Cirro

IoT Platform as a Service

IoT Platform-as-a-Service (PaaS) is an advanced suite designed to facilitate the multiple IoT applications and use cases on a single unified IoT platform. With an SDK and API, the applications can be integrated with existing systems and new IoT applications built. For use in smart buildings, cities, parks, health, emergency-services

Features

• Seamless integration, deployment of diverse IoT applications & use cases.
• Any IoT device type, any protocol & any connection method
• Measure and control pollution levels, air, noise and water pollution
• Remote monitoring, timely care, and sensor-based equipment in healthcare
• Highly secure platform end-to-end encryption
• 1000's of pre-integrated devices from main IoT manufacturers
• LoRaWAN, NB-IoT, LTE-M, sigfox connectivity supported
• HTTP, MQTT, TCP/IP, UDP, CoAP transport protocols are supported
• Bluetooth, Modbus, M-Bus, enocean local protocols are supported
• monitor traffic conditions, manage public transportation, and optimise traffic flow

Benefits

• Core IoT lifecycle management application, project management, bespoke development
• Multiple IoT applications and use cases on a single platform
• Smart bins to improve waste management & route collection
• Ability to standardise data for Machine Learning and AI integrations
• Modular approach; Application, ProjectManagement, Integration, Development, ML/AI, Installations
• Sub-metering & Carbon Monitoring - MID certified, reduced energy consumption
• Sub-metering & Carbon Monitoring - MID certified, reduced energy consumption
• Cold Storage and Cold Chain Monitoring
• Legionella Compliance and Water Safety
• Tailored support to suit your needs, service designed to requirements

£3 to £7 a device a month

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michaelo@cirro-solutions.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

561435720912341

Contact

Michael Owen
020 3418 0412
michaelo@cirro-solutions.co.uk

Service scope

• Service constraints: None
• System requirements: 1st Line Helpdesk

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Dependant on severity/priority and customer specific SLA including hours covered.; ; Typically from 30mins to 2hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Multiple support options are available, they include:; IoT Business Case Review. Project Planning. Site Surveys with Risks & Methods. Physical installations. SDK Bespoke Application, API with back office systems. Machine Learning & Predictive Analytics. ; ; Basic support includes:; 2nd line access to support; Remote diagnostics; Proactive performance monitoring and alerting; Support with data standardisation; Charged as a % of the monthly spend; ; Premium Support; Added support for onside support ; Charged as a % of the monthly spend; ; Commercial, project and technical support services are all available
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The IoT SaaS platform and all IoT solution elements are scoped in a SoW so the lines of responsibility are clear. For larger projects, we can provide a project management team to deliver the full SoW including managing the deliverables for all parties. We can also provide onsite engineers to complete site surveys (pre-installation), identify risks and methods for installation, check communications links, and complete IoT device installations. ; ; The core IoT application is handed over to the customer via our professional services team who provide remote training and configuration support.; ; Our application and data scientist provide direct engagement with customers to complete any bespoke development, back-office integration work or the creation of predictive analytics. This is typically managed by a commercially focused technical project manager as agreed within the SoW.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Customers own the data which comes from any IoT deployment. Towards the end of the term, a SoW can be produced which covers the details of any exit for those elements affected. Typically customers will buy the IoT devices and own them as assets, the licensable elements are the core IoT management application and any support for bespoke development or data science work.; ; The data produced for the core IoT application is standardised and can easily be migrated between IoT management platforms that aren’t proprietary. Our professional services team and technical project managers can provide existing or migration support to customers on a T&M basis.; ; Once exited from the IoT platform, a certification of data destruction can also be provided.
• End-of-contract process: Customers own the data which comes from any IoT deployment. Towards the end of the term, a SoW can be produced which covers the details of any exit for those elements affected. Typically customers will buy the IoT devices and own them as assets, the licensable elements are the core IoT management application and any support for bespoke development or data science work.; ; The data produced for the core IoT application is standardised and can easily be migrated between IoT management platforms that aren’t proprietary. Our professional services team and technical project managers can provide existing or migration support to customers on a T&M basis.; ; Once exited from the IoT platform, a certification of data destruction can also be provided.

