NORTH HIGHLAND UK LIMITED

Portfolio Insights – Strategy Execution Management

NH360 Portfolio Insights delivers capabilities specifically designed for those focused on orchestration and delivery, helping them ensure that all initiatives, spend and resources are derived from – and continuously align with – strategic priorities. We provide strategic planning, investment governance, and portfolio execution controls to maximise organisational performance.

Features

• Standardise demand and innovation management
• Dynamically manage financials and take charge of financial blind spots
• Resource capacity planning and benefits and outcome management
• Roadmapping and release management
• Dynamic analysis/what-if scenario modelling
• Track performance at any level across the portfolio
• Adaptive programme management
• Integrate with a variety of ERP and other enterprise systems

Benefits

• Swiftly generate business cases, aligning demand with strategy
• Efficiently manage project and programme financial performance portfolio-wide
• Clear understanding of progress and success probability for objectives
• Respond swiftly to address and predict future challenges
• Enabling effective governance across multiple methodologies
• Connect all portfolio entities while visualising interdependencies of each
• Seamless integration of data between portfolio and systems

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at nhuk.frameworks@northhighland.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

691386995965054

Contact

Craig Spence
020 7081 2544
nhuk.frameworks@northhighland.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Enterprise performance management
  • Project and portfolio management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Our service does not have any constraints that buyers need to be aware of.
• System requirements: Secure connection to client network via EntraID (Active Directory) required.

User support

• Email or online ticketing support: Yes
• Support response times: Response times are defined in our SLAs and depend on the criticality of the issue. Typically, the client’s own network support services act as Tier 1, and NH provides Tier 2 support. We aim to acknowledge all queries as quickly as possible, with initial response and resolution times governed by the agreed SLA. Response times may vary at weekends or outside business hours, as specified in the SLA.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: No-cost: Hypercare is the post-production support that is part of our implementation engagement in the implementation cost. This is intended to cover short-term adoption as your solution transitions to production. At that point, the solution has typically been analysed, designed, and configured based on your requirements, previewed, and reviewed by your team, and well tested by both NH360 and your team. Hypercare typically includes problems related to training, user acceptance, and adoption. ; ; No-cost: NH360 provides limited Tier-2 support as part of your license agreement. Tier-2 support provides up to 24 hours per month for Qualifying Tier-2 Support Services. Tickets for Technical Support are logged through a simple support email or the customer portal (https://www.northhighland.com/portal) which provides access to the latest software updates and useful configuration and technical resources. ; ; Additional cost: Sustainment Services are available for long-term system care and enhancements, and staff augmentation, priced as time & material. This provides support services beyond the post-production support that is part of the implementation. This is a popular with customers who don’t want to manage and/or enhance the entire NH360 Portfolio Insights solution. Services that this includes can span break-fix, system analysis, system enhancements, system integrations, training, process improvements, and more.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Your path to portfolio management excellence starts here. ; ; First, we'll show you what's possible. You'll discover strategic portfolio management (SPM) best practices and explore how NH360 can transform the way you work. ; ; Within the first two weeks, we work alongside you to capture your requirements and configure the platform around your unique business processes. This means you're not just learning a tool—you're seeing exactly how it fits your real-world needs. ; ; Before you go live, your team gets the support they need to succeed: instructor-led training tailored to each role, backed by documentation, videos, and open office hours. Every person understands their part in the SPM value chain and how to deliver it. ; ; The result? Rapid adoption, measurable impact, and returns you can count on.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: A copy of the database can be offered on demand upon contract termination.
• End-of-contract process: At the end-of-contract, customer will have access to their data via a copy of the solution database. Customer may do whatever they wish with their data. At termination of contract the subscription service and NH360 user experience will no longer be available, unless renewed.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: NH360 Portfolio Insights features a modern, responsive interface with single-page application design for faster response times and a personalized home experience that serves as a centralised command center. The interface includes a wizard-style dialog for streamlined entity creation, inline editing capabilities, and intuitive objective and metric management. It delivers embedded analytics with integrated data visualization showing critical metrics and trends directly within the application. The connector uses dynamic dropdowns, allowing users to select everything they need without requiring extra technical knowledge.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: User-Centered Testing Approach: We employ a visually impaired team member who uses assistive technologies daily as part of their regular workflow. This provides continuous, authentic feedback on interface usability from someone who genuinely relies on these technologies, rather than simulated testing scenarios. This real-world perspective has been invaluable in identifying usability issues that might be missed in traditional testing and validating that our improvements genuinely enhance the user experience for users of assistive technologies. ; ; Testing Environment and Tools: Our testing is conducted across Windows 10 and Windows 11 platforms using Google Chrome and Microsoft Edge. Assistive technologies regularly tested include: ; ; NVDA (Non-Visual Desktop Access) ; ; Microsoft Narrator ; ; JAWS screen reader ; ; Microsoft Magnifier ; ; We also conduct occasional testing on Mozilla Firefox and on macOS using VoiceOver. ; ; Testing Methodology: We combine ongoing manual testing by our assistive technology user with automated accessibility scans using Google Lighthouse in Chrome. Our primary accessibility tester performs both manual evaluations and automated testing as an integrated part of our development cycles, ensuring accessibility is validated continuously rather than as an afterthought. ; ; This integrated approach ensures our interface is tested by actual assistive technology users throughout the development process.
• API: Yes
• What users can and can't do using the API: Most functions available through the UI can also be replicated through the API. Customers can use regular commercial API’s or work with North Highland to turn on or facilitate specific use cases. ; ; The NH360 Portfolio Insights solution has an extensive catalogue of documented APIs. These APIs are used for integrating and automating NH360 Portfolio Insights. ; ; NH360 uses these APIs for integrating with work management systems, finance systems, and others. ; ; The OData API uses API Keys or OAuth tokens and the CSOM API uses OAuth tokens.; ; You can find the list of our APIs at: https://www.nuget.org/packages/UMT360.Client/
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: NH360 Portfolio Insights is designed to be configured around your unique business processes, not the other way around. North Highland works collaboratively with you to configure the platform to match your specific business needs, including customizing dashboards to surface your most critical information for decision-making. ; ; The platform offers 15 template Power BI reports out-of-the-box that can be tailored to your requirements, and using OData with tools like Power BI, Tableau, or others, you can create unlimited custom reports from your data. You can also integrate data from NH360 Portfolio Insights with other enterprise systems such as finance or CRM platforms to get a complete view of your portfolio performance. ; ; NH360 is built to scale and adapt as your organization evolves. The robust cloud architecture automatically scales services with the size of your user community, and as you adopt new capabilities, the platform can be further configured to suit your changing needs. It's methodology agnostic, working seamlessly with waterfall, agile, and hybrid approaches. NH360 includes out-of-the-box connectors for systems like Jira, Azure DevOps, and Microsoft Project, with two-way data synchronization using published APIs. North Highland trains your team to administer as much of the system as you want—from fully self-sufficient management.

