrypted backups, redundancy across availability zones, and rapid failover to ensure uninterrupted access to carer data and online services.
• Approach to resilience: Approach to Resilience; iCASPAR is hosted on the Microsoft Azure UK cloud platform, which provides enterprise-grade resilience through geographically separated, redundant data centres. Azure’s infrastructure is designed for high availability, fault tolerance, and disaster recovery, ensuring continuity of service even in the event of hardware failure or regional disruption.; Data is replicated across multiple UK availability zones, and all components benefit from automatic failover mechanisms. Regular encrypted backups are performed daily, with recovery testing incorporated into Forward Carers’ business continuity plan.; Network and system monitoring tools continuously assess performance and availability, triggering proactive alerts if degradation is detected. Maintenance is scheduled to minimise user disruption.
• Outage reporting: ICASPAR uses a structured email alert system to notify clients of any service outages or performance issues. In the event of planned maintenance, degradation, or unplanned downtime, all registered administrative contacts receive email notifications detailing the issue, impact, and expected resolution time. Updates are issued at key stages until normal service is restored.; Post-incident reports summarising cause, resolution, and preventative measures are shared with affected customers. Outage management and communication are coordinated through Forward Carers’ service desk within office hours, with 24/7 monitoring provided by Microsoft Azure infrastructure tools.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to iCASPAR’s management interfaces is strictly limited to authorised, security-vetted staff following the principle of least privilege. Administrator accounts require Multi-Factor Authentication (MFA) and are role-based to prevent unnecessary permissions. All administrative actions are logged and reviewed through Azure Security Centre.; Support channels are accessed only via secure, authenticated accounts within our service desk system. Sensitive information shared through support requests is encrypted in transit and at rest. Session time-outs, audit trails, and regular access reviews ensure ongoing compliance with Cyber Essentials Plus and NCSC operational security guidance.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • Other
• Other security governance standards: ICASPAR platform complies with CSA CCM v4.0 and ISO/IEC 27001 standards. Forward Carers holds Cyber Essentials Plus certification, confirming adherence to government-endorsed cybersecurity controls for data protection, access management, and threat prevention. These combined standards ensure governance and operational security aligned with UK public-sector expectations.
• Information security policies and processes: Forward Carers follows a comprehensive Information Security Management Framework aligned with Cyber Essentials Plus and the UK Government’s Security Policy Framework. Our policies cover data protection, access control, incident response, acceptable use, and supplier management.; The Information Governance Lead oversees policy implementation and compliance, supported by the Data Protection Officer (DPO) and senior management team. Security responsibilities are clearly defined within all staff roles.; Policies are reviewed annually, approved by senior leadership, and updated in line with changes to UK GDPR, NHS DSPT, and public-sector security standards.; Compliance is ensured through mandatory staff training, access auditing, penetration testing, and periodic reviews. Any suspected or actual incidents are logged and escalated through a formal incident response process, including root cause analysis and corrective actions.; iCASPAR’s hosting on Microsoft Azure extends compliance with ISO/IEC 27001 and CSA CCM v4.0 for physical and cloud infrastructure controls.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All iCASPAR components are version-controlled and tracked throughout their lifecycle using secure configuration management tools. Changes follow a formal change control process, including impact assessment, approval, testing, and documented release. Each change is reviewed for potential security, performance, and compliance implications before deployment. Audit logs record configuration modifications, enabling full traceability and rollback if required. Updates are first applied to a staging environment for verification before production release. Forward Carers’ approach aligns with Cyber Essentials Plus and CSA CCM v4.0 standards, ensuring stable, secure, and controlled service evolution within Microsoft Azure’s compliant infrastructure.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Forward Carers operates a proactive vulnerability management process aligned with Cyber Essentials Plus and Azure Security best practices. Potential threats are continuously assessed through automated monitoring, vulnerability scanning, and review of threat intelligence from Microsoft Defender Threat Intelligence, NCSC advisories, and CVE databases. Security updates and critical patches are prioritised and deployed within 24–72 hours of release, depending on severity. Non-critical patches are applied during scheduled maintenance windows following testing. Regular penetration testing, system audits, and configuration reviews ensure emerging vulnerabilities are identified early. All actions are documented, tracked, and verified through change control to maintain service integrity and compliance.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: ICASPAR uses Microsoft Azure Security Centre and Defender for Cloud to continuously monitor system activity, logs, and network traffic for unusual or suspicious behaviour. Automated alerts identify potential compromises, such as unauthorised access or anomalous data patterns. On detection, incidents are immediately escalated to the Information Governance Lead and investigated within four working hours. Containment, remediation, and root cause analysis follow defined incident response procedures. Security logs and alerts are reviewed daily, with summary reports analysed to improve resilience and prevent recurrence of future security threats or vulnerabilities.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Forward Carers maintains a robust Incident Management Policy aligned with Cyber Essentials Plus, ISO 27035, and NCSC guidance on post-quantum cryptography security. Pre-defined procedures address common incidents such as data breaches, service outages, and unauthorised access. Users can report incidents via the iCASPAR helpdesk, AI chatbot, or secure email. All incidents are logged and monitored through the Quantum incident tracking system, enabling swift triage, investigation, and escalation. Forward Carers’ encryption, key management, and response processes adhere to post-quantum cryptographic readiness principles, ensuring continued data protection, integrity, and resilience throughout any security event.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2.5%
• Between £500,001 and £1,000,000: 3%
• Between £1,000,001 and £2,500,000: 3%
• Between £2,500,001 and £5,000,000: 3%
• Over £5,000,001: 3%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Bb0a6f24-5aaf-484f-bf25-9fcf57f83837
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 7323e8f9-7227-49af-a745-e53e60a23254
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Volunteering opportunities for staff

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Introducing transparency to pay and reward processes
    • Working conditions which promote an inclusive working environment and promote retention and progression

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Anna.Smith@forwardcarers.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.