BFTTT RESOURCES INC LTD.

Business Process Modeling for Cloud Services

Our multi-site management platform accessed through a browser-based interface to build and manage sites. Our Web Service subscriptions allow customers to perform administrative actions such as create, duplicate and export websites through BFTTT platform management dashboard. Users can configure, customize, and publish sites through customer code theme with ease

Features

• Assist your different units and participants within your organisation
• Facilitate understanding, performance and collaboration
• Support the management of your business processes
• Ensure the semantics of complex processes are made relatively easy
• Reduce misinterpretation of communication between your process design stage
• Reduce misinterpretation of communication between your process implementation stage

Benefits

• Implement solutions-based on business requirements
• Provide improvements to business processes and workflows
• Identify cost effective solutions in respects of business requirements
• Ensure concise gap analysis to maximum business potential

£600 to £1,200 a unit a day

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adeosideinde@bfttt.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

780502391610330

Contact

Ade Osideinde
+447470362281
adeosideinde@bfttt.co.uk

Service scope

• Service constraints: None
• System requirements: None

User support

• Email or online ticketing support: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: 1st, 2nd and 3rd line support is provided by our cloud support engineers and in some cases a technical account manager is assigned. ; All calls are processed and managed based on our standard P1, P2, P3, P4 classifications with defined SLAs. Our support channels includes web, phone and email.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provides a range of resources to help customers get started on its services. These include comprehensive documentation (in multiple formats), introductory videos, hands-on labs, online and in-person training, and access to support from the GCP/AZURE/AWS public sector account team.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data could be extracted via secure gateway connection and in compliance with GDPR.
• End-of-contract process: The Buyer may terminate the relationship with the Supplier for any reason by (i) providing the Supplier with notice and (ii) closing the Buyer's account for all services for which Supplier provides an account closing mechanism.; Administrative fee with be included in the SLA

Using the service

• Web browser interface: Yes
• Using the web interface: Deploy, scale and diagnose issues via a simple web based interface. You can securely manage and monitor everything that powers your cloud application via: https://cloud.google.com/cloud-console
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: For many of our support clients, we configure private chat groups to allow the client real-time access to the support team.
• Web interface accessibility testing: Currently, we have not performed any web chat testing with assistive technology users.
• API: Yes
• What users can and can't do using the API: All these services can be fully configured through the AWS API. See https://docs.aws.amazon.com/index.html#user_guides for the full list of API interfaces. There are no limitations to how the service is configured via the API.
• API automation tools:
  • Ansible
  • Chef
  • OpenStack
  • SaltStack
  • Terraform
  • Puppet
  • Other
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Through load balancing.
• Usage notifications: Yes
• Usage reporting:
  • Email
  • SMS

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
• Reporting types:
  • Real-time dashboards
  • Regular reports

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Users can recover backups themselves
  • Multiple data centers with disaster recovery
  • Under user control, depending on buyer requirements
  • Under user control, depending on buyer requirements
  • Backup through a web interface
• Backup controls: User have the flexibility to backup based on their own preference
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: The AWS Business Continuity plan details the process that AWS follows in the case of an outage, from detection to deactivation. AWS has developed a three-phased approach: Activation and Notification Phase, Recovery Phase, and Reconstitution Phase. This approach ensures that AWS performs system recovery and reconstitution efforts in a methodical sequence, maximizing the effectiveness of the recovery and reconstitution efforts and minimizing system outage time due to errors and omissions.; ; AWS maintains a ubiquitous security control environment across all regions. Each data centre is built to physical, environmental, and security standards in an active-active configuration, employing an n+1 redundancy model, ensuring system availability in the event of component failure. Components (N) have at least one independent backup component. All data centres are online and serving traffic. In case of failure, there is sufficient capacity to enable traffic to be load-balanced to the remaining sites.; ; Customers are responsible for implementing contingency planning, training, and testing for their systems hosted on AWS. AWS provides customers with the capability to implement a robust continuity plan, including the utilization of frequent server instance back-ups, data redundancy replication, and the flexibility to place instances and store data within multiple geographic regions across multiple Availability Zones.
• Approach to resilience: This is available on request.
• Outage reporting: Email alerts.

