TRUST SYSTEMS LIMITED

Trust Cloud

The Service provides a production ready Infrastructure as a Service (IaaS) offering to clients, using Hyper-Converged, Edge Landing, intermediate Local Area Network (LAN) and Firewall technologies.

Features

• Hyper Converged environment using Nutanix Hypervisor, via Secure IPsec VPN
• Dedicated environment is not multi-tenanted
• Solution sized for 75 VM’s using
• Redundancy factor RF2 by default
• Product tier CPU & RAM utilisation max with N+1
• Disk customisable
• Designed for 4vCPU:1Core utilisation
• 150GB Cold Data and 25GB Hot data per VM
• Self Service Portal provides pre-configured BluePrint/API deployment scripts
• Self Service for management, ISO templates and Performance data

Benefits

• Nutanix Acropolis Hypervisor (AVH) and Self-Service Portal (SSP) included
• Dedicated environment not multi-tenanted
• Bronze Managed Service for Monitoring, Reporting and Service Desk included
• Crown Hosting UK Location Secure Government Security Classifications standards
• Nutanix default security baselining (with auto-remediation)
• Nutanix Security Technical Implementation Guide (STIG) included in platform operations
• Self Service Portal provided by Nutanix Prism Central and CALM

• Education pricing available
• Free trial available

Service documents

• Pricing document

  ODT

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at marketing@trustsystems.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

672440198919617

Contact

Trust Sales
01285 898054
marketing@trustsystems.co.uk

About your service

• Service categories:

  IaaS

  IaaS Compute

  • Bare metal
  • Container and serverless engine compute

  Virtualised x86

  • General purpose
  • Compute optimised
  • Memory optimised

Service scope

• Service constraints: Trust Cloud provides a "Template" sized dedicated HCI environments for client workloads reference Trust Cloud Hosting service description.; Customers to provide and perform: ; -VM OS update toolsets ; -VM OS update management ; -Option Bring Your Own Licensing (BYOL) VMware licenses are required; Customer must provide Trust access to the appropriate licensing portals to obtain patches ; -Where BYOL has been provisioned for Windows or Linux services, the customer is responsible for VM OS support. ; -Planned Maintenance to be advised as in the Service T&Cs ; -Access via SSP is limited in relation to the underlying infrastructure provisioned on the nodes of the cluster
• System requirements:
  • Customers provide BYOL for Operating System and Applications
  • Anti-Virus must be provisioned by customer (Bronze service)
  • Additional Trust Cloud services including Anti-Virus are available via LOT3
  • Internet landing implemented via IPsec VPN by default
  • Direct NW presentation e.g., WAN need design engagement LOT3
• Cloud deployment model:
  • Private cloud
  • Hybrid cloud

