CGR Foundation
CGR Foundation (CGRF) allows users to clearly and visually integrate risk, compliance and other business processes (including incidents and issues). This activity is connected through real-time action management and communicated through concise reporting - including cost/benefit analysis. The resulting live and collaborative picture enhances decision-making whilst also delivering efficiency benefit.
Features
- Real-time action management (with notifications) across all modules.
- Linkage of risks to objectives (aligned with ISO31000).
- Intuitive bowtie visualisation (aligned with ISO/IEC31010) supporting focus on controls.
- User-configurable audit capability with management summary and risk integration.
- HSE modules including hazards, observations and incidents.
- Reporting suite including dashboards, client logos/templates, and personally customisable filters.
- Fully auditable history of changes in all modules.
- Use 'in the field' through CGRF Mobile (iOS and Android).
- Strong integration between modules/records - easily entered and assimilated.
- Auto-word search prompts user identification and linkage of records.
Benefits
- Decision-support with clear picture integrating risk, business intelligence and objectives.
- Efficiencies through reduction in overheads associated with standard office tools.
- Transparency of action management supports accountability and drives positive behaviours.
- Live status of records (including actions) reduces time on communications/prompts.
- Integration of actions/evidence to risk and compliance increases review/audit efficiency.
- Notifications to user email addresses integrates with Business as Usual.
- Automatic report delivery against user-defined filters and schedules supports governance.
- Inherent ease-of-use supports acceptance and data-input whilst minimising training requirements.
- Integrated Cost Benefit Analysis (through risks/controls) supports resource prioritisation.
- Ease of configuration enables self-administered changes - allowing agile updates.
Pricing
£10.00 to £27.00 a user a month
- Education pricing available
- Free trial available
Service documents
Request an accessible format
Framework
G-Cloud 13
Service ID
9 2 2 1 9 5 2 1 8 5 5 0 0 2 7
Contact
Corporate Governance Risk Ltd
Patrick Parker
Telephone: 07780986929
Email: pat.parker@corpgovrisk.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
-
- Public cloud
- Hybrid cloud
- Service constraints
-
CGRF supports all standards-compliant browsers, including IE, Chrome, and Firefox.
CGRF Mobile is used by many clients, and is available for iOS and Android. - System requirements
- Standards-compliant web browser.
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
- Commitment for response times to technical support questions are contained in our Terms and Conditions document - they are based on business hours and range from 1 hour to 2 days based on severity level.
- User can manage status and priority of support tickets
- No
- Phone support
- Yes
- Phone support availability
- 24 hours, 7 days a week
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
- Support Levels are outlined in our Terms and Conditions document (Part E). Levels 1 and 2 are generally associated with user account management and permissions which we expect client helpdesk/system champions to manage. Level 3 would be other queries escalated in the first instance to the CGR account manager through our ticketing system - these may often be resolved by the account manager but technical issues may be further escalated within CGR for resolution. Response times vary according to severity level as described elsewhere in this service (and in our Terms and Conditions document). Technical support is included within the license cost provided in our Pricing document.
- Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
- CGR provides full project roll-out and structured implementation of installation, process mapping, configuration, data migration and training.
- Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
-
CGRF allows export of data at all times, using the "Export CSV" functionality
Additionally, the CGR Terms and Conditions document includes: "Within 30 days after the date of termination or expiry of this Agreement, the Licensor must, at its cost, return all Licensee Data to the Licensee in a form that means the Licensee Data is readily usable without the Software or other non-generic application. For clarity, the Licensor must provide the Licensee with a single flat file in CSV format, containing all Licensee Data." - End-of-contract process
- Database backup will be provided if required, and the service will be disabled. After an agreed period of time, the service will be deleted. Data deletion is aligned with client request and agreement.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Microsoft Edge
- Firefox
- Chrome
- Safari
- Application to install
- No
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- CGRF Mobile provides a subset of CGR Foundation functionality but does not fully replicate it. Designed to work "on site", modules such as Incidents, Actions, and Observations can be accessed for creation of new records or revision/update of existing records. The audits module can be accessed such that pre-assigned audits can be executed. Data entered on CGRF Mobile is immediately accessible by users operating on the core system. CGRF Mobile can be used offline, with data synchronising once mobile connection is re-established.
- Service interface
- No
- User support accessibility
- WCAG 2.1 A
- API
- Yes
- What users can and can't do using the API
- The CGR Foundation API enables complex push and/or pull interfacing to a range of key systems. These have included SharePoint, 1SAP, and other enterprise systems.
- API documentation
- Yes
- API documentation formats
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
-
CGRF is highly configurable in forms, fields, workflows and notifications. We expect to provide initial configuration for clients, aligned to their requirements, during deployment of CGRF - the user interface for this configuration activity is so straightforward that we do much of that activity live in-session with the clients. Thereafter, although we can continue to provide configuration support, the highly intuitive nature of the system interface allows designated admin users to add and adjust as required without having to come back to CGR. This reduces client dependency and increases agility - helping client use to remain in-step with changing business requirements.
CGR also provides customisation for clients within the contract terms - for instance, in generating bespoke dashboard reports that may be required above and beyond the existing report library.
Scaling
- Independence of resources
-
Clients are hosted in their own environment (resources are not shared).
Additionally, hosting through AWS allows rapid elasticity of resources.