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
• Access restrictions in management interfaces and support channels: Role-Based Access Control (RBAC); Attribute-Based Access Control (ABAC); Discretionary Access Control (DAC); Policy-Based Access Control (PBAC)
• Access restriction testing frequency: At least every 6 months
• Management access authentication: 2-factor authentication
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
• Information security policies and processes: Policies, processes, and tools designed and deployed to protect sensitive business information and data assets from unauthorised access. There are three core aspects of information security: confidentiality, integrity, and availability.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: This is in accordance with AWS Framework configuration approach.; Feature flags; A/B testing; Debugging and logging attributes; Allow lists or deny lists; Operational tuning (throttling limits, connection limits, URIs); Database failover configuration
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Our vulnerability management is used to identify, analyze, and manage vulnerabilities within client operating environment. Inventory of assets Configuration standards are adhered to Vulnerability, DAST, and SAST scanning Risk assessment Employee training Penetration testing We deploy patched immediately we discover the issue. We check the following: Insecure code Unpatched software Cloud misconfigurations Lack of encryption Default authentication Lack of security awareness and training Improper internal controls Weak or missing policies
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Our vulnerability management is used to identify, analyze, and manage vulnerabilities within client operating environment. Inventory of assets Configuration standards are adhered to Vulnerability, DAST, and SAST scanning Risk assessment Employee training Penetration testing We deploy patched immediately we discover the issue. We check the following: Insecure code Unpatched software Cloud misconfigurations Lack of encryption Default authentication Lack of security awareness and training Improper internal controls Weak or missing policies
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Our vulnerability management is used to identify, analyze, and manage vulnerabilities within client operating environment.; Inventory of assets; Configuration standards are adhered to; Vulnerability, DAST, and SAST scanning; Risk assessment; Employee training; Penetration testing; We deploy patched immediately we discover the issue.; ; We check the following:; Insecure code; Unpatched software; Cloud misconfigurations; Lack of encryption; Default authentication; Lack of security awareness and training; Improper internal controls; Weak or missing policies

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: VMware
• How shared infrastructure is kept separate: This is included in our SLA agreement

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: We adhere strictly to European Code of Conduct for Energy Efficiency in Data Centres.

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Fighting climate change; At BFTTT we’re committed to reducing our environmental impact on our planet. We try our very best to reduce the amount of waste we produce by ; re-using products and recycling products where possible; use energy and water in an efficient way and reduce printing in our offices.; ; We are an advocate of reducing vehicle emissions by encouraging the use of sustainable modes of transport and discouraging meetings that require transport unless there is an overriding benefit; provide advice and update our team on issues that encourage good environmental practice; make sure we fully comply with environmental legislation.; ; Everyone at BFTTT Resource Inc., Ltd is asked to only print when essential, use print preview and double-sided printing as much as possible to minimise paper use; recycle empty cans, bottles, glass and card in the recycle bins provided throughout the offices; put food waste in the caddies provided in the kitchens; purchase recycled paper products where possible; purchase environmentally friendly hygiene products where possible.

  Covid-19 recovery

  Covid-19 recovery; BFTTT Resource Inc., Ltd closed our offices in favour of remote working in mid-March prior to government lockdowns and furloughed no staff members. Remote or hybrid working remains for all employees. We reopened our offices when restrictions permitted, to provide a safe environment for staff members who are unable or struggle to work remotely due to physical or psychological wellbeing reasons. who are unable or struggle to work remotely due to physical or psychological wellbeing reasons. The offices have been rigorously risk assessed to allow remote working including our clients.

  Tackling economic inequality

  Tackling economic inequality; BFTTT Resource Inc., Ltd has achieved significant growth over the last 8 years by placing great importance on recruitment from the surrounding areas including employment of employees regardless of race, gender, ethnic background.; ; We are active in our commitment to improving social mobility within our community and took part in the employee seminars and public speaking to develop the framework for Software Engineering degree level BSc (Hons) apprenticeship in London and suburb, which aims to deliver degrees through employment to those who may not have been able to follow a traditional route into higher education. ; ; We are actively involved in delivering IT training in the Hackney Borough in partnership with nonprofit organisations.

  Equal opportunity

  Equal opportunity; We also conduct anonymous survey to comprehend the wellbeing through questioners where results of these surveys are monitored and measured annually.; Our main focus is in these areas: age; disability; race; religion; Women in Technology.

  Wellbeing

  Wellbeing; Our HR practices are designed to support employees and protect those who may have care responsibilities or health issues that may leave them vulnerable to unemployment. We have flexible start and finishing hours, hybrid working for the vast majority of roles, wheelchair access throughout our offices, work station assessments and remote working opportunities available prior to and post the pandemic. ; We have a slogan “Speak Out” encourage our team to speak openly about mental health issues, to allow us to provide both and external support, which we hope will reduce the risk of escalating mental health concerns.

Pricing

• Price: £600 to £1,200 a unit a day
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Further detail will be provided during consultation with our sales team.

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adeosideinde@bfttt.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.