Dun & Bradstreet Ltd

D&B Toolkit - API for global business data, ratings and scores

FOR NEW CONTRACTS PLEASE SEE D&B DIRECT+ - D&B Data Integration Toolkit (API) provides access to Dun & Bradstreet’s global commercial data with mor than 455m companies worldwide, across 220 markets with 30,000 data sources updated 5 million times per day, including: 3,000,000 corporate family trees, firmographics, scores and ratings.

Features

• API to access over 455 million Global business data records.
• Full business financial records, risk ratings, payment history and scores.
• Data can be enriched for many purposes e.g. supplier onboarding
• Including full business family trees.
• For record verification and onboarding.
• GDPR compliant data attributes for compliance and due diligence needs.
• Providing a consistent data structure across verified business entities.
• Accredited for Cyber Essentials, ISO27001 and Hellios FSQS and JOSCAR
• Year-round access with high availability: 24x7x365 at 99.9%.
• Easy to use and fast to implement

Benefits

• On demand and batch access to global business information
• Supports business transformation helping you to make informed business decisions
• Accelerating your due diligence and reducing costs of duplicate screenings
• Provides global data for business process innovation and regulation
• Compatible for compliance, risk management and fraud detection use cases
• Auto-populate your systems with high quality and consistent business data
• APIs enable a risk averse approach to business data
• Uninterrupted availability with consistent response times across peak periods
• Fast APsI response times support high and low transaction volumes
• The modern APIs enhances developer experience and reduces implementation costs

£5,000 a licence a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at PublicSector@dnb.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

931471233070910

Contact

Public Sector Team
0800 001234
PublicSector@dnb.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: There may be planned maintenance windows as required, however, these will be communicated to the customer.
• System requirements:
  • Access to the Internet
  • Web Browser such as Chrome, Internet Explorer, Firefox

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: 24 business hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: Web chat is available through the D&B website or through the product
• Web chat accessibility testing: D&B do not offer any additional support for assistive technology but offer chat and phone mediums
• Onsite support: Yes, at extra cost
• Support levels: D&B have three levels of support available from basic set up and training ranging to bespoke levels of support including technical and project management support and consultancy. A Statement of Works will be drafted with the client prior to a contracted piece of work.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users have a range of training support available. Most products run a weekly live training webinar with a product expert in attendance, which is free to all subscribers. Additional bespoke webinars can be run for individual user groups if required. A Web based training environment is also available to all users which includes access to product videos and user guides. Our new generation of products also include extensive help sections which also include training videos within the product.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Other formats available upon request
• End-of-contract data extraction: No data is uploaded - non applicable.
• End-of-contract process: There will be a loss of access to the application, at the end of the contract.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Toolkit is mostly used to query and retrieve information from the D&B Data Cloud.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Runs in a clustered environment

Analytics

• Service usage metrics: Yes
• Metrics types: Metered product. Usage reported against the available meter (units or dollars)
• Reporting types: Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: D&B's information security program (GSR - Global Security and Risk) uses the ISO-27001 framework.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Non Applicable
• Data export formats: Other
• Data import formats: Other
• Other data import formats: Non applicable

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: System is available 99.9% 24*7 except for planned maintenance communicated to the customer. Any outages / downtime outside of this, is communicated immediately with customers and recovery plans will be implemented.
• Approach to resilience: Available on Request
• Outage reporting: 24*7 monitoring for services and application with service alerts and emails to on-call staff and customers.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: All access is role-based. Before a user can access management interfaces and support channels, the user must be approved and assigned to a group with the necessary privileges on a need-to-know, least-privilege basis. Access to any computing resource requires a valid username and complex password.
• Access restriction testing frequency: At least once a year
• Management access authentication: 2-factor authentication

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: Between 6 months and 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: United Registrar of Systems
• ISO/IEC 27001 accreditation date: 03/07/2017
• What the ISO/IEC 27001 doesn’t cover: All 114 controls are included, none are omitted
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • D&B Business Information Solutions is accredited to IS027001 security standards
  • D&B Business Information Solutions accredited to IS09001 quality standards
  • D&B UK is authorised and regulated by Financial Conduct Authority
  • Dun & Bradstreet Ltd is accredited to Cyber Essentials Standards
  • Dun & Bradstreet Ltd is an approved JOSCAR supplier
  • Dun & Bradstreet Ltd is an approved HELLIOS supplier

