F-24 UK LIMITED

FACT24 ENS + / CIM

FACT24 is a crisis and emergency notification and communication platform. CIM, or Crisis Information Management, refers to the systematic process and systems (like FACT24) used to manage data, information, and communication during a crisis . They are both essential components of crisis management and business continuity

Features

• Mass Communication (SMS, Voice, Email, Push, FAX, MS Teams)
• Video and Voice Conference Calling
• Incident / daily operational logging
• Document Storage and Distribution
• Incident Reporting
• Crisis Action Cards / checklists
• Persons of Concern / Next of kin management
• Incident Escalation
• International Emergency Number
• API / System integrations

Benefits

• Improve staff communication speed
• Incident response improvement
• Independent of company IT infrastructure

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at office_uk@f24.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

602887384637048

Contact

John Davison
01923432715
office_uk@f24.com

About the service

• Service categories:
  • Application Development and Deployment
    • Application platforms
      • Model driven application platforms
        • Model driven application platforms
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: API, Video Conference Calling, Lone Worker Capability, Alerting via MS Teams, Launch forms, SSO etc
• Cloud deployment model: Private cloud
• Service constraints: 99.99 Service Availability
• System requirements: None

User support

• Email or online ticketing support: Yes
• Support response times: 24/7 support available. Although we do not contract to an exact response time, we normally respond within 10 minutes of the ticket 24 hours x 365 days.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: F24 provide 24x7x365 first line support. Each client is assigned a Customer Success Manager (CSM) who will work with a client at implementation phase and as ongoing assistance to ensure training and configuration of the system is sufficient for client needs.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We offer full scoping session with each client to review their individual requirements. Such meetings are typically done either onsite or online, depending upon client preference.; ; Thereafter we'll agree a bespoke training and configuration package of the system, including help setting up data import and any API / SFTP file transfer. ; ; F24 Customer Success Team work thereafter with clients to set up and configure the account along with providing user training for system administrators and activators.; ; Training is provided online or face to face, depending upon client preference and locations of users. Video training tutorials can be recorded and are bespoke to each client. ; ; Full user documentation is provided.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Via online help portal. ; ; FACT24 ENS+ was externally audited against WCAG2.2 in December 2026 and we're currently reviewing the findings of this in order to implement any remedial measures required in order to achieve our desired compliance level of WCAG2.2 AA later in 2026.
• End-of-contract data extraction: Data can be extracted as a PDF, Excel and CSV file format.
• End-of-contract process: There are no additional costs associated with termination.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile applications are generally used to activate the solution, view incident logs, and also more widely to receive push notification alerts. ; ; Therefore the full administrative interface is only available via the full web version.
• Service interface: Yes
• Description of service interface: The Service Graphic User Interface is generally only accessible to administrative users of the system, in terms of how they administer the system & activate alerts. ; ; There is also REST API to allow Machine to Machine to connection.; ; The majority of those that interact with the system would receive the output of the solution in terms of SMS, Voice Calls, Emails and Push Notifications. ; ; FACT24 ENS+ User Interface has recently been externally audited under WCAG2.2 and we are conducting the remedial work to allow compliance with WCAG 2.2AA as a minimum.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: First external audit conducted by https://www.materna.de/en/ against WCAG2.2AA in December 2025.; ; The initial report was provided in January 2026 to allow F24 review prior to implementation of recommendations to achieve compliance to WCAG2.2 AA
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: The FACT24 ENS+ External API is a RESTful interface for integrating with the FACT24 ENS+ emergency notification and alerting platform. It allows external systems to manage organizational data and to trigger and control notifications and alarms programmatically.; In summary, the API provides functionality to:; Authenticate and manage sessions (token-based authentication and refresh).; Manage organizational structures such as departments and groups.; Manage people/persons (create, update, import, and look up contacts/recipients).; Manage profiles and emergency plans that define notification behavior and escalation logic.; Configure and manage alarm settings.; Send notifications directly (with or without predefined alarm settings).; Create, trigger, retrieve, and control alarms within the ENS+ system.; Overall, the API is designed to enable automated emergency communication workflows, keeping contact data in sync and allowing third-party systems to initiate and manage alerts in FACT24 ENS+
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: He application implements rate limiting mechanisms at both the user and account levels. These measures are designed to regulate the number of requests that can be made within a defined time period, ensuring fair and reliable access to the system. By preventing excessive usage by individual users or customer accounts, the application safeguards overall performance and availability, so that no single party can negatively impact the experience of others.

