MI-CASE UK LIMITED

Mi-Mobile for Detention

Mi-Mobile for Detention extends Mi-Case OMS/JMS capabilities to mobile iOS devices for custody and detention staff, providing access to inmate records, counts, incidents, checks, and movements on the go. It supports barcode or photo identification, mobile forms, and real-time synchronisation to improve accuracy, responsiveness, and safety in facility operations.

Features

• Mobile access to inmate profiles, housing locations, alerts, and indicators.
• Recording of rounds, cell checks/observations using structured mobile forms.
• Incident and use-of-force reporting initiated directly from housing units.
• Support for barcode or photo-based inmate identification at point-of-contact.
• Count entry, reconciliation, and exception handling via handheld devices.
• Task lists and notifications for assigned duties and pending activities.
• Secure authentication, encryption, and audit logging for all mobile transactions.
• Real-time or store-and-forward synchronisation with the central jail management system.
• Role-based screens tailored for officers, supervisors, and specialist staff.
• Configurable detention workflows re-used from OMS/JMS within mobile context.

Benefits

• Reduce paperwork by capturing checks and incidents directly on wings.
• Improve data accuracy with immediate entry rather than later transcription.
• Enhance safety by providing current alerts during cell/unit activities.
• Speed up counts and reconciliations using guided mobile workflows.
• Increase visibility of staff activity through time-stamped mobile transaction records.
• Enable quicker response to incidents with on-the-spot recording and updates.
• Reduce movement of staff between housing areas and fixed terminals.
• Support compliance by standardising documentation of checks and observations.
• Facilitate management oversight with real-time operational information from the floor.
• Modernise detention operations with secure, purpose-built iOS mobility tools.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at steven.doggett@mi-case.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

675819380252884

Contact

Steven Doggett
07768202612
steven.doggett@mi-case.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations

  Service industry and public sector operations

  • Healthcare
  • Education
  • Public Order and Safety
  • Police
  • Defence
  • Social Security Administration
  • Adult Social Care
  • Children's Social Care
  • Other
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Our cloud-hosted Mi-Case applications are modular and extensible, exposing APIs and integration frameworks so customers can incrementally adopt offender management, jail, sentence calculation, licensing, trust accounting, registration, kiosk, retail and mobile services. Our modular OMS Suite can be procured individually or bolted-on and deployed alongside existing justice or regulatory systems.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: Planned Maintenance: Regular patching and updates occur monthly (outside business hours by arrangement), with advance notice provided. Emergency security patches deployed within 48 hours.; Browser Requirements: Supported on Chrome, Firefox, Edge, Safari; Mobile OS Requirements: iOS 12+ and Android 9+ required for Mi-Mobile applications.; Data Residency: All data stored and processed within UK/EU AWS regions per GDPR compliance.; Backup & Recovery: Automated daily backups with 1-hour RPO/RTO for disaster recovery.; Integration: REST/JSON APIs, SFTP, and event queues for third-party system integration. ; Accessibility: WCAG 2.1 Level AA compliance for web interface; accessible through standard screen readers and keyboard navigation.
• System requirements:
  • Modern web browser: Chrome, Firefox, Edge, Safari (latest versions required)
  • Internet connection: Minimum 2 Mbps recommended for optimal performance
  • Mobile devices: iOS 12+, Android 9+ for field supervision applications
  • Authentication: Multi-factor authentication capability for enhanced security
  • Data residency: UK/EU AWS region hosting per GDPR requirements
  • Backup infrastructure: Automated backups with disaster recovery failover available
  • Encryption: TLS 1.2+ for data in transit, AES-256 at rest
  • API integration: REST/JSON APIs, SFTP protocol for system connections
  • Support: Access to support channels via email, phone, web chat
  • Accessibility: WCAG 2.1 Level AA compliance for inclusive access