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: D&B has published and maintains policies addressing information security and privacy requirements, a Code of Conduct, along with standards and procedures documentation as well, e.g., access provisioning. The Internal Audit group is responsible for evaluating compliance against policy. Internal Audit reports audit findings to the Board and tracks findings to completion. Dun & Bradstreet Ltd is certified to the ISO-27001 framework.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change tickets are opened in the automated change management system. The ticket describes the reason for the change; who requested the change and at what capacity; description of the requirements, risks and impacts; implementation, test, and back-out plans; scheduling information including analysis of potential conflict with other proposed changes. The ticket is reviewed by a Change Advisory Board at a regularly scheduled meeting. The CAB comprises technical and management representatives of each line of service management, reviews and approved or disapproves all change tickets. After the change is executed it is reviewed for post-change impact and metrics analysis.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Servers are scanned weekly for vulnerabilities. Per Policy, vulnerabilities and patches are deployed based upon the criticality of the vulnerability in-scope.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: A SIEM is in place to provide secure collection of server OS security event logs; network device logs; Internet proxy; host/network IDS/IPS; email gateway, etc. The SIEM analyses and correlates information from the various input sources and provides near-real-time analysis and alerting. D&B also maintains a Security Operations Center (SOC), whose staff responds to alerts originating from the SIEM. Incident response documentation is in place.
• Incident management type: Supplier-defined controls
• Incident management approach: Events are evaluated for scope, impact, initial damage assessment and response level by the CSIRT team, Team members are engaged according to the scope and severity and brought into the Incident Management Team's ECC Call. The team is composed of ancillary groups and SMEs. A response plan is created containment strategy, eradication strategy, evidence retention and investigation steps. Execution is governed by the incident coordinator. Regular reports are created and provided to the CSIRT Team; timing intervals for issuing reports depend on the criticality of the event. The CSIRT team documents lessons learned. Post-incident activity is then undertaken.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  Dun & Bradstreet has been purchasing renewable energy credits (REC’s) since 2010 as a part of our energy agreements for our main office locations. The percent of green energy was 35% for 2014, and 40% up to 2019. In the UK 100% renewable energy is procured for our offices in London. ; ; Dun & Bradstreet participates in an Alternate Workplace program with a mix of office based, homebased and hybrid working. This programme is sustainable in that not all our employees have to travel to the office. This programme reduces overall energy consumption.
• Covid-19 recovery:

  Covid-19 recovery

  D&B has supported local government departments both in Europe and the US, by providing a free of charge service to highlight type of workforce by region for Covid-19 planning and recovery.; ; Operationally, our robust Business Continuity Management plans were deployed and have proven to be highly effective.
• Tackling economic inequality:

  Tackling economic inequality

  Dun and Bradstreet take its responsibilities to its clients, suppliers, and the wider community extremely seriously. This extends to supporting through charitable work to support tackling economic inequality. ; ; We aim to lead when it comes to being an ethical company and we are extremely proud that we have been voted as one of the most ethical companies by The Ethisphere Institute. We have also received a 100% score on the Human Rights Campaign Corporate Equality Index.
• Equal opportunity:

  Equal opportunity

  Dun and Bradstreet promotes equal opportunity throughout the business and was voted as one of the best places to work, under 'Best Places to Work for LGBTQ+ Equality 2021, by US Human Rights Campaign.
• Wellbeing:

  Wellbeing

  Dun and Bradstreet offer employees and their families a number of benefits to support wellbeing, this includes health and life insurance, and retirement and savings, to family planning and supporting fitness and well-being. We are all about ‘sustainable high performance’, we’re always looking for new ways to help our employees strike that right ‘balance’ in their lives.

Pricing

• Price: £5,000 a licence a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Trial for 30 days , with limited access to data.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at PublicSector@dnb.com. Tell them what format you need. It will help if you say what assistive technology you use.