Civica UK Limited

Civica eSAFETY

Health & Safety Management software to assist organisations manage Incident/Accident/Event/Near Miss reporting.RIDDOR reporting.Investigations of Incidents/Accidents/Events/Near Misses. Action raising, allocating and tracking to completion. Mange Audit and Inspections, on a scheduled or ad hoc basis including the raising of corrective and preventive actions which can be allocated and tracked to completion.

Features

• Online Health & Safety management solution
• Online forms to complete on laptop, desktop & mobile
• GDPR features to support record retention, SARs, processing restrictions etc
• Reports securely delivered within online portal
• RIDDOR reporting
• Automated letters, emails and reports
• Realtime reports & dashboards
• Configurable by WICS and client
• All data reportable & ability to create own reports simply
• Inbuilt document module

Benefits

• Access anywhere with web connectivity, mobile working, business continuity
• Accessible reduces reliance on paper available 24/7
• Demonstrate compliance with GDPR & HSE RIDDOR reporting etc.
• Securely delivered sensitive information 24/7 on self serve basis
• Streamlined process to report RIDDORs without leaving the application
• Reduces administration & streamlines processes in consistant manner
• Evidence compliance, status of activity & visibility of risk
• Manage costs,ensure system reflects change in process,requiremnts etc.
• Powerful MI, track, trend, manage costs, react quickly
• Keep all documents relating to health & safety within application

£3,570 a licence a year

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at g-cloud@civica.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

768280874901803

Contact

Civica UK Limited
+44 (0) 3333 214 914
g-cloud@civica.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Internet access
  • Main application (used by the core Health & Safety team)
  • IE versions 8, 9, 10 and 11
  • Portal used to report and investigate incidents, assign&complete actions
  • View&review risk assessments, carry out audits&inspections is cross browser
  • (no reliance on IE)

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Our SLAs state between 1 - 4 hours depending upon severity however we aim to respond to all questions immediately they enter the support department
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Onsite support
• Support levels: Unlimited phone, email, Help Desk support Monday - Friday 09:00 - 17:00 for issues and 'how to' type queries+ 20 hours of report writing time. Dedicated Account Manager
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Training is delivered as part of the implementation project, training documentation is supplied and accessible at any time
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • MS Word
  • Videos
• End-of-contract data extraction: Data can be provided to our clients at the end of their contract
• End-of-contract process: Data provided in format required, system decommissioned

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
  • Windows Phone
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: N/A
• Service interface: No
• User support accessibility: WCAG 2.1 AAA
• API: Yes
• What users can and can't do using the API: Interfaces to upload Personnel and Demographic data. Data can also be extracted for use in external systems in CSV or XML format.
• API documentation: Yes
• API documentation formats:
  • PDF
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Field names can be changed, new forms can be created, existing forms changed, triggers and actions can be set i.e. automated emails. Automated Letter templates can be created and amended, new processes created etc.

Scaling

• Independence of resources: The support and project departments have the largeset teams of any at WICS. IBM Cloud easily scalable.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: By using advanced searches/queries
• Data export formats: Other
• Other data export formats: Data can be exported by users in Excel,PD XML&XPS
• Data import formats:
  • CSV
  • Other
• Other data import formats: Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The availability of the application is monitored from a remote location to ensure the system is available over the Internet. We strive for 99.5% uptime and regularly achieve 100% uptime during the month.
• Approach to resilience: ESAFETY is deployed using Microsoft Internet Information Services (IIS) and utilises Microsoft SQL Server for data storage. The application is accessed using a JavaScript enabled web browse and has a zero client footprint. Remote monitoring tools are used to monitor capacity:; • The Corporate and hosted infrastructures are monitored with PRTG & Spiceworks; • WAN links are monitored with PRTG; • Bandwidth is monitored by PRTG.; Thresholds have been set up and automated alerts are in place. The dashboard alerts page in the IT Helpdesk is also checked daily for warnings and any problems are recorded on the IT Help Desk.; Planning is a management function and capacity requirements are established prior to the introduction of any systems, taking into consideration requirements for future growth etc. ; Testing and Development facilities are made available for the sole purpose of providing an isolated environment in which new application roll out, upgrades or modifications (changes) can be evaluated prior to implementation.; Civica's test and development environments are physically and logically separated from the production systems.; Data, software and system images are backed up regularly, using schedules designed to provide minimum loss of information to Civica & it’s customers
• Outage reporting: All services are monitored for uptime by Civica's Teams. They will be notified as soon as there is any outage and remedial action taken as soon as possible. Customers will be notified by the Support Desk if they are affected by any outage.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
  • Other
• Other user authentication: Since the eSAFETY application is hosted within IIS, authentication to the application can make use of all the security elements IIS provides, i.e.: IP and Domain Filtering, file and folder permissions etc.; eSAFETY supports any authentication method that provides access to a domain and username. Typically, this is Windows Integrated Authentication for on-premise and Basic Authentication for Hosted deployments .; As previously mentioned, only the Genohsis_Start.aspx page is secured, with all other resources being granted anonymous access. Internal control measures prevent dynamic resources being accessible if not logged in.
• Access restrictions in management interfaces and support channels: Since the eSAFETY application is hosted within IIS, authentication to the application can make use of all the security elements IIS provides, i.e.: IP and Domain Filtering, file and folder permissions etc.; eSAFETY supports any authentication method that provides access to a domain and username. Typically, this is Windows Integrated Authentication for on-premise and Basic Authentication for Hosted deployments .; As previously mentioned, only the Genohsis_Start.aspx page is secured, with all other resources being granted anonymous access. Internal control measures prevent dynamic resources being accessible if not logged in.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: 2-factor authentication