Using the service

• Web browser interface: Yes
• Using the web interface: The application utilises User Type to control access to specific features and functionality. The application can be fully administered through the Web UI. This includes setting up sites, IoT devices, projects, use cases, data visualisation, resources, jobs, naming conventions, performance dashboards, device status and system alerts. Additionally, all gateways, security, device protocols and networks are all managed through the UI.; ; A separate UI is also available for installation engineers who need to know which devices they need to install and at which locations.
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: Interface available as Web UI via web browser
• Web interface accessibility testing: We use standard Web technologies and security methods to reduce risk, such as HTTPS, SSL and support various access control methods. No specific assistive technology testing has been carried out so far.
• API: Yes
• What users can and can't do using the API: All operations within the core Daizy application can be performed using a RESTful API. The API allows for the management of your organisation's devices (and versions) and their lifecycle. Including audit details. device responses, inventory, device import/export, and bulk subscriptions.; ; Additionally, the API covers all critical operational areas of the core platform to allow for control and data flows, these include:; Gateway, positions, tasks, types; Networks; Organisations; Projects; Users; Tasks; SIM’s; Subscriptions; DataExplorer; Units; Jobs; Notifications
• API automation tools:
  • Chef
  • Terraform
  • Puppet
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Through logical resource segregation and resource allocation to each environment, ensuring consistent performance of all users in each customer environment. This approach ensures no one customer can act as a resource thief against another and that complete independence exists. When customers approach resource limits, auto-scaling can be applied to a predefined upper agreed limit. ; Each customer has a designated resource pool which is proactively monitored and managed.
• Usage notifications: Yes
• Usage reporting:
  • API
  • Email
  • SMS
  • Other
• Other usage reporting: User can utilise the API or SDK t create integrations with existing ticketing systems or notification work streams

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
• Other metrics:
  • Windows event logs
  • Resource history (changes)
  • Application Performance Monitoring
  • Vulnerability Scan alerts
  • Network performance
  • IDS/IPS & Network Security
  • Error alerts - back-up failures
  • Risk register against GDPR, ISO 27001, Cyber Security
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Daizy

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Customer configuration, settings and database
  • Device configuration, settings, changes & audit data
  • Network settings
  • Security & gateway settings
  • Customer policy settings
  • IoT device data
• Backup controls: The IoT SaaS platform back-ups are set at a low level and not by customers individually. The purpose of the backups is to ensure data integrity during any serious outage and to prevent data loss from occurring. The backup routine is designed to comply with ISO 22301 for Business Continuity.
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery: Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: The SLA on the IoT SaaS platform is 99%, and on data integrity, it is 99.999%.; ; Refunds are typically provided as service credits against future invoices. Such credits are calculated based on a given month's uptime of the SaaS platform.; ; No SLA is provided for the availability of gateways or endpoints connecting to third parties through Packet Broker.
• Approach to resilience: The IoT SaaS platform runs in AWS and has deployed instances in EU and UK regions. The platform is designed to be fault-tolerant and is configured to run in high-availability clusters. The platform is backed up regularly with data segregated for quicker restoration. Including snapshots, databases and file-level back-ups.; ; DR testing is regularly performed with any identified risks being reviewed and remedied for continual improvement to service performance, security, data integrity and availability.
• Outage reporting: The Major Incident Process for a core outage ensures that all affected customers are notified at pre-allocated touch points, this is normally via email and phone. Each customer has access to the ticketing system which provides continual updates on any incidents and the Support desk proactively keeps customers informed. ; This process covers:; P1-P2 Core platform and network incidents; P1-P2 Customer-specific platform, Service and networking incidents ; Platform APIs are available that provide performance information and alerts based on thresholds for both Cloud Core and Customer specific elements.; Should a major incident occur, a Root Cause Analysis is completed and delivered to affected users, this details the problem, Severity & Impact, Timeline of Events, Root Cause, Category, Corrective Action Taken, Preventative Action Taken and Service Improvement Actions to mitigate future risk.

