Crown Computing Ltd

Crown Duty Management Suite

Crown Duty Management enables police and emergency services to improve productivity by scheduling officers and staff with the right skills, right role, right place, right time. Mobile access ensures continuity whilst on the move. Data security, scalability and reliability are paramount. Fully configurable and interfaces with HR and C&C systems.

Features

• Real-time capture of arrival, departure, and absence from workplace
• Realtime view of all staff showing attendance and absence
• Real-time management of flexi-time and flexible working hours balances
• Management of Annualised Hours processes
• Simple employee scheduling and rostering to manage coverage
• Automated leave and absence request and authorisation workflow
• Absence monitoring including Bradford scoring
• Real-time absence and return to work alerts and processes
• Working time legislation compliance automation and alerts
• Employee Self-Service on desktop, tablet, and mobile devices

Benefits

• Flexible configuration for divisional and departmental requirements
• Real-time visibility of manager and employee flexitime information
• Reduces payroll and administration costs and maximise productivity
• Reduces absenteeism and identify absence trends
• Reduces casual or unplanned Overtime through better authority levels
• Consistent and robust Working Time compliance and reporting
• On demand and fully auditable working time records
• Aligns service delivery with labour budgets to manage costs
• Self-Service eliminates paperwork and simplifies business processes
• Ensures coverage and service levels are consistently met

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@crownwfm.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

735057061790415

Contact

Crown G-Cloud Sales
01827 309800
info@crownwfm.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Police
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Hybrid cloud
• Service constraints: Crown will on an occasional basis plan system maintenance and upgrades, which will be agreed with the customer in advance.
• System requirements:
  • Good quality Internet connectivity, typically broadband or fibre
  • Web browsers supporting a minimum of TLS 1.2

User support

• Email or online ticketing support: Yes
• Support response times: Crown aims to respond to support queries within 2 working hours during standard support hours (08:30 to 17:30 Monday to Friday excluding English Bank Holidays).
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: - The Customer Support Desk is available from 08:30 hrs to 17:30 hrs Monday to Friday excluding Bank Holidays. ; - Support may be provided outside these hours by prior arrangement.; - All support requests will be logged and assigned one of 3 severity levels - 1=Critical, 2=Urgent and 3=Minor.; - Costs of the support service are included in the prices shown in the G-Cloud Pricing Document.; - Crown does not need to assign dedicated technical account managers or cloud support engineers, as the - Crown support staff are trained to handle technical issues relating to the application software and cloud platform.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Crown’s standard implementation project includes provisions for onsite and online training as required by the customer, as well as documentation that the customer may require beyond the online help facilities.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: On Completion of the service period contract or termination under the agreed contract terms (subject to the minimum period) the Off Boarding process will follow:; ; 1) All User Access to the Service will be terminated; 2) The database will be backed up (Termination Backup) and this backup will be provided to the buyer; 3) The Termination of Service Backup will be held securely for a maximum of one month or until the buyer confirms receipt of the database, whichever is the shorter period; 4) All copies of Backups held by Crown will be destroyed
• End-of-contract process: At the end of the contract period, the buyer’s right to access the service will cease and the subscription payments will stop, as per the call-off agreement.; ; Included in the price of the contract are rights to access the software, software maintenance and technical support, cloud hosting and application management. In addition to the monthly subscription, there are additional costs for implementation and training services, which are estimated in the G-Cloud 14 Pricing Document.; ; Data collection devices for capturing time and attendance data and any desktop or mobile technology used for accessing the system are not included in the costs. Provision of clocking devices can be included at an additional cost.; ; Ad hoc consultancy services are available at an additional cost at a fixed daily rate.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The employee self-service (ESS) application is optimised for use on desktop and tablet devices.; The optional Crown Mobile module is specifically designed for use on mobile phones by employees.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The system has web interfaces through which employees, including managers and administrators, can access the system.; ; Depending on their access level, employees will be able to access self-service functions (such as absence registration and activity booking) or manager functions (such as absence approvals and exception handling).
• Accessibility standards: None or don’t know
• Description of accessibility: The system provides functions that are used for managing employees and accessing self-service data. There are options with different colour schemes (such as high contrast screens for visually-impaired users) which can be set at a user level. Screens can also be zoomed to make them easier to read for certain types of user.
• Accessibility testing: Crown have not currently completed formal interface testing with users of assistive technology. But current customers do have visually-impaired users in its existing customer base using assistive software technologies.
• API: Yes
• What users can and can't do using the API: A variety of data input and output functions are available via a web service, which can be set up via either .csv or web service transactions. These include Absence Registration, Time & Attendance Clocking, Activity Time Booking and Entitlement and Flexi Balance Enquiries.; In addition, a standard import transaction is available which can be used to import on a suite of over 50 API library transactions.; A variety of data input and output functions are available via web services, which can be set up via either .csv or web service transactions. These include Absence Registration, Time & Attendance Clocking, Activity Time Booking and Entitlement and Flexi Balance Enquiries.; In addition, a standard import transaction is available which can be used to import on a suite of over 50 API library transactions.; ; As the API service is flexible, they can be modified by the users, but only subject to appropriate access profiles, and subject to the security constraints on the system. Crown can also provide expert services for support of customers in extracting and importing data via the APIs, provided at an additional consulting cost.; ; Full documentation on these APIs can be provided on request under Non-Disclosure Agreement.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Each customer system exists as a distinct tenant in virtual private cloud with dedicated resources, isolated from systems used by other customers. As a result, each customer system is not impacted by other users.