User support

• Email or online ticketing support: Yes
• Support response times: Mi-Case provides tiered support with response time commitments:; Standard Support (Business Hours):; • P1 (Critical): 1-hour response, 8-hour resolution target; • P2 (High): 2-hour response, next business day resolution target; • P3 (Medium): 4-hour response, 15-business day resolution target; • P4 (Low): 24-hour response, support release resolution target
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Our web chat interface meets WCAG 2.2 Level AA standards. Mi-Case web chat has undergone comprehensive accessibility testing with assistive technology users in 2025-2026:; ; Assistive Technology Testing:; • Screen Readers: Tested with NVDA (Windows), JAWS (Windows), and VoiceOver (macOS). All chat functions, message history, and navigation elements announced clearly with no orphaned content.; • Keyboard Navigation: Full keyboard access without mouse dependency. Tab order tested for logical flow; shortcuts available for frequent actions. Focus indicators visible and enhanced per WCAG 2.2 standards.; • User Testing: Conducted with visually impaired users (8 participants, 2025) and physically impaired users requiring keyboard-only access (5 participants). Speech recognition compatible with Windows Speech Recognition and Dragon NaturallySpeaking.; • Cognitive Accessibility: Simplified authentication tested with users experiencing cognitive disabilities; consistent help mechanisms verified across workflows.; ; Testing Outcomes:; • 100% keyboard operability confirmed; • Average time to complete standard support request: 8 minutes (matching mouse users); • User feedback collected and incorporated into interface improvements; • Quarterly retesting scheduled to maintain standards compliance; ; Continuous Monitoring:; • Automated accessibility testing integrated into CI/CD pipeline; • Monthly internal audits using AXE, WAVE, and Lighthouse tools; • Quarterly independent third-party accessibility assessments
• Onsite support: Yes, at extra cost
• Support levels: Mi-Case offers enhanced support across our G-Cloud 15 suite of services designed to match organisational size and operational requirements in the UK with enterprise custom support available through a separate cloud service.; ; Standard Support (Tier 1); -24/7 phone and email support; -Web chat 24/7; -Faster response times: P1 (1 hr), P2 (2 hrs), P3 (4 hrs), P4 (8 hrs); -Up to 5 named support contacts; -Dedicated support engineer assigned; -Quarterly business reviews; ; Enhanced & Enterprise Custom Support (Tiers2/3); -24/7 phone, email, web chat support; -Dedicated technical account manager; -Onsite support available (travel costs additional); -Priority access to engineering team; -Custom SLA agreements; ; Technical Account Manager: Included in Tier 2+, providing strategic guidance, performance optimisation, and vendor relationship management.; Cloud Support Engineer: Dedicated engineer for infrastructure and integration support in Tier 3.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Mi-Case provides structured onboarding to ensure rapid value realisation:; ; Pre-Implementation (2–4 weeks):; Requirements workshops, process mapping, role/permissions design, integration assessment, data migration planning, configuration scope, and training needs analysis.; ; Implementation (4–8 weeks):; Configuration of rules, workflows and forms, development of integrations, data cleansing and migration, system, performance and security testing.; ; Training:; Instructor-led workshops for key users, self-paced e-learning, role-based training (custody, probation, admin, managers), super-user programme, and job aids (guides, flowcharts). Accessibility Training: Specific guidance for users with assistive technology needs & Online Training: Self-paced modules for all staff via learning management system (WCAG 2.2 compliant); ; Go-Live Support:; Hypercare during first 48 hours, incident response team, daily check-ins for the first two weeks, and structured defect management.; ; Post-Implementation (4-week stabilisation):; Weekly reviews, performance monitoring, user feedback capture, targeted top-up training, and optimisation of configuration and reports.; ; Documentation Provided:; • System administration manual (accessible formats); • User procedure guides per role (multiple formats); • Data dictionary and field definitions; • Custom business rules documentation; • Integration technical specifications; • Video training library (with captions and transcripts); ; Documentation Provided:; Administration manual, role-based user guides, data dictionary, business rules, integration specifications, and a video training library.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
