JML SOFTWARE SOLUTIONS LIMITED

Chronicle Systems

Captures occupational and operational competency against defined skills sets in highly regulated environments. Supports strategic threat & risk assessment and ensures capacity and capability meets demand.
Access to Firearms and high value assets can be managed virtually or physically based on accreditation against a defined role or skill set.

Features

• Management of specialist skills training and development
• Management of specialist and high value assets
• Real-time overview of accredited staff facilitating resource management
• Real-time automated approval for issue of assets
• Captures operational deployments and informs STRA reporting
• Fully configurable to match licencing and monitoring requirements of organisation
• Configurable real time notifications for exception reporting
• Full interface to HR/ERP systems available
• Full audit trail of transactional history
• Reporting and resource demand analysis functionality

Benefits

• Risk mitigation over access to specialist and high value assets
• Real-time identification of specialist skilled individuals available for deployment
• Ensures compliance with organisational policies and external regulations
• Ensures capacity and capability matches demand
• Reduces risk for organisation, employees and the public
• Proven assurance under external scrutiny
• Optimises operational performance and reduces financial overhead
• Single source of truth re available assets and resources
• Proactive decision making resulting from notifications
• Optimise performance, evidence compliance, reduce risk and costs

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at diane.finn@polarissoftware.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

667701746039189

Contact

Diane Finn
03332412205
diane.finn@polarissoftware.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Public Order and Safety
  • Police
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: If required - Door Access Control and Asset Management Issue and Return Stations require physical devices to be installed to call the cloud hosted web service. Deployments are planned and communicated a month in advance and will include planned system downtime.
• System requirements:
  • Windows 10 or above PC for Door Access Control
  • Windows 10 or above PC for Issue and Return Stations

User support

• Email or online ticketing support: Yes
• Support response times: Response within 60 minutes, Monday – Friday excluding Bank Holidays 8:30am – 5:00pm
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard Support; Cost is included in monthly per user amount.; Access to Phone and Email Support with responses in less than an hour to all enquiries.; Email & Phone Working Days, Business Hours; Scheduled deployments during working hours.; Other support options possible on request.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Chronicle provides comprehensive on boarding services which can be applied against a small number of departmental users or an organisation as a whole. The on boarding process enables the end user to collate the required information from multiple sources into a single excel sheet. The collated information is then imported to Chronicle to enable a single view of the data obtained from multiple sources, enabling advantage to be taken of Chronicle in a matter of a few days. Support from a Services Manager is provided throughout this process, ensuring that appropriate data is captured and subsequently imported to Chronicle with minimal disruption to the end user.; Training can be provided on-site or via video link and Polaris provides user guides, quick reference guides and training videos through the Support Portal on our website.; User Documentation is also accessable so users can self serve and configure themselves.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Database can be exported and imported into any appropriate system which conforms to the same standard and can support the audit trail provided by Chronicle.
• End-of-contract process: All customer data and configuration is extracted and delivered by secure medium to a single nominated location.; On receipt of the extracted data, the Chronicle database is cleared and erased using industry standard tools. Confirmation of data and configuration erasure is provided to the end user.; Finally, the virtual hardware utilised is destroyed with source files erased.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Accessible via knowledge base on support portal

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Chronicle provides inbound and outbound APIs, which enable the import of user data from third party systems, such as HR applications, along with the export of user and skill-based data to third party systems such as Duties, HR or Learning Management.; The inbound API is configurable by users via a configuration file where users define which fields the API will expect to be transferred to Chronicle from the external third-party system. There are Mandatory fields required by the API, along with optional fields that the user can choose from. Users can also “map” fields within the configuration to enable the API to transpose data within the interface, to cater for data descriptions differing in the third-party system and Chronicle.; The outbound API enables the user to configure formatted exports of officer and skills-based data for all, or selected Chronicle modules. The data can be output at a configurable schedule, or on an ad-hoc basis. The end user can manipulate the data to produce output in any format, such as CSV, XML, JSON etc. as required by the third-party system accepting the data. Multiple, differently formatted data exports can be created by the API at the same time.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Users with the right level of permission can define organisational role profiles for skill accreditation and compliance.

Scaling

• Independence of resources: We do not guarantee complete isolation from the effects of other users’ demand, but we work with customers during onboarding, implementation and UAT to size and configure the service appropriately for expected usage levels, and we continuously monitor performance and capacity throughout the contract to ensure the service remains stable and responsive. Where necessary, we adjust resources and configuration to maintain agreed performance levels.