Analytics

• Service usage metrics: Yes
• Metrics types: Service reports include availability, performance, and system patching metrics.; ; Other application usage reports are available in the system, which are accessible by the customer.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft Azure cloud services, included as part of the service.

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: Less than once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Crown Systems Integration team and the customer will create a requirements definition document which includes the detailed content and format of each extract dataset, as well as file transport and communication requirements.; ; Most frequently output files are written to pre-determined shared folders. File name nomenclature is configurable and can contain run specific values such as system date and time.; ; Output can also be directed for consumption by external web services, or processed by integration middleware products.; ; After initial definition, export processing can be configured to be automated by scheduled jobs, or initiated by manual request.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Crown service is implemented over the Microsoft Azure cloud platform, providing the guaranteed availability within that platform.; ; In a standard configuration, the virtual servers use premium SSD storage for all operating system & data disks, and VPN connectivity. All these service elements are guaranteed to deliver monthly uptime of 99.9% excluding maintenance and planned downtimes. The application also uses the DNS service which is guaranteed to respond to requests at least 99.99% of the time.; ; The system can also be optionally configured and installed in a Higher Availability and multi-site Disaster Recovery configuration for special requirements. Crown will provide quotes for such special configuration on request.
• Approach to resilience: The Crown service is implemented on virtualised infrastructure provided by the Microsoft Azure cloud platform with self-healing automatic recovery capability.; ; Virtual Machines and the Hypervisor physical hosts are monitored and managed by a Fabric Controller (FC) which has the ability to detect failures in 2 modes: Reactive and Proactive. If the FC detects failures in reactive mode (missing heartbeats) or proactive mode (known situations leading to a failure) from a VM or a hypervisor host, it will initiate a recovery by either redeploying the VM on a healthy host (same host or another host) and mark the failed resource as unhealthy and remove it from the rotation for further diagnosis.; ; Similarly, data is replicated in three separate instances within the data centre, protecting against failures of one or two replicas. To ensure that three replicas are always maintained, Azure Storage automatically spawns a new copy of the data in the background if one of the three copies becomes unavailable.; ; In addition to the resilience provided by the underlying infrastructure, the Crown solution also includes backup of the production databases, files, and application configuration to enable easy recovery from data loss.
• Outage reporting: The Crown service is implemented in an environment that constantly monitors the performance, health, and availability of the infrastructure and applications. Many component level outages are automatically rectified by the automated service healing mechanisms.; ; Azure Service Health provides a dashboard to track active events like ongoing service issues, upcoming planned maintenance, or relevant health advisories.; ; The Crown solution is configured to create and manage service health alerts which proactively reports when service issues are affecting specified installations.; ; Service health alerts and reports can be sent to designated receivers via a number of channels including SMS, email, and Webhooks.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Restriction of access for management and support channels is implemented by a segregation of duties. For example, a system administrator of our hosting services team will have no access to the customer system or database contents.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Crown has an information security process to protect the data of our customers. This is aligned with the UK Government NCSC cloud security principles.; ; Access to the Hosted system is limited to authorised staff assigned to providing the Managed Hosted Services, with access through specific password controlled Profiles. The customer would have the right to undertake an audit of the security arrangements around the Hosting and Managed Hosting Services.; ; All staff assigned will be named and will be available for the Customer to undertake security reviews with. Crown employees are contractually required to comply with a number of Company processes and procedures, including Company Rules, the IT Code of Practice and the Employee Handbook which are designed to protect the business, our Customers and employees. Areas/topics covered by some of these policies & procedures include Confidential Information, Handling Customer data, Email & Internet Policies, Passwords, Network Security, Virus Control, Media Security and Social Media. All employees are aware of their responsibilities and that breaches to these policies are handled under the Disciplinary & Dismissal procedure.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Crown has its own change management process. This ensures each software change is assessed, prioritised and defined before being scheduled into our release plan.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability management in the Crown solution is built upon the threat management capabilities provided by Microsoft Azure, which includes protection from both malicious software and attacks against systems and networks.; ; The Crown solution deploys Microsoft Antimalware for Azure, providing real-time protection; scheduled scanning; malware remediation; automatic updates to antimalware engine, platform, and signatures; active threat metadata reporting; and event collection and logging.; ; The solution is also protected against network-layer high-volume denial-of-service attacks by continuous monitoring and penetration-testing processes in Azure. This includes detection and mitigation techniques such as SYN cookies, rate limiting, and connection limits.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring is provided through Azure security health monitoring service.; Security policies are established for the installation, which will be used to monitor the system to automatically collect, analyse, and integrate with log data from anti-malware program and firewalls. When threats are detected, a security alert is created and processed through the incident management process.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: The Crown system takes advantage of the Azure Security Incident Response process, a part of the overall Azure incident management plan. This process involves a 5-step incident response process of:; - Detection of incident, originating from automated monitoring systems, or reported by phone, email, or web; - Assessment of impact and severity of incident; - Diagnosis, involving technical or forensic investigation as well as identifying mitigation; - Stabilisation and recovery through containment; - Close and post-mortem review; The incident will be tracked and managed by designated incident managers who will have responsibility to track, coordinate investigation and mitigation, and report.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Tuesday 7 August 2018
• What the ISO/IEC 27001 doesn’t cover: All Crown services are covered by ISO 27001
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: LRQA
• ISO 9001 accreditation date: Sunday 2 May 1993
• What the ISO 9001 doesn’t cover: All Crown services are covered by ISO 9001
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 209db325-817a-404e-8bc6-783cc61f58c9
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • SOC1 Type 2
  • Risk Ledger

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@crownwfm.com. Tell them what format you need. It will help if you say what assistive technology you use.