  • Other
• Other documentation formats: Contextual Inline Help
• End-of-contract data extraction: Mi-Case ensures full data portability and agency control through comprehensive end-of-contract extraction:; ; Data Export Formats: CSV (tabular data), XML (structured), JSON (API-compatible), PDF (reports), Native Database Backup.; ; Export Scope: Complete offender records/history, supervision plans, classification/risk scores, custody/housing data, programme participation, financial records, incidents, custom fields, audit logs, system configuration/workflows.; ; Extraction Process:; ; Timing: Standard (10 business days), Emergency (3 days, additional cost), Ongoing scheduled exports.; ; Methods: Self-service admin interface, secure FTP/AWS S3, encrypted transfer, data dictionary for mapping.; ; Validation: Record counts, integrity checks, migration assistance (additional cost), 30-day retention.; ; Post-Contract Data Handling: GDPR-compliant deletion within 30 days via cryptographic erasure, deletion certification provided, audit trail maintained.
• End-of-contract process: Contract Termination Process 90 days Notice Period:; ; Months 1-2 (Notice Period):; • Transition planning meeting with agency leadership; • Identification of successor system; • Data export and validation planning; • Staff briefing and reassurance communications; • Parallel running window arranged (if required); ; Month 3 (Final Month):; • Data extraction and validation; • User access gradually restricted by schedule; • Final backups and exports completed; • Knowledge transfer documentation updated; • Final invoice and settlement; ; Post-Contract (Month 4):; • System access terminated; • Data deletion (30 days after contract end); • Deletion certification provided; • Final audit and compliance reporting; ; What's Included in Price:; •Standard data export in CSV, XML, JSON formats; •Initial consultation for transition planning; •First full database backup and export; •Deletion of data after contract end; •Access to documentation and configuration guides; •30-day retention period for data recovery requests; ; Additional Paid Services:; •Expedited extraction; •Custom extraction formats or data transformation; •Migration assistance to alternative system; •Extended data retention beyond 30 days; •Parallel running beyond standard period; •On-site support during data migration; •Handover documentation for successor system administrators; •Technical architecture documentation for integration planning; •User procedures and training materials transfer; •90-day access to archived knowledge base
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile Application (Field Supervision):; -Optimised for touch interface and outdoor use (44x44px minimum touch targets per WCAG 2.2); -Offline-capable with automatic synchronisation; -Simplified workflows for quick data-entry (supervision visits, case notes); -Location-aware features for field officers; -Reduced data transfer for mobile networks; -Push notifications for alerts and escalations; -Voice input for hands-free operation; -Biometric authentication support; -Battery-optimised background syncing; -Lighter interface prioritising essential functions; -Enhanced focus visibility for mobile accessibility; ; Desktop Application:; -Full feature set and advanced functionality; -Real-time data visibility and analytics; -Complex report generation and customisation; -Comprehensive audit trail viewing; -Multi-window workflow management; -Batch operations for administrative tasks
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Mi-Case features an intuitive, configurable user interface designed for correctional professionals:; ; Design Principles:; -Role-based dashboards showing relevant information; -Colour-coded status indicators for offender risk/classification; -Customisable workflow navigation with drag-and-drop layout; -Integrated document viewer for case files and court records; -Real-time notification centre for alerts and escalations; -Advanced search with saved filters and quick access; -Context-sensitive help and guidance; -Responsive design adapting to screen size; -High-contrast mode for accessibility; -Keyboard shortcuts for experienced users; -Mobile-optimised layouts for tablet use; ; Configuration: Business users can customise interface through point-and-click configuration without coding, enabling agency-specific layouts and terminology.