MOBYSOFT LIMITED

RiskSense

RiskSense helps social landlords identify, monitor and track hazards covered by Awaab’s Law, supporting a proactive and evidence-led approach to hazard management. Focused currently on damp & mould hazards, RiskSense enables landlords to understand where risk is emerging, track actions taken, and maintain oversight of hazard status across their stock.

Features

• Identify Hazards consistently (data-led approach).
• Optional Predictive Machine Learning for Hazard Identification.
• Prioritise cases based on severity, resident vulnerability, and impact.
• Supports timely, preventative intervention and inspection planning.
• Audit trails to support regulatory assurance (Housing Ombudsman recommendation).
• Compliance reporting for “Investigation” and “Fix” targets (e.g. 24h/5d/10d/12w).
• Repairs management service

Benefits

• Demonstrates compliance with Awaabs law
• Reduces Hazards: Improves tenant satisfaction measure performance.
• Audit trails to support regulatory assurance (Housing Ombudsman recommendation).
• Improved first time fix for repairs
• Reduces complaints & avoidable voids

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at james.carter@mobysoft.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

868528936402159

Contact

James Carter
0161 974 2000
james.carter@mobysoft.com

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Advanced and predictive analytics
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Industry standard devices (PCs, laptops, SmartPhones, Tablets etc.)
  • Industry standard browsers (Chrome, Edge, Safari etc.)
  • Extract tool will upload to internet via HTTPS
  • Standard API protocols
  • Excel to view report downloads

User support

• Email or online ticketing support: Yes
• Support response times: Requests are prioritised by business severity to assign ; target response and restoration times: ; S1: Complete loss of service or a critical function ; unavailable with no workaround – 1 business hour ; response, restoration as soon as reasonably practical. S2: Major functionality impaired, significant business ; impact – 4 business hours response, restoration by ; next business day. ; S3: Partial loss of functionality or degraded ; performance – 1 day response, restoration target to ; be agreed with Customer on a case-by-case basis. ; S4: Minor issue, cosmetic defect, or general query - 2 ; day response, where accepted to be restored by next ; release.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: As standard, Mobysoft provides an End User to Support Team Service Model aligned to industry good practice (Service Desk Institute). The service is provided with a 99.5% service availability target. Availability is underpinned by our high-performance service architecture, proactive service monitoring & management (including capacity management), as well as our ISO27001 accredited Integrated Security Management System (includes vulnerability management). ; ; Service requests raised via telephone or email (M-F 0800 – 1730) are prioritized vs business impact and provided, e.g., in the unlikely event of an outage we provide a Recovery Time Objective (RTO) of just 6 hours, with a Recovery Point Objective (RPO) of end-of-last working day.; ; You will also be assigned an Account Manager who will act as your single point of contact for your Mobysoft services. In addition, you will be assigned a Customer Success Manager to assist you to adopt RiskSense and drive benefits realisation as well as a continuous programme (includes provision of training).
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We will form a joint project team with you to implement RiskSense using our proven project methodology. Our approach is proven to get customers live quickly, safely, and with confidence, while ensuring the solution is configured to reflect how your teams work. The key stages of an implementation are: ; ;  Discovery ensures that we understand your IT environment, patch structures and ways of working, ahead of deploying RiskSense.;  Once technical requirements are understood we will Provision RiskSense and Configure RiskSense to follow your preferred ways of working - this is a collaborative phase combining our implementation expertise with your operational insight to ensure the system highlights the right cases, at the right time, for the right people.;  You will then perform Customer Acceptance Testing (CAT) ahead of Go-Live & Training.; ; Following go-live, we will work collaboratively with you to Optimise RiskSense. This includes monitoring performance and usage, proving accuracy, as well as hands-on support from our team to support you adopt good practice. Once the service is optimised, it will enter a short period of Hypercare, prior to the service being formally transitioned to our Customer Success team.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: RiskSense connects to your HMS to provide AI Arrears Collection services. The HMS remains your system of record and therefore data extraction are not required at the end of a RiskSense contract.
• End-of-contract process: The following Exit Management services are provided:; ; • Assistance with re-competition for the application at the end of the contract term, e.g., template statement of requirements.; • Assistance with the development of an Exit Plan.; • Termination assistance (Optional); • Decommission of the service and disposal of any assets exclusively utilised to deliver the service.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: SQL scripts can be used to integrate data to the service.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: RiskSense provides a two-way Microsoft Dataverse ; connector. You can therefore use the Microsoft ; Dataverse Open API for onward connections where ; required, for further details on the Microsoft API ; please visit: Use the Microsoft Dataverse Web API ; (Dataverse) - Power Apps | Microsoft Learn
• API: No
• Customisation available: No

Scaling

• Independence of resources: The service is hosted on hyperscale AWS ; services that are designed to auto-scale with ; demand.