Analytics
- Service usage metrics
- Yes
- Metrics types
- CGRF provides "last login", "all active users" and other service usage metrics in the Reporting module.
- Reporting types
-
- API access
- Regular reports
- Reports on request
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Conforms to BS7858:2019
- Government security clearance
- Up to Security Clearance (SC)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 3.0)
- Penetration testing frequency
- At least every 6 months
- Penetration testing approach
- Another external penetration testing organisation
- Protecting data at rest
-
- Physical access control, complying with CSA CCM v3.0
- Physical access control, complying with SSAE-16 / ISAE 3402
- Physical access control, complying with another standard
- Encryption of all physical media
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Data importing and exporting
- Data export approach
- Users can export individual records or entire registers in PDF/XLSX/DOCX formats through a simple 'Export' menu. Additionally, users can manage the search and export of multiple records across any registers through a Reports module - here the data can be presented in customised graphical dashboards tailored to client requirements (including formats and logo) or subject to data-mining request against filters based on any of the record input fields. Reports can be automatically scheduled for delivery to user email address at user-nominated frequency/date/time. Finally, users can review the interactive data dashboards and export a dashboard image in PDF.
- Data export formats
-
- CSV
- Other
- Other data export formats
- JPEG/PNG/GIF etc (for attachments)
- Data import formats
-
- CSV
- Other
- Other data import formats
- CGRF data import template (CSV) only
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
Availability and resilience
- Guaranteed availability
-
In line with Amazon Web Services SLA of 99.9% uptime, CGR provides a 99% uptime target which is routinely exceeded due to redundant servers for all clients (i.e. multiple instances, staged upgrade deployments to one instance at a time). Over the last 5 years, CGR has operated above 99.99% availability.
There are no rebates for downtime. - Approach to resilience
- https://aws.amazon.com/compliance/data-center/data-centers/
- Outage reporting
- Email alerts in line with CGR's ‘Information Security Incident Response Plan’.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Identity federation with existing provider (for example Google Apps)
- Username or password
- Access restrictions in management interfaces and support channels
- CGR uses 2FA internally for all management interfaces.
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Identity federation with existing provider (for example Google Apps)
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- Users have access to real-time audit information
- How long supplier audit data is stored for
- User-defined
- How long system logs are stored for
- User-defined
Standards and certifications
- ISO/IEC 27001 certification
- No
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Cyber essentials plus
- No
- Other security certifications
- Yes
- Any other security certifications
- CSA CAIQ
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- Other
- Other security governance standards
- CGR is certified to Cyber Essentials. Our cloud services provider, Amazon Web Services, is certified to a range of international standards as identified as this link: https://aws.amazon.com/compliance/programs/
- Information security policies and processes
- CGR is aligned with ISO 27001, with certification scheduled for late 2022.
Operational security
- Configuration and change management standard
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Configuration and change management approach
-
CGR uses internal tools including enterprise-grade version control systems to manage all configuration and change management.
CM processes are aligned with client requirements.
All CM is passed through internal CGR quality assurance team, before being made available via a staging environment for client review and sign-off. - Vulnerability management type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Vulnerability management approach
-
CGR has continuous monitoring of vulnerabilities through CVE. https://cve.mitre.org/
All servers have vulnerability management tools. - Protective monitoring type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Protective monitoring approach
- CGR maintains logs on all servers. These are managed via SIEM.
- Incident management type
- Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
- Incident management approach
- CGR uses its own SaaS platform (CGRF) to log incidents in line with best practice.
Secure development
- Approach to secure software development best practice
- Conforms to a recognised standard, but self-assessed
Public sector networks
- Connection to public sector networks
- No
Social Value
- Fighting climate change
-
Fighting climate change
The application is ideal for collating and managing carbon performance (including with the supply chain) and is also ideal for managing performance against applicable standards such as the Task Force for Climate Related Financial Disclosures. Among a growing number of our client base using the application in this way, we have a FTSE 100 client using the application to manage ESG performance across its global operation. - Covid-19 recovery
-
Covid-19 recovery
By delivering a collaborative single point of truth, CGR Foundation supports new ways of working that are likely, post Covid, to involve a hybrid of office and home working. Our mobile app further enhances this flexibility. This will support employers and employees as they seek to find a new BaU balance of working life. This in turn may help reduce the travel demand – with positive financial impact that can mitigate rising costs of living, and positive environmental impact. - Tackling economic inequality
-
Tackling economic inequality
N/A - Equal opportunity
-
Equal opportunity
As an employer, CGR can demonstrate significant diversity - especially for its size. Our employees range from early 20s to late 70s, with a gender spread across different levels of seniority. Our staff come from a range of cultural backgrounds, between us bringing fluency in 6 global languages. - Wellbeing
-
Wellbeing
CGR Foundation is a powerful process tool. It takes on the heavy-lifting that would otherwise be required of users trying to fight with data across MS tools – from our own former experience, we know this legacy way of working to be inefficient and often demoralising because the picture is perennially out of data and incomplete. CGR Foundation releases staff time to think about the ‘so what’ rather than just the ‘what’, to add more value based on a better picture delivered with less struggle. This has a positive impact in terms of well-being and mental health.
Pricing
- Price
- £10.00 to £27.00 a user a month
- Discount for educational organisations
- Yes
- Free trial available
- Yes
- Description of free trial
- Following an in-person presentation and signed confidentiality agreement, CGR may choose to provide a demonstration environment to client.