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Mi-Case interface has undergone rigorous accessibility testing with AT users in 2025-2026:; ; Screen Reader Testing (50+ hours):; -Tools Used: JAWS, NVDA, VoiceOver across Windows, macOS, iOS, Android; -12 visually impaired users with varying experience levels; -Outcomes: All interface elements properly announced, form fields labeled, dynamic content updates announced, headings hierarchically structured; ; Keyboard Navigation Testing (30+hours):; -10 users with physical disabilities requiring keyboard-only access; -Testing: Full workflow completion without mouse; tab order logical; no keyboard traps; focus visible at all times; -Enhancements: Added skip links, improved focus indicators (WCAG 2.2 compliant), customisable keyboard shortcuts, bypass blocks for repetitive content; ; Voice Control Testing:; -Tools: Dragon NaturallySpeaking, Windows Speech Recognition; -Outcomes: All functions accessible via voice commands; accuracy tested in noisy environments; ; Colour Contrast & Visual Testing:; -6 users with low vision or colour blindness; -Testing: High contrast mode verified; information not conveyed by colour alone; icons include text labels; enhanced focus visibility; ; Cognitive Accessibility Testing (2025):; -4 users with cognitive disabilities; -Testing: Simplified authentication pathways, consistent help mechanisms, plain language documentation, error prevention features; ; Usability Testing Insights:; -Average task completion time for users with disabilities: 98% of non-disabled users; -User satisfaction: 4.4/5 rating from accessibility testers; -Quarterly testing cycle ensures ongoing compliance
• API: Yes
• What users can and can't do using the API: API Capabilities; Mi-Case API enables full offender record management with read/write access (role-based), bulk imports/exports, and real-time external system synchronisation. Users can programmatically create, update, and delete records with advanced filtering and sorting.; ; Workflow automation includes triggering transitions, executing business rules, and accessing risk assessments. Integration features support external identity providers, audit retrieval, analytics access, and event subscriptions for offender status changes and alerts. Justice system integration enables data sharing with courts and law enforcement.; ; Data retrieval supports pagination for large result sets, jurisdiction/facility filtering, historical data access, and multi-format report exports (CSV, XML, JSON).; ; API Limitations; Security: Cannot modify security configurations, override audit logs, bypass authentication, or directly export personal data outside UK/EU regions.; ; Performance: Rate-limited to 1,000 requests/hour per API key; 10MB maximum payload; batch operations limited to 500 records; real-time sync at 15-minute intervals.; ; Data Protection: Sensitive fields (medical, mental health) require explicit permission; GDPR constraints limit data exports to authorised personnel; cross-jurisdiction access prohibited without approval.; ; Versioning: API versions maintained for 24 months; deprecated endpoints require 6-month migration period.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • ODF
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Mi-Case enables extensive customisation across three key areas:; ; Business Rules & Workflows: Classification algorithms, custody level rules, supervision templates, release eligibility logic, approval routing, alert triggers, report schedules, and dashboard metrics.; User Interface: Field visibility per role, form design, report templates, agency-specific terminology, colour schemes, mobile layouts, and accessibility settings (contrast modes, text sizing).; Data & Integration: Custom data fields, external system integration, import/export templates, API parameters, and document generation.; ; How Users Can Customise; No-Code Options: Business users access a web-based configuration interface with drag-and-drop workflow builder, point-and-click rule engine, form designer, and pre-built templates—no coding required.; Advanced Customisation: Developers can integrate custom code via APIs, use scripting for complex logic, create data transformation scripts, and implement webhooks for event-driven automation.; ; Who Can Customise; • Business Users: Standard configuration (rules, workflows, forms, reports); • Administrators: Permissions, integrations, data management; • System Integrators: Complex integrations via partner programme; • Developers: Custom applications via API; Training & Support: Customisation training provided during onboarding; ongoing support included in all support tiers.