Analytics

• Service usage metrics: Yes
• Metrics types: RiskSense integrates with your HMS to understand hazards across your estate. Data is used to provide dashboards that give teams visibility of current and emerging risks across your housing stock. This enables you to:; ;  Apply a consistent, data-led method for identifying and prioritising risk;  Provides a clear, consistent views of risk.;  Prioritise cases based on severity, resident vulnerability, and potential impact.;  Support timely, preventative intervention and inspection planning.;  Report on your performance against “Investigation” targets for Emergency and Non-Emergency Hazards, as well as “Fix” targets (e.g. 24h/5d/10d/12w targets).;  Risk Audit Trail (Housing Ombudsman)
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: AES256
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Excel Spreadsheets and CSV downloaded ; from portal.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Excel
• Data import formats:
  • CSV
  • Other
• Other data import formats: Via SQL Scripts

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Subject to specific agreement
• Approach to resilience: Available on request
• Outage reporting: Service issues are reported internally, service status in front end portal and communicated out to users via email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: SSO (SAML), e.g., via Customer Microsoft Entra ID service.
• Access restrictions in management interfaces and support channels: Limited to connection from Mobysoft known IP Address(s) only via VPN.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials and Cyber Essentials Plus
• Information security policies and processes: We operate a comprehensive suite of information ; security policies aligned to the ISO 27001 framework. ; Core policies include General IT Usage and Internet ; Usage, VPN Policy, Client Data Policy and Mobile ; Computing Device Policy. These are supported by ISO ; 27001-mapped controls such as our Access Control ; Policy, Password & MFA Policy, Data Retention & ; Disposal Policy, Incident Response Policy, Change ; Management Policy, Secure Development Policy and ; Third-Party/Supplier Security Policy. All policies are ; centrally accessible, version-controlled and must be ; acknowledged by staff at induction and upon major ; updates. ; Governance follows ISO 27001 principles and is led by ; the Chief Security Officer (CSO), who reports directly ; to the CEO, ensuring independent oversight and ; accountability. The CSO owns our security framework, ; manages risk assessments, maintains our Statement ; of Applicability-aligned controls, and oversees ; incident management. ; Compliance is supported through privileged-access ; reviews, SIEM/log monitoring, endpoint compliance ; checks, patch-management oversight, phishing ; simulations, internal audits and supplier assessments. ; Mandatory training reinforces correct handling of ; systems and client data. ; All non-conformities or incidents follow a formal ISO ; 27001-aligned incident response process, with ; corrective actions tracked to closure and lessons ; integrated into continuous improvement of our ISMS.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: RiskSense is designed with security in-mind. The component parts are not exposed directly to the internet, except for the user-portal. All components (services and third-party modules) are registered and vulnerabilities checked for against CVE as published.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We manage vulnerabilities by continuously monitoring ; trusted sources such as vendor advisories, CVE/NVD ; feeds and industry threat bulletins. When a ; vulnerability is disclosed, we assess its relevance to the ; components and configurations used in our services, ; considering severity, exploitability and potential ; impact. Critical patches are deployed as soon as available, typically within 24 hours; lower-risk fixes ; follow scheduled maintenance. If a vulnerability does ; not apply, we document the assessment and apply ; mitigations where appropriate. This ensures timely, ; risk-based protection of our services.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Systems are monitored for exceptions (odd usage patterns). This is in addition to the front-end monitoring provided by the Firewall and AWS platform itself (RiskSense is hosted using Amazon Web Services).
• Incident management type: Supplier-defined controls
• Incident management approach: In line with our ISO270001 pre-defined processes exist for service failures including: Client failure to send data (no results available), Service Interruption (short-term); Service Interruption (mid/long-term) and for general business continuity. A standard procedure exists to be followed in the event of a suspected data breach. All incident management processes include a comprehensive customer communication plan.; ; Incident Reports are provided to affected organisations as a completed document detailing the cause, extent and remedial actions for the incident.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Where requested, Mobysoft may offer a chargeable Proof of Value (POV) exercise that provides ; up-to six months of service to prove data services and to test value against agreed success ; criteria (operated as a break clause for cause within a longer term agreement).
• Link to free trial: N/a

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Bsi
• ISO/IEC 27001 accreditation date: Saturday 13 July 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001 certification covers the core information security management system (ISMS) that ; underpins our service delivery, internal operations, and the controls we implement to protect ; customer data. The scope includes our internal infrastructure, security governance, policies, ; processes, monitoring, and personnel controls. (“the Service Boundary”). Please note that customer; managed infrastructure, customer-side devices, and any custom configurations made by the ; Customer are outside the Service Boundary. ; Whilst any services outside of the Service Boundary are not covered by our accreditation, we ; establish good practice controls to protect our service from external threats e.g., access control, ; encryption, vulnerability scanning, as well as security devices deployed to protect the service ; boundary (e.g., firewall).
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 76084fea-3c6a-42df-ba65-7205791f823e
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: B1e0f155-9939-4e7f-8bf3-546357c5fbec
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at james.carter@mobysoft.com. Tell them what format you need. It will help if you say what assistive technology you use.