Analytics

• Service usage metrics: Yes
• Metrics types: Login Volume,; Bandwidth and Machine Usage,; Uptime over a Time Period.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Other
• Other data at rest protection approach: We use token authentication for communication via rest service.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Web Front End provides functionality to export a breakdown of information.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Rtf
  • Xls
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Rtf
  • Xls

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: We are committed to providing a highly available and responsive service supported by defined service level targets (SLAs). Our service is designed and operated to minimise disruption and to ensure timely response and resolution of incidents based on their severity.; ; Service availability is supported through proactive monitoring, incident management processes, and priority-based response handling.; ; Service Level Agreements (SLAs); We operate a priority-based support SLA that defines response and resolution targets according to incident severity:; ; Priority First Reply Time Requester Wait Time; Urgent 20 minutes 12 hours; High 40 minutes 12 hours; Normal 1 hour 56 hours; Low 8 hours 30 minutes. 120 hours; ; First reply time is the maximum time before initial acknowledgement and engagement.; ; Requester wait time is the target time to provide a resolution or agreed workaround.; ; Incidents are categorised by impact and urgency in agreement with the customer.
• Approach to resilience: Full details available on request.; ; Data is replicated across physical sites and each Datacentre has built in redundancy of n+1 in Cooling, Power Generation and Hardware.
• Outage reporting: The solution includes automatic up time monitoring and Email alerts are sent in the event of an outage.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Username or password
• Access restrictions in management interfaces and support channels: The Chronicle Control Panel provides an interface to the configuration and management of the Chronicle application. The Control Panel is restricted to authorised users and controlled by user ID and password.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Description of management access authentication: Users authenticate by either entering username and password, or via an Oauth provider (we currently support Microsoft EntraID and ADFS)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO 9001; Cyber Essentials Plus; Police Approved Secure Facility
• Information security policies and processes: Our security governance and controls are aligned to our ISO 27001 policies including access control, physical security and best practise. We have also been certified to Cyber Essentials Plus and ISO 9001. We align to the NCSC cloud security principles including data in transit, audit and monitoring and supply chain security. ; We have established clear roles and responsabilities for security and also build security inot our service design through configuration, design and data flows.; Our solution integrates with a SIEM solution which reviews logs for anomolies and process are regularly reviewed.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We have an ISO 27001 compliant Change and Configuration Management Policy which covers changes made to Software and Systems.; Security impact is quantified in line with this policy.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We continuously monitor our systems using automated vulnerability scanners, review threat intelligence, and conduct regular security testing. Identified vulnerabilities are evaluated based on severity, exploitability, and impact to prioritise remediation.; ; We follow a severity-based SLA:; Critical vulnerabilities: patched as quickly as possible (often within 24–72 hours).; High severity: typically within 1 week.; Lower severity: scheduled in routine maintenance cycles.; ; We use multiple sources to gather information about potential threats through vendor advisories, CVE recommendations, threat intelligence services and internal monitoring tools to stay informed about emerging risks.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use continuous monitoring, log analysis, intrusion detection, and threat intelligence to detect suspicious or abnormal activity.; We follow a structured incident response process: investigate, contain, eradicate the threat, recover systems, and document the incident.; Critical incidents are addressed immediately (24/7), with all other incidents handled according to defined severity-based response times.
• Incident management type: Supplier-defined controls
• Incident management approach: Our Information Security Incident Management policy defines processes for reporting, responding to, and managing security events that compromise confidentiality, integrity, or availability. It mandates prompt reporting via our ticketing systems, communication channels, local processes, or email. Our processes outline personal data breach handling, evidence maintenance, awareness training, and root cause analysis for continuous improvement. We can share our incident handling policy upon request.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Police National Network (PNN)
  • Other
• Other public sector networks: LECN

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 30%
• Between £250,000 and £500,000: 32.5%
• Between £500,001 and £1,000,000: 35%
• Between £1,000,001 and £2,500,000: 37.5%
• Between £2,500,001 and £5,000,000: 40%
• Over £5,000,001: 42.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Monday 2 September 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISO certifications cover all operational, technical and organisational processes.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Thursday 27 June 2024
• What the ISO 9001 doesn’t cover: Our ISO certifications cover all operational, technical and organisational processes.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Securious Limited
• PCI DSS accreditation date: Wednesday 2 April 2025
• What the PCI DSS doesn’t cover: Polaris Software has demonstrated compliance with all PCI DSS requirements.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Db8897c3-145d-4e0d-8989-c6ab205acb84
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 96a86d54-db53-4ee5-8245-0d6fe29b7579
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at diane.finn@polarissoftware.com. Tell them what format you need. It will help if you say what assistive technology you use.