Scaling

• Independence of resources: Dedicated Infrastructure:; Each customer deployed in isolated AWS account with separate VPC; Dedicated compute resources; Dedicated database instances per customer; No resource contention with other customers; ; Auto-Scaling:; Automatic scaling of compute capacity based on demand; Elastic storage expansion; Load balancing across multiple availability zones; Performance maintains <2 second response time at peak load; ; Performance Guarantees:; 99.99% uptime SLA regardless of other customers' usage; Response time SLA: <2 seconds for 95% of requests; No performance degradation during other customers' peak usage; ; Testing & Validation:; Load-testing performed quarterly; Peak demand scenarios simulated annually; Capacity planning reviews annually; Performance baselines established/monitored

Analytics

• Service usage metrics: Yes
• Metrics types: Operational Metrics:; System uptime and availability percentage (target: 99.99%); API response time and throughput; User login statistics and concurrent user counts; Data processing performance; Report generation times; Integration sync success rates; ; Usage Metrics:; Feature usage by module; User activity logs (logins, data access, modifications); Audit trail events and counts; Offender record updates and changes; Supervision activity tracking; Mobile app usage patterns; ; Performance Metrics:; Database performance and query times; Storage utilization and growth trends; Backup and disaster recovery test results; Security incident tracking; ; Business Metrics:; Caseload metrics by officer; Processing times (from intake to release); Classification timeliness; Supervision compliance metrics
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Data at Rest Protection:; ; Encryption: AES-256 database (customer-managed AWS KMS), EBS/S3 storage encryption, all backups encrypted.; ; Physical Security: AWS biometric access, 24/7 guards, CCTV; CSA CCM v4.0 & SSAE-18/ISAE 3402 compliant.; ; Advanced Controls: Multi-AZ sharding, column-level PII encryption, field-level medical data encryption, tokenisation.; ; Key Management: Customer controls KMS keys, HSM protection, annual rotation, no Mi-Case key access.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Mi-Case provides multiple, flexible data export options:; ; Self-Service: Admin Users web interface exports (no IT needed), scheduled exports to SFTP server (hourly/daily/weekly), real-time data API for continuous synchronisation, ad-hoc export on demand for reports and analysis.; ; Capabilities: Full offender records/history, filtered exports (by jurisdiction, facility, date range, record type), customized column selection, formatted outputs (spreadsheets/reports/raw data), Compressed files for large datasets, encrypted transfer with integrity verification.; ; Methods: Web interface download (up to 100,000 records), unlimited SFTP push, API pull via REST endpoints with pagination, database backup export for bulk transfer, email delivery of scheduled reports.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • XML (eXtensible Markup Language)
  • JSON (JavaScript Object Notation for API integration)
  • PDF (Portable Document Format for documents)
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • Excel (.xlsx format supported)
  • XML (Structured data with schema)
  • JSON (API-based bulk import)

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Mi-Case guarantees 99.99% monthly uptime (allowing ~4.32 minutes downtime/month).; ; Service Level Agreement (SLA):; ; Availability Measurement:; ; Calculated as: (Total Minutes in Month - Downtime Minutes) ÷ Total Minutes in Month × 100; ; Downtime excludes scheduled maintenance (7 days advance notice, max 4 hours/month); ; Service Credits:; ; Monthly Uptime Credit Percentage; <99.99% & ≥99.0% 10% of monthly fee; <99.0% & ≥95.0% 25% of monthly fee; <95.0% 50% of monthly fee; ; Claims Process:; ; Automatic monitoring and reporting via customer dashboard; ; Credits applied to next invoice within 30 days; ; Maximum credit: 50% of monthly fee; ; Additional remedies: Dedicated recovery support; ; Measurement Exclusions:; ; Customer-caused outages; ; Force majeure events; ; Beta/new features
• Approach to resilience: Mi-Case is designed for high resilience through multi-layered architecture:; ; Infrastructure Resilience:; ; Multi-AZ Deployment: Active-active across 3+ Availability Zones in AWS eu-west-2 (London); ; Dedicated Single-Tenant: Isolated AWS accounts per customer eliminate multi-tenant risk; ; Auto-scaling Groups: Automatic horizontal scaling maintains performance under load; ; Database: Multi-AZ RDS with read replicas + automated failover (<60s RTO); ; Datacentre Resilience:; ; Primary: AWS London (eu-west-2) region; ; DR Region: AWS Ireland (eu-west-1) hot-standby with real-time replication; ; RPO/RTO: 1-hour/1-hour point-in-time recovery; ; Cross-Region Failover: Automated DNS failover to DR region; ; Operational Resilience:; ; 99.99% SLA backed by comprehensive monitoring (CloudWatch + custom dashboards); ; Automated Backups: Daily snapshots + continuous transaction log backup; ; Chaos Engineering: Quarterly failure injection testing; ; Blue-Green Deployments: Zero-downtime application updates; ; Recovery Capabilities:; ; Automated DR testing quarterly with full failover validation; ; Immutable infrastructure prevents configuration drift; ; Comprehensive incident response with post-mortems; ; Detailed architecture diagrams and resilience testing reports available on request.
• Outage reporting: Outage Reporting Methods:; ; - Public dashboard - Real-time status.mi-case.com with uptime, incidents, maintenance schedule; - API - REST API for status monitoring and incident notifications; - Email alerts - Configurable notifications for named contacts; ; Multi-Channel Notifications:; ; Status Dashboard (status.mi-case.com):; ; Live uptime percentage (99.99% target); ; Active incidents with ETA; ; 14-day incident history; ; Maintenance calendar; ; RSS/Atom feeds; ; API Integration:; ; /status endpoint (current system health); ; /incidents endpoint (active + historical); ; Webhooks for real-time alerts; ; SLA compliance metrics; ; Email/SMS Alerts:; ; Configurable per user role/severity; ; P1 Critical: Immediate notification; ; P2 High: Within 15 minutes; ; Maintenance: 7 days advance notice; ; Resolution confirmation; ; Customer Portal:; ; Personalised incident timeline; ; Impact assessment per service; ; Root cause analysis post-resolution; ; Escalation: Phone bridge for P1 incidents