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: All management interfaces are only accessible by named and security vetted individuals via a two factor authenticated session on an IPSEC v2 VPN tunnel. All connections are logged and audited. Multiple failed attempts automatically lock the individual user account with automated notification sent. All passwords are timed and must be unique and can't be recycled. Cirro also support Software Defined Networking (SDN) virtualisation technologies, including Network Virtualization using Generic Routing Encapsulation (NVGRE) and Virtual Extensible LAN (VXLAN). These technologies are designed to supported better connectivity, access and scalability specifically for cloud computing environments.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: IQS
• ISO/IEC 27001 accreditation date: 16/07/2024
• What the ISO/IEC 27001 doesn’t cover: Everything outside the core IoT application and operations.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • ISO 22301 - Business Continuity
  • ISO 14001 - Environment
  • ISO 9001 - Quality

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow ISO 27001 Information Security Management Systems (ISMS) and CSA guidelines as well as best practice for Cyber Security.; Our providers are accredited to the appropriate standards, such as ISO 27001, 9001, PCI DSS, Cyber Security Essentials.; Cirro will be completing ISO 27001 independently; Any security incidents are captured and recorded. A full incident response and remedial report is available and provided to an affected customer

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: There are two aspects to Change Control, they are Customer and Supply chances.; ; Customer changes are implemented by a Customer Administrator, this should follow a customer Change Control Process, which the supplier has no control or insight over typically.; ; Supplier Changes; where the Customer asks the Supplier to review major changes for impact and risk as part of the support agreements. Typically the Customer would still implement these changes however the Customer can create an Administrator account for the Supplier to make changes as a trusted 3rd party on the Customer's behalf as part of a Support Agreement.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: All systems are scanned for vulnerabilities every month. Cirro uses the Common Vulnerability Scoring System (CVSS) for all Common Vulnerabilities and Exposures (CVE) provided by the National Vulnerability Database. Scoring for non-CVE vulnerabilities is provided by UB’s vulnerability scanning tool. A priority is placed on patching or mitigating the vulnerability based on these scores and the logical location of the vulnerability within Cirro's network infrastructure. Remediation occurs within 10 business days for critical vulnerabilities.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Our service management processes are ITIL V3 aligned and have a particular focus on Security Incident Management System and Continuous Service Improvement. Some of the components of this system have been provided below: - Network and Host-based IDS/IPS - Traffic monitoring and intelligent traffic analysis - Packet capture and analysis to enable investigations into alerts - DNS monitoring to detect DNS lookups to known or suspected malware - Botnet monitoring – hunts for and alerts on any type of connection - Web and email threat monitoring - Geographic analysis of all attacks and traffic Automated systems ensure ultimate continual protection.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Prevention: The understanding of and application of insight gained from the intelligence Detection: The interpretation of any events of interest occurring to discriminate between legitimate and abnormal events to identify anomalous activity Investigation: The analysis of anomalies to determine whether they are emerging threats that may lead to a security incident Reaction: Our analysts use tailored, predefined and configured Playbooks to efficiently inform their reaction to an identified threat Response: The planning of effective mitigation in response to the cyber-attack, the communication of these plans to all relevant stakeholders, and the collaboration with all relevant parties to carry out mitigation.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: KVM hypervisor
• How shared infrastructure is kept separate: An organisation serves as the container for a tenant, establishing logical boundaries between tenants within the system. Each organisation is uniquely identified by its Org ID. Upon the creation of an organisation, resources are allocated to it. Subsequently, a segregated instance of each User Organisation is established in the application’s database, ensuring that users cannot access other organisations' database structures. Administrator accounts are then generated for customers to access and manage their respective environments.; For further details regarding data integrity, virtualisation, security, and access controls, additional information can be provided upon request.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Data centres adhere to ISO 50001 Energy Management and 14001 Environment Management (which we also hold).