User support

• Email or online ticketing support: Yes
• Support response times: Trust provides a Bronze Monitoring and Reporting Managed Service. This includes Service Desk ticketing and email support. ; ; This provides 30-minute initial response, resolution target is subject to incident severity grading. ; ; Service desk email and ticketing support to 24x7x365 (subject to agreed service level) with no change in response time outside of normal business hours. ; ; A web interface is available to customers to raise, view and manage current and historic incidents and changes.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: None.
• Onsite support: Yes, at extra cost
• Support levels: Trust Cloud Hosting includes 'Bronze' Support. The cost for this Managed Service is included in the IaaS monthly cost. (See LOT1 Price document); 1. Managed Infrastructure platform, including: ; a. All patching ; b. Support of infrastructure (hardware and software) by Cloud Support Engineers; c. Hardware Break-Fix management of All components ; d. Minor and major upgrades for all elements ; e . Configuration transparent to customer ; 2. Managed Firewall and network configuration, with changes made based on default change package included with service - additional available under LOT3 when base provision exhausted; ; Additional levels of Managed Service are available via LOT3 Trust Cloud Enhanced Silver and Gold Services.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: The onboarding service will include: ; ; 1. Identify requirements for platform to be running, including VMISO template uploads ; ; 2. Identify existing migration requirements, and offer additional services to assist with: ; ; a) Migration of VM’s onto platform; b) VM creation/setup ; ; 3. Onboarding Familiarisation process (2-hour process): ; ; a) Remote based session overview of the management platform, with tutorial of activities including basic remote login, through to deploying, managing IaaS objects and of viewing utilisation ; b) Setting up new objects, IaaS object removal ; ; 4. Standard documentation overview, handover of documents to customers, documentation of setup customer specific platform (including end to end specification) ; ; In addition, the managed service operations: ; ; 1. Support contacts ; 2. Support Portal interface ; 3. Support documents ; 4. Service Delivery Manager contacts, and support escalation contacts ; 5. Service Delivery approach, reviews ; 6. Service Transition including Service Operational Runbooks
• Service documentation: Yes
• Documentation formats:
  • ODF
  • PDF
• End-of-contract data extraction: A Customer ‘exit’ project is started, after notice is served. If the customer requires data secure removal and migration off the IAAS platform the process is: ; -Identify size of requirement/approach (WAN copy/local copy); -Confirm the scope of Professional Services engagement (including day estimate); ; For customers wishing to remove data: ; 1. Formal Service Transition manager project initiated closing all setup service elements and dealing with transition exit according to ITIL framework with checklist of activities ; 2. Quote for required services Professional services from Rate Card ; 3. Copy option:; 3a. Customer given access to copy VM’s remotely over WAN; 3b. Trust Consultancy locally copy data to removable/portable storage media (customer supplied device); 4. HCI IAAS platform erased using Blancco software drive eraser with proof provided via certificate. ; ; Customer not requiring secure wipe (satisfied by Nutanix erase operation on data): ; 1. As per item 1, 2 and 3 above ; 2. Data erased using Nutanix native consoles by Trust
• End-of-contract process: Trust will perform exit according to industry best practice: ; ; Exit is project managed by a Service Transition Manager ** ; ; Agreed extraction and data wipe timescale ; ; Charges for use of any data software (Blancco) ; ; Data off boarding copy local or via network transfer ; ; Network and Service decommissioning ** ; ; Scope of effort and quote provided for exit ; ; Exit will provide time for customers to ‘move’ any data from the system to their own within reasonable limits ; ; Trust will assist with the exit approach if required ** ; ; Trust will perform an exit meeting to identify reasons for exit ; ; **Additional charge applies to professional services engagement; ; For a customer exiting the platform, options are available for data removal from the systems, Trust will use a COTS solution to erase data from the platform disks. The cost of this exit is an additional service cost .; ; Additional costs: ; Service Transition Manager; Professional services to assist with exit; Certificated Data wipe; Secure data copy local device at DC
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Using the web interface: The service includes a web portal for provisioning virtual machines and managing these via a console. Three base sizes of Virtual Machines (VM) can be provisioned on Windows and Linux, with the customer able to expand required configurations. The platform allows the customer to bring own base ISO images if needed (Optional Migration Service required as per LOT3). ; 1. The toolset supports 500 projects ; ; 2. There is a Web interface and API ; ; 3. Security is via local account or Lightweight Directory Access Protocol (LDAP) to customer LDAP if customer requires/allows; ; 4. The SSP Web service uses a base HTTP that redirects to HTTPS; users authenticate and are directed to specific ‘project’ ; ; 5. This is a Commercial off the Shelf (COTS) product widely used for such purposes provided by Nutanix. The web interface will use a public vendor provided SSL certificate for security (as will all customer facing solutions utilizing SSL systems).
• Web interface accessibility standard: WCAG 2.2 A
• Web interface accessibility testing: None.
• API: Yes
• What users can and can't do using the API: Nutanix REST APIs allow creation of scripts to run administration commands. The APIs use HTTP requests using get/post/put (etc) to query and make changes to VMs i.e. create, list VM’s, setting categories, modifying configuration, cloning/snapshotting, power changes and deletion. Output from the commands is in JSON. ; ; Multiple API automation tools can be used, Users are only limited by the supported implementation of the Nutanix REST API version and these tools. Trust do not support setup/usage in the managed service, this would be professional services support under LOT3. Trust provide HTML documentation. Other Tools: ; • Go e.g. Creating multiple VM clones; • PowerShell (Default PowerShell installation with Nutanix commandlets will allow scripts to be run) ; • Python (scripts utilise requests, urllib3/getpass/argparse/json) ; • JSON (Using application e.g. Postman, using JSON scripts for API requests); • BASH - Scripts are standalone and run without dependencies. Scripts utilise jq, (free sed-like JSON processor) ; • PHP (Requires PHP 7.2 or later and are complete, standalone scripts carrying out common API operations) ; • Microsoft C# (Code samples utilise Newtonsoft.Json, a JSON framework for .NET).; Access in CALM DSL and operations are limited to the permissions assigned to users, which is limited to only IAAS operations.
• API automation tools:
  • Ansible
  • Terraform
  • Other
• Other API automation tools:
  • Python
  • Powershell
  • PHP
  • BASH
  • JSON
  • GO
• API documentation: Yes
• API documentation formats:
  • HTML
  • Other
• Command line interface: No

