DAVIES TECHNOLOGY SOLUTIONS LIMITED

Senior Managers and Certification Regime

The Senior Managers and Certification Regime proposition is a SaaS (software-as-a-service) product delivering flexible workflow, record keeping and management information to support adherence to the regimes within Financial Services for large and small firms. A multi-tenanted Single Page application hosted on a scalable and secure private cloud based Environment.

Features

• Allocation of SMFs, Responsibilities, Key Functions to Senior Management
• Committee membership and Governance Structures
• Handover and Delegation functions
• Reasonable Steps evidence
• Organigram function to create Organisation charts and model updates
• MRM creation
• Fitness and Propriety process
• Certification process
• Manage Employee Competence
• FCA Directory updates and reconciliation

Benefits

• Automate your processes
• Unlock more efficiency for all stakeholders
• Create a more sustainable long-term and future proofed solution
• Resolve the challenges of insufficient resources
• Alleviate the risk of manual data entry and manipulation
• Mitigate risks to the integrity of management and regulatory returns
• Resolve concerns with transparency, oversight and control
• Simplify the production of reports and regulatory returns
• Ensure greater levels of consistency across end to end process
• Information and tasks in a consistent and cohesive way

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@davies-group.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

999611502946820

Contact

Davies Bid Management
02078424800
bids@davies-group.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Enterprise performance management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Users are required to be within the regulated sector and will be subject to due diligence. API integration assumes familiarity with Web Services and concepts such as SOAP, XML and hierarchical data structures.
• System requirements:
  • Internet access
  • Modern web browser

User support

• Email or online ticketing support: Yes
• Support response times: Within an hour Mon-Fri 9-5
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard support level to all clients for no additional charge. We also offer AML training on a per student basis. On site support/training charged on case basis.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Online demo, user guide collateral, guidance call if required, technical assistance for integration as required
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data may be downloaded from the reporting interface.
• End-of-contract process: Data export upon request free of charge.
• Documentation accessibility standard: WCAG 2.2 AAA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: NA
• Service interface: Yes
• User support accessibility: WCAG 2.2 AAA
• Description of service interface: Icon-accessed input forms within selectable menu
• Accessibility standards: WCAG 2.2 AAA
• Accessibility testing: Beta testing with VI users
• API: Yes
• What users can and can't do using the API: Open API
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users may integrate check elements at granular or product level. Service codes are available for all. Customisation is available to all integrators. We also have complementary offerings in Davies Group from our colleagues within the Consulting and Technology division, including: Contact Management, Bespoke Application Development, Intelligent Automation, Voice of the Customer (VoC), RegTech, and Analytics. Often, working with a single vendor across multiple disciplines and business areas can have wide-ranging benefits to all initiatives. So, please do get in touch if you have questions regarding how these elements can work together to provide even greater benefit.

Scaling

• Independence of resources: Our cloud host (Azure) provides load scaling to ensure resource availability.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide reports on usage by product, date, input, result and individual user.
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Data may be downloaded from within the management interface as csv, xls or pdf.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XLS
  • PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Azure-based service offers comprehensive 99.99% SLAs which covers the guarantees for throughput, consistency, availability and latency. Service extensions can be provided at a percentage of a total contract period for any degradation in service below these set parameters.
• Approach to resilience: Available on request.
• Outage reporting: Email alerts and platform message centre

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: All users have unique logins and all actions are logged and identified.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate to ISO27001 standards. All policies are managed by an internal InfoSec and Governance team under our CISO. Staff training is conducted bi-annually or in the event of policy change. Training is delivered via online courses and assessments and is mandatory for every employee as a part of their employment contracts.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All development cycles include functional testing in a dedicated test environment. Once approved, changes are merged onto a Pre-Production environment to mirror Live as closely as possible, where a second wave of functional and regression testing takes place. Once changes are released to Live, testing is once again carried out to ensure functionality works as expected.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Internal assessments involve all relevant parties, including clients. If a threat is detected, we deploy hot fixes to address and resolve it as quickly as possible. We assess in accordance with both industry standards and relevant project requirements. We employ active monitoring processes to highlight issues as soon as they occur. Additionally, we employ network hardware and software to protect our systems. Penetration testing is undertaken by a third party.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We identify potential compromises, network attacks and/or breaches via manual checks as well as software and supplier alerts. If a compromise is detected we raise issues with senior management and instigate detailed investigations and associated threat assessments immediately. If any deployments are required to resolve compromises these are done immediately as a hot fix.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incidents are categorised as one of the following: • Minor incident – a weakness, event or incident which cannot significantly impact confidentiality or integrity of information, and cannot cause long-term unavailability • Major incident – an incident which can incur significant damage due to loss of confidentiality or integrity of information, or may cause an interruption in the availability of information and/or processes for an unacceptable period An internal reporting protocol is in place. Incident Reporting to clients is managed by internal process with delineated responsibility. Reporting to suppliers is managed by the Chief Technology Officer or senior VP.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 4%
• Between £500,001 and £1,000,000: 6%
• Between £1,000,001 and £2,500,000: 8%
• Between £2,500,001 and £5,000,000: 11%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Perry Johnson Registrars, Inc.
• ISO/IEC 27001 accreditation date: Friday 13 June 2025
• What the ISO/IEC 27001 doesn’t cover: All controls in scope
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Brendan Staley
• ISO 9001 accreditation date: Tuesday 15 December 2015
• What the ISO 9001 doesn’t cover: All controls in scope
• Quality management systems (QMS): No
• CSA STAR certification: Yes
• CSA STAR accreditation date: Wednesday 12 April 2023
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: All aspects in scope
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c0b4b65-085e-45c0-8b81-a3ba29d17ea1
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 85f82c2d-4ba0-4c00-8f0d-aaa459d8f1ab
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@davies-group.com. Tell them what format you need. It will help if you say what assistive technology you use.