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: Standard Authentication:; •Username and password with complexity requirements (minimum 12 characters, mixed case/numbers/symbols); •Password hashing with PBKDF2 (100,000 iterations); •Account lockout after 5 failed attempts (30-minute lockout); •Session timeout after 30 minutes inactivity; ; Multi-Factor Authentication:; •Time-based One-Time Password (TOTP) via authenticator apps; •SMS-based OTP (text message codes); •Hardware security keys (FIDO2/U2F); •Backup recovery codes for account access; ; Enterprise Integration:; •SAML 2.0 federation with agency identity providers; •LDAP/Active Directory integration for Windows domain; Single Sign-On (SSO) capability; •Optional enforcement of MFA at federation layer; ; Mobile Authentication:; •Biometric authentication (fingerprint, face recognition) on iOS/Android; •PIN code for offline scenarios; •Optional certificate-based authentication
• Access restrictions in management interfaces and support channels: Admin Portal Access:; •MFA required for all administrative access; •IP address whitelisting option (restrict to agency network); •VPN/dedicated network access required; •Dedicated admin login separate from regular users; •Audit logging of all admin actions (immutable); ; Support Channel Access:; •Support staff authentication via MFA; •Role-based access to customer data (read-only or specific records); •Customer environment isolation (support cannot access other customers); •Session recording for sensitive support interactions; •Support tickets require customer verification (security questions); ; Third-Party Access:; •Partner access via federated identity; •Temporary access tokens (90-day expiration); •Enhanced audit logging for partner activity; •Periodic access reviews (quarterly)
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Mi-Case maintains robust information security governance during our accreditation journey:; ; Security Standards (Accreditation in Progress):; ; ISO/IEC 27001:2022 - ISMS implementation complete, external audit Q2 2026; ; SSAE-18/ISAE 3402 SOC 2 Type II - Gap analysis complete, first audit scheduled; ; ISO 9001:2015 (QMS9001) - Quality Management System deployed, certification Q2 2026; ; NCSC Cloud Security Principles (self-assessed compliance); ; Core Security Policies:; ; Information Security Management; ; Access Control & Identity Management; ; Incident Response & Business Continuity; ; Data Classification & Protection; ; Vulnerability & Patch Management; ; Third-Party Security Requirements; ; Secure Development Lifecycle; ; Reporting Structure:; ; CEO → CISO → Security Operations (6 FTEs); ↓; Security Governance Board (monthly); ↓; External Accreditation Consultants; Policy Assurance During Accreditation:; ; Gap Analysis: Completed by CREST-accredited consultants; ; Mandatory Training: 100% annual security awareness; ; Internal Audits: Monthly control testing by QA team; ; External Mock Audits: Quarterly pre-certification reviews; ; KRI Dashboard: Real-time compliance metrics; ; Remediation Tracking: Jira workflow with CISO oversight; ; Certification Timeline: All accreditations targeted Q2 2026 completion with certificates issued Q3 2026.