Scaling

• Independence of resources: Trust Cloud uses a dedicated Hyperconverged Infrastructure (HCI) environment to ensure clients are not impacted by the demands of other users on the system. ; ; Trust Cloud uses FortiGate firewall products which will allow for rate limiting of the segmented workloads using Traffic Shaping. The system will be set-up to have up to 10 customers sharing a pair of physical FortiGate devices, and the source/destination interface paths will be configured with traffic shaping according to the limits of the ingress bandwidth service or a 10th share of the overall bandwidth to the upstream LAN switches, whichever is the greatest.
• Usage notifications: Yes
• Usage reporting: Email
• Optimising consumption: Yes
• Automatic scaling: Yes

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • Memory
  • Network
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Other
• Other data at rest protection approach: Software encryption Leveraging a NIST certified FIPS 140-2 level 1 compliant encryption module.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Backup and recovery

• What’s backed up: Virtual Machines
• Backup controls: Base Nutanix system snapshots (stored locally on the cluster) once per day, per IAAS VM; ; Customer self-restore capability ; ; Off box backup can be provided via Lot3 Trust Cloud Managed services. ; ; Snapshots have a removal of 30 days using GFS model: ; ; Daily backup – 7 for 1 week ; ; Weekly backup – 4 for 30 days ; ; Backups will be setup via initial onboarding for Scheduling. ; ; Backups will be scheduled via the SSP (Self Service Portal) ; ; Restores provided by cloning a second VM from a snapshot ; ; The customer to maintain supported OS and backup scripts.
• Datacentre setup: Single datacentre
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery:
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team
• Backup and recovery: Yes
• RPO/RTO: Yes

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: Customer can connect via any IP connectivity option that is secure, examples include MPLS, SD-WAN
• Data protection within supplier network: IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.9% availability on the TrustCloud platform as standard.; Where:; “Availability" = ((Total Uptime - Total Downtime) / Total Uptime) x 100; "Total Downtime" = the total amount of time (in minutes) where there is a complete loss of the defined service. ; "Total Uptime" = the total number of minutes in the relevant Service Measurement Period.; ; Service Credits Payable where the Supplier fails to meet the Target Availability:; 4hrs or less: None; In excess of 4 hours but not greater than 10hours: 1% per hour*; In excess of 10 hours: 15%*; *Percentage of the monthly equivalent of Trust Cloud
• Approach to resilience: Available confidentially upon request.
• Outage reporting: The Trust Service Desk monitor the platform 24x7x365 through various toolsets (PRTG/Auvik/Nutanix/AlertLogic). The service desk provide 30minute response SLAs to all alerts/events from these tools. On receipt of a service affecting event an incident will be created and email alerts sent to affected clients. The normal incident management process determines update frequency and resolution targets based on incident severity. For example, a P1 incident receives 30minute status updates.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Other user authentication: LDAP Integration for username/password authentication.
• Access restrictions in management interfaces and support channels: Trust Management Service and support Teams use Duo two factor authentication with AD authentication to access the RDS support VM’s. From there, they must provide named access with LDAP authentication to the individual systems access:; 1. OpenGear – used via RADIUS, AD and NPS to access all console ports and IPMI ports on the Nutanixs; 2. Network switches, IPMI ports, OOB management – integrated into the management Active Directory via NPS Services; 3. OpenGear uses authentication and logging via AD; 4. Management VMs – accessed via the management network from the support VM’s only, with AD to authenticate users.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through: Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO 27017 & 27018 are addendum clauses to the annual surveillance audit of ISO27001 and can be separately noted for G-Cloud 15 as evidence they are covered by the addendum clauses for Cloud Cyber Security. Trust use British Assessment Bureau Limited a UKAS-accredited certification body these requirements.
• Information security policies and processes: Trust Systems operate an Information Security Management Forum (ISMF) to govern ISO and Compliance standards with the business on a monthly basis. This reviews Security policy and process from the staff to the Senior Leadership and Operations Leadership. The ISMF ultimately is represented at the main board to report ISO27001 and Cyber Essentials Plus items such as Security Incidents that are recorded and actioned within the Corporate Risk Register.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Customer changes must be raised through our RFC form. Only customer authorised contacts can raise RFCs to Trust. A request from an unauthorised contact will be referred to the service owner. Changes include the following which are communicated to the directly affected customer: ; -Firewall changes (access list change to policy) ; -Upgrades to customer platforms (new nodes) ; -Changes to existing nodes (e.g. more RAM) ; ; Trust Changes: ; Major Feature updates, System upgrades (e.g. replacement for EOL hardware). ; Changes to configurations will be raised on change management platform and assessed for potential security impact. Trust will communicate according to the defined Change process.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability and Threat Management will be in conjunction with Trust Systems partner PureCyber. PureCyber will scan for known vulnerabilities and notify Trust Systems of issues on a daily basis. Trust will then analyse vulnerabilities and evaluate an appropriate response. ; ; Trust Systems will adhere to Cyber Essentials + and patch within 14 days of patch release aa per this framework. Any specifically raised high priority threats will be mitigated by the Service Desk team as a P1 with urgent priority.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Trust Systems subcontractor AlertLogic will provide a Threat Monitoring and Management Service; Where an Intrusion Event is detected a process exists where Trust Systems will be notified according to, subject to the SLA, 24/7 Security Operations and required technology to monitor for threats and escalate them to customers. Scanning will include: ; ; 1. PCI Scanning for vulnerabilities ; 2. File Integrity Monitoring ; 3. Network Monitoring ; 4. Log Data Monitoring ; 5. Log Analysis ; 6. Log Collection & Search with 12 Month Retention ; 7. Web Log Analytics
• Incident management type: Supplier-defined controls
• Incident management approach: Trust follows the SANS Institute incident response principals for security incidents reported via the service desk.; Prepare—establish security policies, carry out risk assessments, determine which assets are sensitive and establish an incident response team.; Identify—monitor systems to detect anomalous activity, identify security incidents or threats.; Contain—conduct short-term containment procedures to stop the spread of the threat e.g. apply fixes; Eradicate—identify the root cause of the incident, remove malware and implement measures to prevent future attacks.; Recover—restore your production systems and apply measures for preventing further attacks. ; Learn—perform analysis following an incident with documentation via PDF to the client.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: Other
• Other virtualisation technology used: Fortigate Virtualised Firewalls.
• How shared infrastructure is kept separate: Compute is physically separated. Trust implements virtualisation only for the network. Fortigate Virtualised firewalls are used to segregate traffic between clients via firewall policy and individual client VDOMs. The clients are ‘landed’ through shared WAN connectivity on an IP address on the Fortigate firewall. Additionally the Mellanox switches support 802.1q Virtual Local Area Network segmentation. ; In the self service portal user configuration and information is managed via software level constructs known as ’project’, where each customer is a project, and all resources can only be access by that project. Users must separately authenticate against the portal to access their projects.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Energy efficiency is part of both Crown Hosting’s ISO 14001 and ISO 50001 certifications and management systems and is addressed in how DCs are designed. Also, contractual obligations with client and/or suppliers, guidance in documents such as rules for working in a DC as well as other requirements such as part of our CCA/CCL agreements in terms of energy efficiency.

