GEOFF SMITH ASSOCIATES LIMITED

Security Screening Vetting Management

GSA Cloud Security Vetting provides a time saving and flexible Security Vetting Management system with Portal option, Vetting activity-management, Vetting Decision/Appeal Recording. Includes Review /Change of Personal Circumstances Management for all types of Security Vetting Applications in an Audited, Access Controlled Vetting Solution with Document Management and Tasking.

Features

• Configurable Solution for different Vetting Recruitment Screening requirements
• Vetting features inc Web Portal, MI Dashboard, Automations
• Device agnostic HTML/5 allowing agile remote versatility
• Prompted Policy, Actions, Decisions and Messaging
• Integrated Document Management, template generation and Redaction capability
• Web Portal and automations to improve data accuracy
• Record specific email/SMS alerts re deadline management
• Comprehensively Audited, with Access Controls and Security Controls
• Automated acknowledgments, progress reports through to decision !

Benefits

• Quickly and securely manage content on the move
• Promotes consistency and legal adherence
• UK GDPR and LED compliant
• Configurable Solution for new, renewal, appeal, all workflow
• Check tag for unambiguous confirmation of mandatory or bespoke checks
• Delivering optimal business-process for cost saving benefits

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@gsaltd.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

740472363378358

Contact

Sheila Harris, Sales Department
01455 299100 x 0
sales@gsaltd.com

About your service

• Service categories:

  Application Development and Deployment

  Application development

  • Business rules management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The software is offered as a cloud solution, there are no constraints for customers.
• System requirements:
  • Client Web Browser requires any HTML5 compliant browser
  • Security controls to permit secure access to the cloud service.

User support

• Email or online ticketing support: Yes
• Support response times: GSA responds to support calls within one hour between the hours of 8 am to 6 pm Monday to Friday (excluding UK Bank Holidays). We we provide telephone, email and Remote Access assistance to customers and their systems in accordance with our SLAs. Out of hours suppor4t can be requested via our 24/7 portal which has a library of online Help Support material which is available to read.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: GSA's standard support includes a first line Customer Support Team, a range of second and third line specialist Support Engineers. Technical Product Managers and Cloud Engineers complement. We aim to respond a triage response to all issues within 60 minutes between 8.am - 6 pm every weekday (excluding UK Bank Holidays), from which SLA Priority as either Incident or Case Type can be determined and applied. Progress on items can be tracked by a customer with a Customer Portal account. Priority 1 Incidents (Critical) will receive continuous effort to resolve with Director level oversight able to allocate the resources necessary to resolve at the earliest.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Each installation is different but GSA offer services of onsite Training, e-Tutorial training and a range of user documentation. We also provide 'hand holding' days during Service Commencement (Go Live). GSA's Trainers provide follow up support to Super Users and Users once a project has gone live to continue supporting the customer installation.; ; In service we offer periodic free on-line Workshops which focus upon building customer confidence or identifying and training on a particular feature to improve User exploitation of functionality.; ; For the longer term, for interested customers we promote the formation of User Groups amongst customers for which free development hours are allocated to further develop the functionality of the software application.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The Exit Strategy provides the basis to plan the cessation of Service Delivery to the Customer, and Planning/Activities for orderly disengagement of Service Delivery. Such planning is provided in order to ensure safe delivery of Customer Data back to the Customer or completion of Customer instructions. The Exit Strategy plans the transfer and/or deletion of Customer Data to the Customer. GSAs standard output format and transfer method is a Backup of Data in native sql server format by transfer to an encrypted Hard Drive provided and collected by the Customer.
• End-of-contract process: During onboarding an Exit Plan/Offboarding Plan is documented and agreed with the customer. This document describes the required steps and expected attainments of the process of Exit Planning or OffBoarding from GCloud Services. As part of the process post Service Commencement a full set of Design details, Artifacts, and Data Dictionaries are provided to the customer.; ; The Exit Strategy provides the basis to plan the cessation of Service Delivery to the Customer, and Planning/Activities for orderly disengagement of Service Delivery. Such planning is provided in order to ensure safe delivery of Customer Data back to the Customer or completion of Customer instructions. The Exit Strategy plans the transfer and/or deletion of Customer Data to the Customer. GSAs standard output format and transfer method is a Backup of Data in native sql server format by transfer to an encrypted Hard Drive provided and collected by the Customer.; ; The Strategy covers the situations of an Orderly Exit Plan or an Emergency Exit Plan. An Orderly Exit Plan occurs on the natural expiry of the Service Delivery Contract, An Emergency Exit Plan occurs if the Customer wishes at any point in time to voluntarily terminate the Service Delivery Contract.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The screens of the solution are designed to accommodate and resize to the device. This may mean the display of the screen changes into a tabular format to ensure display.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: GSA provides out of the box Service Interfaces to its solutions to allow ease of integration with third party solutions. Interfaces including the creation of new records and the automated execution of queries for reporting purposes. We utilise an extensible framework allowing us to easily tailor our Service Interfaces to your bespoke requirements. We provide Web Services using JSON and XML to securely exchange data between applications. The interfaces are RESTful and are highly secure requiring client side authentication. In addition GSA utilises AWS S3 storage and secure file transfer protocols to transfer data in and out as required.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: GSA needs to do further work to re-gain full compliance with the latest WCAG 2.2 AA standard. We have undertaken verification exercises, this forms part of our test strategies and the changes required are now in our roadmap for the coming twelve months.
• API: Yes
• What users can and can't do using the API: A RESTful xml web service xml web-service API that allows data to be requested via a web-service and returned to a calling application can be provided to enable the receipt of or provision of data to or from other systems. In some installations this facility can be used to interface with other customer applications but is provided as required.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our solutions are highly customisable and configurable, our customers not only have the ability to control all constrained fields and dropdowns but they also have the ability to modify workflows and to define new record types and workflows. Template Manager enables simple Templates to be created and amended. This capability is usually restricted to a defined set of users based upon our Role Based Access Controls.