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: 27001 ISOQAR
• ISO/IEC 27001 accreditation date: 07/11/2023
• What the ISO/IEC 27001 doesn’t cover: NA
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: EMEA Global Compliance and Risk Services
• PCI DSS accreditation date: 11/08/2016
• What the PCI DSS doesn’t cover: Civica UK's certificate is Level 1 - Service Provider.
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • Cyber Essentials
  • ISO22301
  • DSTP (NHS Service Provider)
  • PCI-DSS

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Civica is committed to ensuring the fulfilment of customer needs and continuity of its business in the face of security breaches and unwanted events and has implemented an Information Security Management System (ISMS). This ISMS is compliant with ISO/IEC 27001 the international standard for information security.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Systems will have antivirus deployed as per the Hosted Servers Policy / Internal Systems Policy. • Systems will be patched in accordance with the Internal Systems Policy / Hosted Servers Policy• Penetration testing will be performed by an agreed third party as part of the application development process (Development Procedures) or as the need arises as part of application or infrastructure improvement. Civica maintains an ongoing risk analysis of its information security assets in order to assess:
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Systems will have antivirus deployed as per the Hosted Servers Policy / Internal Systems Policy. • Systems will be patched in accordance with the Internal Systems Policy / Hosted Servers Policy• Penetration testing will be performed by an agreed third party as part of the application development process (Development Procedures) or as the need arises as part of application or infrastructure improvement. Civica maintains an ongoing risk analysis of its information security assets in order to assess:
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Remote monitoring tools are used to monitor capacity. The corporate and hosted infrastructures are monitored with PRTG & SpiceworksWAN links are monitored with PRTG Bandwidth is monitored by PRTGAll. Civica event logs are protected and shall be maintained until the laptop or server’s event log repository exceeds 10MB. Following this, the oldest logs will be overwritten, as per Internal Systems Policy.; For hosted environment additional log files are retained for the purposes of tracing activity on a customer’s system as per the Hosted Server Policies and Procedures.
• Incident management type: Supplier-defined controls
• Incident management approach: At the point an Information Security Incident occurs the employee should notify the Information Security Forum of this at the earliest possible opportunity. For this purpose, a form named ‘Information Security Incident’ form has been created on the company’s internal, Information Security SharePoint Site. This form should be used as the primary method for an employee to report all Information Security Incidents. Upon completion of the form, this facility will immediately alert the Information Security Forum by email when an incident has taken place.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  As a company, we’ve made an ambitious commitment to achieve Net Zero Carbon emissions by 2040 (or sooner) by supporting our customers net zero ambitions, creating software with inbuilt sustainability and reducing our own impact.; ; Our Carbon Reduction Plan demonstrates our ambition to become industry leaders in reducing our environmental impact in support of the UK’s Net Zero Target. Underlining this ambition, we are focusing not only on our direct emissions sources but also actively engaging with our wider supply chain to understand, measure and develop meaningful emissions reductions targets in line with our Net Zero Target.; ; We are accredited to the ISO14001 Standard and to support delivery of our commitment our Environment, Social Value and Governance provides clear focus for the ongoing development of our environmental policy.; ; • We develop innovative software-based services that reduce power requirements.; • We help customers opt for more sustainable choices, through digital platforms/apps which remove paper, support flexible/agile working, all underpinned by cloud-based services employing energy efficient technology.; • We support carbon neutrality with workforces/facilities to reduce carbon consumption over the next 10-years.; • We prioritise the use of green energy in Civica owned facilities within the next 10 years.; • We promote recycling through our ‘Zero to Landfill’ and ‘Zero Print’ schemes.; ; Our commitment to continue to promote with employees and customers a greater responsibility and leadership in eliminating unnecessary single-use plastics; we continue to look to make more innovative and systematic changes to further reduce our use of single-use plastics across the organisation and to openly share our outcomes/learnings.; ; We undertake SECR Streamlined Energy and Carbon Reporting on our environmental footprint and the progress we are making to becoming Net Zero. ; ; Our commitment to fighting climate change will help deliver the policy outcomes for fighting climate change under PPN 06/20.