Scaling

• Independence of resources: Resources are being scaled to meet demand. Some services employ automatic scaling, others are being scaled based on monitoring.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Data is available for export through an OData interface. Direct Excel export is also available.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: NH360 uses Microsoft Azure to host NH360 Portfolio Insights, benefiting from Azure’s built-in security and hardening to support uptime and reliability. Scheduled downtime occurs 1–2 times per month to install security updates. Customers are informed ahead of time and receive two weeks’ advance notice for software updates, allowing them to test changes in their own environments before deployment. ; ; Unscheduled downtime is very rare and typically brief. Over the past 12 months, NH360 experienced two unscheduled outages—one caused by a configuration change and another due to a short Azure outage. When outages occur, they are reviewed under NH360’s risk management policies to identify root causes and implement measures to reduce the likelihood of recurrence. ; ; NH360 communicates proactively with customers during scheduled and unscheduled events to minimize disruption. Updates follow a structured process to ensure stability and security. While occasional downtime is unavoidable in any cloud environment, NH360’s approach focuses on transparency, planning, and continuous improvement to maintain service availability and customer confidence.
• Approach to resilience: NH360 software is hosted in Microsoft Azure and inherits all resilience features implemented by Microsoft for Azure.
• Outage reporting: Our service reports any outages via email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted through a granular set of permissions. Backend administration and support is restricted to select North Highland personnel, with specialized roles.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: North Highland is ISO27001 certified and has a comprehensive set of policies and procedures that make up our ISMS. The Information Security team reports to the CIO who has board level authorisation and will periodically update the board with relevant information regarding the overall status of the ISMS program. As part of our certification process, we are audited annually by qualified third party to verify that our program meets all of the requirements set out by ISO.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: North Highland follows a formal change management process where all changes are logged, reviewed weekly, and approved at management level before implementation. Each change is assessed for production and security impact. NH360 tracks service components throughout their lifecycle and enforces strict policies covering Business Continuity, Disaster Recovery, Backup/Restore, Penetration Testing, Incident Response, and Information Security. Additional controls include application development standards, privacy, IT security, and risk management. These measures ensure changes are secure, documented, and compliant with organizational and regulatory requirements.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We apply security patches periodically. We scan our applications for vulnerabilities weekly and address vulnerabilities as soon as they appear, with prioritisation based on severity.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We scan our applications for vulnerabilities weekly and address vulnerabilities as soon as they appear, with prioritisation based on severity. High severity vulnerabilities are fixed within 30 days, Medium ones within 90 days and Low ones within 180 days.
• Incident management type: Supplier-defined controls
• Incident management approach: North Highland maintains pre-defined processes for common incidents such as data breaches, malware, unauthorized access, and ransomware, as outlined in the Incident Response Policy. Users report incidents through the Global Service Desk or directly to IT/security contacts. All incidents are logged and managed in a centralized system, enabling efficient tracking and escalation based on severity. Incident reports, including post-incident analyses for higher-severity events, are documented and shared with relevant stakeholders. Lessons learned are incorporated into ongoing process improvements to strengthen future incident response and organizational resilience.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: North Highland offers a free proof-of-concept environment for up to 4 weeks and 10 users, including full platform features and support from a dedicated account manager. After the trial, continued access requires a paid agreement. The free version is limited to the trial period and user count.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 3%
• Between £2,500,001 and £5,000,000: 4%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: The Certification Body of Aprio, LLP
• ISO/IEC 27001 accreditation date: Wednesday 24 July 2024
• What the ISO/IEC 27001 doesn’t cover: ISO27001 certification does not cover handling of specific data types such as health care and payment transactions that are covered under other certifications such as HIPAA and PCI.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: The British Standards Institution bsi
• ISO 9001 accreditation date: Saturday 6 July 2024
• What the ISO 9001 doesn’t cover: Our ISO9001 certification specifically covers Business Analysis, Project Management, and managed services. Other service areas we provide, such as Organisational and Change Management fall outside the current certification scope.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 4ae803c4-cffe-4e8f-9739-7ac106532076
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 331483cd-9060-4fbf-9074-d55ec6ed6e4e
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Volunteering opportunities for staff

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at nhuk.frameworks@northhighland.com. Tell them what format you need. It will help if you say what assistive technology you use.