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Commitment to Reduce Carbon Footprint and Climate-Related Initiatives; In alignment with our commitment to reducing our ecological impact, we are dedicated to collaborating with our customers and suppliers to contribute to environmentally sustainable initiatives that improve ecosystems and reduce ecological impact. Our primary objective is to minimise the environmental impact of our operations.; Focus on Environmental Impact Reduction; Our main focus is to engage in discussions with our customers to explore collaborative approaches for reducing the environmental impact, particularly by minimising non-essential travel, to reduce energy usage and wastage of time and materials, all of which have an impact on operational consumption.; As we transition back to regular operations, we are focused on reducing our physical impact, including initiatives such as flexible working, minimising printing, and enhancing recycling efforts.; We are committed to optimising our physical office requirements to ensure efficient resource utilisation.; Future-Focused Solutions and Efficiency; We are dedicated to designing future-oriented solutions that embed efficiency into our design and delivery processes. Leveraging the momentum generated by the pandemic, we aim to build on successful new working methods.; At Cirro, we are continually looking to identify potential improvements in the way we work to improve our operational efficiencies which directly impact energy usage, travel or ecological impact.; ; By championing these initiatives, we are steadfast in our commitment to not only reduce our own ecological impact but also to actively engage with our stakeholders to foster environmental sustainability and support initiatives that have a positive impact on our world.

  Equal opportunity

  Delivering Social Value Theme 4 and PPN 06/20 Model Award Criteria ; ; In the following section, we elaborate on our approach to fulfilling Social Value Theme 4 and the relevant PPN 06/20 Model Award Criteria; ; Our strategy, aligned with WSP’s 2022-24 Inclusion & Diversity Strategy, encompasses the following initiatives:; Skill Development for Underrepresented Groups; We are committed to supporting the development of new skills that lead to recognised qualifications for underrepresented groups.; ; Addressing Inequality in Employment, Skills, and Pay; We will demonstrate a clear commitment to identifying and addressing inequality in employment, skills, and pay within the contract workforce. This includes implementing time-bound action plans to monitor the inclusion and progression of full-time equivalent (FTE) employees from underrepresented groups.; ; Supporting In-Work Progression; Our approach includes support for in-work progression, aiming to assist individuals from disadvantaged or minority groups in transitioning into higher-paid roles by developing new skills relevant to the contract.; ; Real-World Equal Opportunity; When recruiting, Cirro has a policy to ensure that all names, ages, race or gender details are removed from CVs, so we focus on interviewing and employing the most suitable person for the role.

  Wellbeing

  Wellbeing Initiatives; In our commitment to prioritising the well-being of our teams, we are dedicated to supporting the health and well-being of our employees, contractors, suppliers and customers.; ; Flexible Working Support; We offer flexible working conditions to our staff. They have a clearly defined job description, they know what needs to be done and they have the flexibility they need to be able to do that whilst balancing home life, physical and mental health.; ; Internal Support; Cirro’s works typically in virtual teams, it’s important that we have ‘virtual’ tea breaks and have regular discussions. Cirro also keeps an eye on the level of output expectations and workloads of employees to ensure the right resourcing levels and workloads. ; ; During periods of high-intensity working, such as working on tenders, delivering projects or whatever it might be, Cirro ensure employees take time out once this is more practically possible to ensure employees can refresh and relax.

Pricing

• Price: £3 to £7 a device a month
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A tailored trial can be arranged in a limited form for a 30-day period. Customer go through User Acceptance Testing to ensure the Cirro solution is fit for purpose. Trials may be limited in functionality and integration. All Terms & Conditions apply to trial users
• Link to free trial: https://cirro-solutions.co.uk/contact-us

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michaelo@cirro-solutions.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.