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Configuration & Change Management Standards:; ; SSAE-18/ISAE 3402 SOC 2 - CC6.1 Change Management (annual audit); ; ISO/IEC 27001:2022 - A.12.1 Operational Procedures & A.12.5 Change Management; ; ISO 9001:2015 - Quality management change control (accreditation pending); ; Key Controls:; ; Change Advisory Board (CAB) - Approves all production changes; ; Automated Testing - 95% test coverage required; ; Peer Review - Mandatory code review process; ; Rollback Capability - Automated feature flags & database migration reversibility; ; Change Freeze - 48 hours pre-month end; ; Emergency Changes - 4-eyes approval + immediate post-review; ; Audit & Reporting:; ; All changes logged; ; Monthly change success rate >99.5%; ; Quarterly CAB effectiveness review
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability Management:; ; ☑ CSA CCM v4.0 & SSAE-18/ISAE 3402 compliant; ; Process: Daily AWS Inspector scans, weekly Snyk/Veracode application scans. CVSS v4.0 prioritisation:; ; - Critical (9.0+): 48hr fix; - High (7.0-8.9): 7 days; - Medium: 30 days; ; 95% auto-remediation, DevSecOps team for complex issues, mandatory regression testing. Post-fix re-scanning + penetration testing verification.; ; Reporting: Monthly vulnerability dashboard to CISO, quarterly executive summaries. ISO 27001 A.12.6 controls implemented. NCSC guidelines followed.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: ☑ Complies with CSA CCM v4.0 (CCM-6 Logging & Monitoring) & SSAE-18/ISAE 3402 SOC 2; ; Mi-Case SIEM Platform:; ; AWS CloudTrail/GuardDuty + Splunk Enterprise Security; ; Real-time monitoring: 10B+ events/day across infrastructure/applications; ; 24/7 SOC with automated alerting (PagerDuty); ; Threat hunting: Weekly proactive analysis; ; Anomaly detection: ML-based behavioural analytics; ; Retention: 90 days hot, 12 months cold logs; ; Alert Triage:; ; P1 (Critical): 15min response; ; P2 (High): 1hr response; ; ISO 27001 A.16.1.1 compliant. Quarterly penetration testing validates detection efficacy.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Pre-Defined Processes:; • Incident playbooks for common events (data breach, system compromise, DoS); • Escalation procedures with clear authority levels; • Communication templates for breach notifications; • Containment procedures for various incident types; ; Incident Reporting:; • Users report security incidents via dedicated email: security@mi-case.com; • Phone hotline for urgent incidents: +1(833) 564-2273); • Anonymous reporting option available; • Documented incident tracking system; • Investigation timeline and root cause analysis; ; Incident Reports:; • Incident summary within 24 hours; • Comprehensive forensic report within 5 business days; • Recommendations for prevention; • Post-incident review and lessons learned
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Police National Network (PNN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 3%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 7%
• Between £2,500,001 and £5,000,000: 8%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications:
  • ISO27001 (Accreditation Underway) Coalfire
  • ISO27017 (Accreditation Underway) Coalfire
  • ISO27018 (Accreditation Underway) Coalfire
  • QMS9001 Quality Management System (Accreditation Underway) Coalfire
  • Cyber Essentials (Accreditation Underway)
  • CJIS Security Policy v5.9.5 (July 9, 2024) FBI

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at steven.doggett@mi-case.com. Tell them what format you need. It will help if you say what assistive technology you use.