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Trust cloud Proof of Concept is a cut down functional version of the service with reduced SLA and Services. Available on request.

Discount

• Provide your minimum discount applicable to your baseline prices: 1%

Formula for calculating price of your services

• Formula for calculating price of your services:

  Which of the core deployment models you intend to offer

  Private Cloud

  Private Cloud - Formula for calculating price of your services

  ---

  Total Cost

  The Total Cost for a buyer's call off requirement in a Private Cloud Deployment

  =

  Baseline Pricing

  This will be found within the Technical Description Document within Lot1a.

  -

  Minimum Discounting

  1%

  +

  Onboarding Activity

  Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process

  +

  Additional sources of cost

  Where additional optional services are chosen within the service description.

  -

  Additional sources of cost reduction

  N/A

  ---

• Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
• Baseline Pricing: This will be found within the Technical Description Document within Lot1a.
• Minimum Discounting: 1%
• Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
• Additional sources of cost: Where additional optional services are chosen within the service description.
• Additional sources of cost reduction: N/A

Mandatory certifications

• Mandatory certifications:

  Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

  Sole Control of the Infrastructure

  ISO 9001 certification

  Provided

  ISO 14001 certification

  Provided

  ISO 27001 certification

  Provided

  ISO 20000-1 certification

  Provided

  ISO 27017 certification

  Provided

  Are you bidding to provide services under Lot 1b or both Lot 1a and Lot 1b?

  Yes

  ISO 27018 certification

  Provided

Cyber Essentials

• Do you have a Cyber Essentials Plus certificate?: Yes
• Cyber Essentials Plus certificate Number: 6d2f648b-28f7-4249-a0d6-3ec9cec52f26

Non-mandatory Standards and certifications

• ISO 28000:2022 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  ODT

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at marketing@trustsystems.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.