  Tackling economic inequality

  Civica is committed to building an inclusive and diverse culture that tackles inequality in employment, skills and pay. We promote equal opportunity through all our activities and ensure rights for all employees are always protected. We are listed as a 2020 Financial Times Diversity Leader and we are a ‘Gold’ Investors in People company. ; ; We have increased our focus and commitment to ensure we proactively implement equal and non-discriminatory treatment to all our workers. We have implemented a Diversity & Inclusion Strategy and have a Diversity and Inclusion Lead to drive the implementation of this strategy. This aims to tackle inequality in recruitment practices, team development, skills and pay through the following actions:; ; • We are a Living Wage accredited employer.; • We recruit locally to where services are delivered.; • We are committed to developing the skills of young people near our client’s businesses e.g., for a local authority, we have developed a programme of engagement workshops for young people with the potential for digital work experience. ; • Our staff act as mentors for Youth Enterprise schemes in schools/universities.; • We are a member of the 5% club, an industry-led initiative focused on creating momentum behind the recruitment of apprentices into the UK workplace. ; • Over 2.5% of our workplace is made up of apprentices or graduates and we intend to increase this to 5% by the end of 2025.; • We provide our own apprenticeship programme for managers, giving them access to training and development that may not be accessible outside the workplace.; ; Our commitment to building an inclusive and diverse culture will help deliver the policy outcomes for tackling economic inequality under PPN 06/20 and will dramatically improve job prospects and increase earning potential for the young and job seeking communities.

  Equal opportunity

  Civica is committed to providing equal opportunities and building an inclusive and diverse culture. The more diverse our workforce, the more informed the decisions we can make for our customers, supporting the communities in which we work. ; ; We are proud to have been ranked as one of the top European companies for workforce diversity and equality, as chosen by in the Financial Times in 2020.; ; We are committed to building and maintaining an inclusive and supportive culture where diversity thrives:; ; • To ensure our recruitment practices support the attraction and hiring of diverse candidates, all vacancies are advertised on multiple Diversity & Inclusion platforms. ; • We run attraction campaigns targeting females and BAME applicants. We use a process of anonymised applications, competency-based questions and scoring to remove bias. We also use decoders to ensure job advertisements use gender and culturally neutral language. We also ensure mixed panel interviewing.; • We advertise vacancies on https://disabilityjob.co.uk/ and share diversity statements on all job adverts.; • We have made training on diversity and inclusion mandatory.; • We aim to ensure increased diversity of new starters in technology/sales/leadership roles by 10% per annum over the next 3 years.; • We aim to ensure that at least 50% of shortlisted people are being considered from a diverse background for roles above £35k.; • We promote affinity groups within the company who represent a group of people linked by a common characteristic, often underrepresented, or historically excluded, which acts as a ‘safe space’ for such individuals. This identity could be related to race, gender, sexual orientation, language, nationality, physical or mental ability, socioeconomic class, family structure, religion, amongst others.; ; Our commitment to providing equality of opportunity will support the delivery of the policy outcomes for equal opportunity under PPN 06/20.

  Wellbeing

  Civica actively promote a mentally healthy workplace and workforce integrating mental health and general wellbeing in all that we do from recruitment, appraisals to strategic management.; ; Through our Health and Wellbeing Policy (HWP) and 40+ Mental Health Champions (MHC) we encourage a flexible and realistic work/life balance. Our HWP provides a foundation to support both the mental and physical health of our staff through ; ; • Employee Assistance Programme and online Wellbeing Hub, providing 24/7 access to websites, e-mail, phone and face-to-face counselling; • Aviva DigiCare+ Workplace App providing external mental health consultancy.; • Mental Health Champions who support colleagues’ wellbeing in the workplace.; • RedArc Personal nurse service.; • Management Coaching - managers are trained in GROW (Goals, Reality, Options and Will) and in being Health and Wellbeing Advisors, supporting employees with mental/physical health needs.; • Health assessments/advice aimed at improving physical health.; • Cycle to Work scheme aiding physical and mental health.; • Weekly fruit for offices, encouraging a healthier diet.; • Provide free eye tests for all VDU users, encourage staff to take advantage of NHS flu vaccinations services, and support people wishing to use the NHS Stop Smoking Service.; ; We also support our customers’ and communities’ through The Civica Foundation, our home for all charity, community, volunteering and social value. Our Days of Difference initiative gives every Civica employee 3 days a year to make a difference to charitable or community causes. Our employee’s can use this individually, join up as a team or take part in coordinated events. ; ; Suppliers/subcontractors are subject to Civica’s Sub-contractor Selection Process as defined in our ISO9001 Quality Management System, which includes criteria for assessing health and wellbeing policies.; ; Our commitment to providing equality of opportunity will support the delivery of the policy outcomes for Wellbeing opportunity under PPN 06/20.

Pricing

• Price: £3,570 a licence a year
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at g-cloud@civica.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.