ANS GROUP LIMITED

Microsoft Power Platform Ecosystem Navigator

Power Platform Ecosystem Navigator guides your low-code journey through collaborative workshops, an assessment of your current ecosystem, and governance experience. Deliverables include an Ecosystem Assessment Report, Digital Guardrails, and proposals for an Ecosystem Enablement Pack and Managed Services, advising next steps for future success.

Features

• Installation/review of Microsoft CoE Kit.
• Evaluation of operational and security readiness
• Detailed maturity assessment using our proprietary model
• Deep technical assessment of guardrails by evaluating area of platform

Benefits

• Establish Power Platform strategy across your business for 6-to-12-month plan.
• Enhanced visibility and initial governance actions
• Understand operational readiness and highlight areas requiring improvement
• Ensure proper installation of Microsoft CoE Tool Kit
• Provide a detailed maturity assessment covering different areas of adoption
• Outline platform vulnerabilities with action points

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@ansgroup.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

506686303881509

Contact

Steve Carroll
+44 (0) 1612271000
tenders@ansgroup.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Application platforms

  Deployment centric application platforms

  • Application Server Software Platforms
  • Cloud Deployment-Centric Application Platforms
  • Transaction Processing Monitors
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Microsoft Power Platform Solutions are cloud based, therefore to access solutions there are system requirements, limits, supported platforms, browsers and operating systems. These are kept up to date by Microsoft and can be easily found on Microsoft Learn, example link below (https://learn.microsoft.com/en-us/power-apps/limits-and-config)
• System requirements: Suitable Microsoft Power Platform Licenses needed to be in place

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Customers will be able to take advantage of industry leading certified engineers and experts on the end of the phone 24x7x365.The service desk is backed by ITIL aligned process and provides comprehensive Response SLAs from P1 to P5:; ; P1 - 30 Mins ; P2 - 1 Hour ; P3 - 4 Hours ; P4 - 1 Day ; P5 - 2 Days; ; All incidents are recorded in ANS’ Service Desk ITSM system under the Incident Management workflow. ANS records the name of the person reporting the incident, call time and any pertinent information, along with resolution criteria ensuring that the workflow is initiated correctly.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Integration with Microsoft Teams / Slack
• Onsite support: No
• Support levels: All ANS customers have access to ticket and telephone-based support, unless they choose to take an unmanaged service. Customers have access to a named Account Manager who takes overall responsibility for the customer's commercial, technical and support relationship with ANS. Customers are assigned a support "pod" based on the type of solution they have with ANS. This ensures customers will always be supported by the same core team of support engineers who are technical experts in their particular solution. Enterprise and public sector customers also have access to a named Customer Success Manager in addition to their Account Manager.; ; Standard support is provided 08:00 to 18:00 Monday to Friday and includes 1st line (User support) through to system management, monitoring and administration. Additional support is available to extend the service support to 24/7 at additional cost.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: At ANS, we believe that helping our clients prepare for, implement and manage organisational change is paramount if they are to achieve long-term success. ANS are highly focused on helping customers to achieve full user adoption with certified Prosci ADKAR Change Management skills across the team.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • PowerPoint
  • Lucid Chart (Whiteboarding)
• End-of-contract data extraction: Should the contract end for any reason, ANS will need to assess what steps need to be followed to ensure data is extracted efficiently.
• End-of-contract process: This scenario will need to be discussed on a case by case basis. Access to the support service will end when the contract does.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Power Platform solutions on mobile and desktop platforms offers unique experiences optimised for the respective devices. Mobile solutions prioritise simplicity, mobility, and touch interactions, while desktop solutions emphasise advanced functionality, multi-tasking, and precision control.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have designers available if required to assist with designing any Power App Canvas solutions to meet accessibility standards if required. We also can include additional interface testing which carry out ; 1. Screen Reader Testing; 2. Keyboard Navigation Testing; 3. Colour Contrast Testing; 4. Zoom & Magnification Testing; 5. Alternative Text (Alt Text) Testing; 6. Form Field Testing; 7. Assistive Technology Compatibility Testing
• API: Yes
• What users can and can't do using the API: The Microsoft Power Platform APIs offer extensive capabilities for integration, automation, and custom application development within the Power Platform ecosystem. These APIs enable various functionalities such as:; 1. Integration with External Systems; 2. Custom Application Development; 3. Automation; 4. Data Manipulation; 5. Authentication and Security; Limitations and things that cannot be done through the API are:; 1. Direct Access to Backend Services; 2. Highly Complex Development Scenarios; 3. Bypassing Platform Governance.
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: We tailor the engagement based on the customer's exact requirements and this is done via the navigator process where we understand the requirements and tailor our services accordingly.