Scaling

• Independence of resources: Working with our IAAS Supplier, we use resource reservations and shares such as internet bandwidth shaping to guarantee that users are not affected by the demands from other users. At the start of a Project capacity planning for the required infrastructure is undertaken to ensure that adequate capacity is provided, that usage is monitored and additional capacity is available for provision upon demand. Near capacity alerts are notified to our team who then effect enhanced capacity.

Analytics

• Service usage metrics: Yes
• Metrics types: A dashboard of basic service metrics provided by the IAAS provider is shared with the customer relating to the infrastructure such as CPU, Disk, Memory, Network usage. We offer formalised quarterly account management meetings with service reports highlighting service levels of support service and also user usage, storage usage, Licence consumption, case volumes etc.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Most Record and Document screens in the Cyclops Application (if not all) have an Export Option enabling users to export selected data and files. The Export function is a Privilege which can be enabled or disabled for users and this is administered by a Super User.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Pdf
  • Excel
  • Copy to Clipboard
  • XML
  • JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • Excel

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The level of availability guaranteed by our IAAS provider is 99.95%.
• Approach to resilience: The IAAS Service Provider we utilise in the delivery of our GCloud Application has a service which is deployed across a number of Availability Zones. Each Availability Zone is designed to eliminate single points of failure including power, network and hardware. All AZs in the UK region are interconnected with high-bandwidth, low-latency networking, over fully redundant, dedicated metro fibre providing high-throughput, low-latency networking between AZs.
• Outage reporting: All outages are reported by our IAAS Service Provider via a Portal Service Status page. Outages are identified as Planned maintenance, Emergency maintenance, and platform issues. GSA would then make contact with the GCloud Customer to communicate the Outage and discuss the service details.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: GSA utilises a management tool for managing Role Based Access Controls. This interface is separate from the main application and users must be separately authenticated in order to be granted access. GSA use HaloITSM Service Management solution as our Support Management Tool. This tool is accessible via https://support.gsaltd.com and only pre-authorised users within our customer organisations are granted access. Calls may be received via telephone and/or email but these are also logged within Halo ITSM and assigned accordingly.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: CSA CSM version 4.0
• Information security policies and processes: GSA are an accreditation led company who hold ISO 9001, ISO 27001 ISO 14001, Cyber Essentials Plus. All GSA staff are Security Vetted to NPPV Level3 SC+. GSA's IAAS provider has accreditation including CSA STAR, ISO27001, ISO 27017, and ISO27018.GSA follow Policies and Processes determined from our accreditation. This compliance is audited by internal and external auditing and trained for by our internal training staff who deliver induction, project-specific, Policy/Process is owned by an accountable individual and reviewed at least annually. We invest in Application-specific, team, role and customer-specialist training. We deliver mandatory annual security training. Resource Planning and outputs are defined in Company Roadmaps and there is a staffing hierarchy which means most staff work to or one Manager away from a Director. This approach leads to clear decision making and a simple communication pathway within the company.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: GSA is an ISO9001 accredited company and we operate to an Agile Development Policy using SCRUM methodology and development is documented through TFS items in 3 week Sprints. Items for change are documented and taken to our Change Approval Board upon which our Cyber Security Engineer sits keeping security paramount. Components are scanned for vulnerability using software such as mend.io ensuring their lifetime fitness.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: GSA receives Threat Intelligence from numerous sources including Secureworks (our CIR partner), Beazley, EMCRC, NCSC. We have a range of monitoring services deployed including MyNCSC Early Warning, MS Defender and AWS tools. We scan for vulnerability using the likes of mend.io. Patches/Updates are applied within 14 days or asap for criticals. Our Cyber Security Engineer scans technical forums and specialist groups to promptly identify and evaluate any emerging patches or updates which require our attention.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Amazon GuardDuty is a threat detection service that continuously monitors all AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation. GuardDuty captures, reviews and alerts on threat findings across multiple log sources, CloudTrail, network flow logs and DNS. This provides a rich view of threats across the entire environment. Amazon GuardDuty is configured to integrate with AWS Security Hub at an account level. All events generated from Amazon GuardDuty roll up into AWS Security Hub providing a centralised location for monitoring of findings, creating alerts and enabling immediate response where required.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: GSA have tested policy and process for incidents and Business Continuity driven Disaster Recovery response guides. Directors and key staff undertake annual Incident training via NCSC/our Insurer. Users can report Incidents via phone/email or portal. Incident response can be tracked over the portal or in higher severity Incidents we will agree a communications plan. Incident response is documented and subject to an appropriate form of Lessons Learned review. We provide reporting or will respond to requests for the same dependent upon Incident type.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Joint Academic Network (JANET)
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 1%
• Over £5,000,001: 1%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation
• ISO/IEC 27001 accreditation date: Thursday 4 July 2024
• What the ISO/IEC 27001 doesn’t cover: Nil - subject to annual inspection
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation
• ISO 9001 accreditation date: Tuesday 21 March 2023
• What the ISO 9001 doesn’t cover: Nil - subject to annual inspection
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Cde2795d-125b-458a-a2ff-bb931dda41a8
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 44f670c2-87a2-40f5-9986-deae20788407
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@gsaltd.com. Tell them what format you need. It will help if you say what assistive technology you use.