Analytics

• Service usage metrics: Yes
• Metrics types: System usage, which includes:-; ; Number of triggered alarms, Number of notified persons, Number of SMS notifications (parts), Landline seconds, Mobile seconds Number of push notifications
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Data at Rest; Data at Rest is encrypted with AES-256-XT.; Customer data is persisted in the Database Cluster Nodes. The mount-points where the database stores the data; must be encrypted either at hardware-level (using SSD encryption) or on OS level using e.g. LUKS.; Data Storage Objects like files must be encrypted either at hardware-level (using SSD encryption) or on OS level; using e.g. LUKS.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users can export data into CSV format.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: FACT24 ENS+ Alerting Service; 4.1.1. Description; Alerting Service covers notification of selected participants in accordance to defined alerting; scenarios, across all communication channels.; 4.1.2. Availability; Target Availability; 99.99% (combined availability of all activation channels incl.; telephony); ; This portal allowes the user to administrate the FACT24 account via a web application. This; includes the setup and change of all base data and the access to the web-based alarm; activation.; 4.2.2. Availability; Target Availability; 99.5%
• Approach to resilience: Available on request
• Outage reporting: System availability is reported monthly via the F24 website - https://fact24.f24.com/en/product/availability-and-certification-2/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is secured by personal multi-factor authentication and a central Identity Policy & Audit-System.; For the administration of the environment, separate Management Zone in use. This doesn't allow a direct connection to the internet.; Firewalls / Security Gateways and TIER based environments in use.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO27001 and ISO22301 - externally audited by the BSI. Certificates and SOA available on request.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: F24 is ISO/IEC 27001 and ISO 22301 certified. Change Management process implemented and part of our Certification. Central patch management in place. Changes are documented, tested and approved by IT manager or the CISO prior the implementation.Information on maintenance measures or product updates is provided via admin-newsletter.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability assessments are part of the secure coding guidelines of F24 and follows the SDLC and software development best practices for coding. F24 performs host agent based vulnerability scans and also external security scans. F24 uses OWASP 10 for code analysis and SONAR QUBE for static analysis (SAST). For vulnerability scans we use QUALYS (all weekly basis).; Annually there is a Pen Test performed by an external renowned company (besides others: White & Black Box Tests and OWASP Threat Detection).
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use "enterprise grade technologies" SIEM to provide our teams with centralized logging and monitoring. It includes reports and triggers alerts 24/7 in the event of deviations.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: Incident Management and Response Process in place. BCP in place according to our ISO 22301 certification. Emergency response Team is available, external 24/7 Forensic team contracted. Customer will be informed in case of customer data is or could be harmed.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Typically 30 day trial is available - longer on request and upon agreement. The trial functionality is based on agreement / client needs.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10.0%
• Between £250,000 and £500,000: 20.0%
• Between £500,001 and £1,000,000: 30.0%
• Between £1,000,001 and £2,500,000: 40.0%
• Between £2,500,001 and £5,000,000: 45.0%
• Over £5,000,001: 50%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI
• ISO/IEC 27001 accreditation date: Monday 10 November 2025
• What the ISO/IEC 27001 doesn’t cover: SOA available on request. Certification cover internal operation and delivery of the FACT24 service
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications: ISO22301

Social value

• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
  • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
  • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
  • Introducing transparency to pay and reward processes
  • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at office_uk@f24.com. Tell them what format you need. It will help if you say what assistive technology you use.