Scaling

• Independence of resources: Microsoft has taken significant steps to ensure that users are not adversely affected by the demand placed on their platforms, especially during critical situations. Microsoft has a commitment to scalability, innovation, and rapid response helps ensure that users can access their services without significant disruptions due to increased demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Service Metrics and Analytics can be accessed via the platform, which helps you demonstrate impact, prioritise efforts, and optimise your usage with standard reports.
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Using standard out-of-the box export functionality.
• Data export formats:
  • CSV
  • Other
• Other data export formats: XLSX
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • XLSX
  • TXT

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: Microsoft Service Level Agreements (SLA) are detailed here (https://www.microsoft.com/licensing/docs/view/Service-Level-Agreements-SLA-for-Online-Services).; Microsoft Key points are:; 1. Availability Guarantee; 2. Downtime and Maintenance; 3. Service Health and Continuity; 4. Data Location and Sovereignty
• Approach to resilience: Microsoft platforms are designed with robust resiliency features to ensure high availability and reliability. Key aspects of its design:; 1. Redundant Architecture; 2. Data Replication; 3. Automated Integrity Checking; 4. Active / Active Design; 5. Enterprise Resilience and Crisis Management (ERCM).; For more detail is available via (https://learn.microsoft.com/en-us/compliance/assurance/assurance-resiliency-and-continuity)
• Outage reporting: Microsoft provides several ways to report and stay informed about service outages and issues. ; 1. Microsoft Service Health Status Page; 2. Report an issue on the Service Health Page; 3. Third party monitor tools (such as Downdector); 4. Azure Status Page; More detail can be found on Microsoft Learn (https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health?view=o365-worldwide)

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Following strategies can be employed to enhance security and governance in the Microsoft platform:; 1. Managed Environments; 2. Tenant Isolation; 3. Disable Anonymous Access; 4. Azure AD Groups and Policies
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ANS follows the following security policies and processes:; Core Policies:; ANS has an Information Security Policy; ANS has an Information Security Policy Statement; ANS has an Acceptable Use Policy; ANS has Cloud & Data Governance Policies; ; We align to the following Security Frameworks & Standards:; ISO 27001:2022; ISO 27017 & ISO 27018; NCSC Cloud Security Principles; SOC2, IASME, NCSC CAF (in practice assessments); ; We have well defined Operational Processes for:; Incident handling (detect → respond → recover → lessons learned); Compliance & governance reviews; Security configuration management; Continuous monitoring & risk management; Access control & identity governance; Mandatory security training; Phishing & threat reporting processes; ; We also following a number of Technology‑Centric Controls, such as:; DLP, information protection, insider risk; Defender XDR baselines; Purview governance; Logging & monitoring; Emergency response for major incidents
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Internal ANS Change is managed through the application of standard project management process with all projects progressing through approval, CAB review and sign off by stage. All ANS Business Change includes the following managed stages (whether these are deployed on a formal or informal basis is determined by the size of the project, by cost, resource application and risk):; ; • Executive or Higher Management sponsor; • Business Case and Success Criteria; • Scope definition; • Documentation; • Risk & Opportunity assessment; • Milestone or stage review; • Stage sign off; • Final Review; • Testing; • Deployment; • Lessons Learned
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Though these are developed in line with ISO27001 and Cyber Essentials, the vulnerability management approach is dictated by the specific requirements of the Application being developed.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: ANS has implemented an Information Security Management System (ISMS), complaint and certified with ISO 27001. This system is supported by the ISMS manual, detailed policies and procedures, and underpinned by the pragmatic application of industry best practice. We assess potential compromises to services via IDS/ IPS, DDoS, AV, FIM - all in place and monitored 24/7. We obtain information regarding potential threats from NCSC and via our vendor partner status. We deploy patches to services - within 7 days for criticals, 14 for high and 30 days for mediums.
• Incident management type: Supplier-defined controls
• Incident management approach: ANS operates a structured incident‑management process with predefined workflows for common events, aligned to priority levels (P1–P5). Users report incidents via the ANS Glass portal, phone, email, or service desk, with P1 issues requiring immediate phone escalation. All actions and updates are logged throughout the lifecycle, and customers receive periodic progress updates. After resolution - especially for major or P1 incidents - ANS provides incident reports and, where required, root‑cause analysis to support transparency and service improvement.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: The trials we provide are subject to eligibility for Microsoft funding, which depends on the customer's spend for Microsoft Stack.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2.5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Tuesday 24 June 2025
• What the ISO/IEC 27001 doesn’t cover: N/A - Full scope
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: LRQA
• ISO 9001 accreditation date: Tuesday 24 June 2025
• What the ISO 9001 doesn’t cover: N/A - Full Scope
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: PCI Security Standards Council
• PCI DSS accreditation date: Friday 8 August 2025
• What the PCI DSS doesn’t cover: No cardholder data in scope.; No insecure services, protocols, or daemons.; No wireless networks in scope.; ANS does not have access to any cardholder data.; ANS does not have access to any cardholder data.; All in-scope servers have Windows; Defender AV solution installed.; All removable media is disabled by default; No bespoke and custom software development; The only bespoke solution is TechDB; No public-facing web applications in scope.; No pre-production environment; No system development; No application and system accounts in scope.; No user access to query repositories of stored cardholder data.; No remote access to customer premises; No cardholder data or customer access in scope.; MFA system is not susceptible to replay attacks; No application and system accounts that can be used interactively.; No media with cardholder data.; No hard-copy materials with cardholder data.; No POI devices that capture payment card data in scope.; No CHD in scope.; ANS is not a multi-tenant provider.; No payment pages in scope.; No cryptographic suites or protocols in scope.; There are no TPSPs in scope.; There is no cardholder data in scope.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: C0b25fab-fa90-4e67-a2eb-851d67f11fd9
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 9f752e61-ca81-49da-a1d0-5b982f14ce38
• Other security certifications: Yes
• Any other security certifications:
  • ISO27018: 2019
  • ISO42001 - AI
  • ISO27017: 2015

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@ansgroup.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.