GOV.UK
3SL Cradle Business Process Modelling
Team collaboration tool for phased and agile projects, unclassified (IL0) to OFFICIAL (IL3) that enables the capture, engineering and analysis of needs, goals, objectives and requirements, traceability to BPM and EA models, processes and procedures, and publishing into contract-ready documents.
It will manage your entire project lifecycle.
Features
- User-defined goals, needs, objectives, requirements, models, processes and procedures
- Bi-directional many-many traceability across entire project lifecycle
- Applicable to any stage in all business process modelling projects
- User-defined list, table, tree, matrix, and graphical data views
- Built-in change history, baselines, review and formal change control
- User-defined workflows for each type of information
- Provides collaboration through discussions, alerts, mail, comments and automatic notifications
- Data analysis from user-defined pivot tables, metrics, dashboards, KPIs
- Automated data load from documents, spreadsheets, raw data files, XML
- Publishes user-defined, production-quality, documentation
Benefits
- Equivalent to combination of JIRA, Confluence and QualityCenter
- Coordinate work by any number of users and groups
- Manage any volume of any types of information and documents
- Provide stakeholders controlled access to their parts of project data
- Eliminate quality problems, using automated, user-defined, conformance consistency checks
- Eliminate omissions and insertions using bi-directional, uniquely transitive, traceability
- Automatically generate consistent, production-quality, documentation in your format
- Easily reuse and share information between projects, teams and stakeholders
- Automatically generate management information, KPIs and dashboards
- Automate release management from sprints, iterations, phases and quality reviews
Pricing
£114.50 to £117.50 per user per month
- Education pricing available
Service documents
- Pricing document
- Skills Framework for the Information Age rate card
- Service definition document
- Terms and conditions
Framework
G-Cloud 11
Service ID
219023934433397
Contact
Service scope
| Software add-on or extension | No |
| Cloud deployment model |
|
| Service constraints | None. |
| System requirements | None. |
User support
| Email or online ticketing support | Email or online ticketing |
| Support response times | Technical support is available between 9:00am and 5:00pm UK time on business days excluding UK national and public holidays. We aim to respond to questions within 4 hours. |
| User can manage status and priority of support tickets | No |
| Phone support | Yes |
| Phone support availability | 9 to 5 (UK time), Monday to Friday |
| Web chat support | No |
| Onsite support | Yes, at extra cost |
| Support levels | We believe that multiple support levels are immoral and so we deliver the highest quality support to all users. We do not need technical account managers or cloud support engineers. All our support staff can provide support to cloud users and all have the authority that you may associate with an account manager. Cloud support is included in the service costs. On-site support is charged at the rates in our SFIA labour categories. |
| Support available to third parties | Yes |
Onboarding and offboarding
| Getting started | On-boarding and startup services are available if required. These include training, workshops, mentoring and on-going assistance. Normal practice is to work together to deploy the service so users can start to do the work - which takes one week. |
| Service documentation | Yes |
| Documentation formats |
|
| End-of-contract data extraction | Either export the data into user's preferred tool-independent data format or publish reports and documents in user-defined formats, or both. |
| End-of-contract process | Support services continue to contract end, which includes guidance to export data. Any other services required can be provided as Cloud Support services. |
Using the service
| Web browser interface | Yes |
| Supported browsers |
|
| Application to install | Yes |
| Compatible operating systems |
|
| Designed for use on mobile devices | Yes |
| Differences between the mobile and desktop service | No differences for Windows and Linux mobile devices. For Android and iOS mobile devices, service is only available through web browser. |
| Accessibility standards | WCAG 2.1 A |
| Accessibility testing | Behaviour has been verified with people of limited vision using standard Windows assistive technology and third party tools such as Chrome Speak and FoxVox. |
| API | Yes |
| What users can and can't do using the API | All service features are available through the API |
| API documentation | Yes |
| API documentation formats |
|
| API sandbox or test environment | Yes |
| Customisation available | Yes |
| Description of customisation | Database (items, attributes, links, properties), queries, views, forms, graphs, reports, documents, metrics, KPIs/dashboards, process, CM system, workflows, UI layout and content, authentication and access control. In essence, everything can be customised. Who can customise and what they can customise is defined by you, the users. |
Scaling
| Independence of resources |
- Fair round-robin scheduling inside service's software - Adequate host hardware - Dynamic balancing of load across servers (transparent to users) as necessary - Determined by agreed SLA |
Analytics
| Service usage metrics | Yes |
| Metrics types | Numeric and/or graphical, daily, weekly or monthly reports. Reports contain details of logins, users, source hosts/IPs, failed logins disabled logins, licence grants, licence denials, concurrent licence use |
| Reporting types |
|
Resellers
| Supplier type | Not a reseller |
Staff security
| Staff security clearance | Conforms to BS7858:2012 |
| Government security clearance | Up to Security Clearance (SC) |
Asset protection
| Knowledge of data storage and processing locations | Yes |
| Data storage and processing locations | United Kingdom |
| User control over data storage and processing locations | Yes |
| Datacentre security standards | Managed by a third party |
| Penetration testing frequency | At least once a year |
| Penetration testing approach | ‘IT Health Check’ performed by a CHECK service provider |
| Protecting data at rest | Other |
| Other data at rest protection approach | Managed by a third party who has authority to manage data to OFFICIAL SENSITIVE. |
| Data sanitisation process | Yes |
| Data sanitisation type | Explicit overwriting of storage before reallocation |
| Equipment disposal approach | A third-party destruction service |
Data importing and exporting
| Data export approach | From the Export button in the tool's UI or from a command line. Note 'export formats' can be defined with users' preferred options so exports are performed consistently. |
| Data export formats |
|
| Other data export formats |
|
| Data import formats |
|
| Other data import formats |
|
Data-in-transit protection
| Data protection between buyer and supplier networks | Other |
| Other protection between networks | The service is directly connected to PSN, there is no separate network, there is only PSN. |
| Data protection within supplier network | Other |
| Other protection within supplier network | Not applicable, the service is directly connected to PSN. |
Availability and resilience
| Guaranteed availability | 99.9%. Refund available on request as a proportion of the time between 8am and 6pm Monday to Friday for all working days that the service is not available. |
| Approach to resilience | This service is provided using third party Cloud Hosting, whose resilience provisions are available on request. |
| Outage reporting | As required by the service user. We can provide a telephone call, e-mail, tweet or any other preferred communication method. Public noticeboard is an option, but this would mean that we would be advertising the use of this service by the HMG group, department or agency. |
Identity and authentication
| User authentication needed | Yes |
| User authentication | Other |
| Other user authentication | Most access is only via PSN. We can provide IPsec host-to-network or network-to-network VPN. Users authenticate using username and password. Optional single sign-on of browser based users with our agreement subject to our check of HMG accreditation. |
| Access restrictions in management interfaces and support channels | Our service provides user-defined databases. Each database has a list of users. Each user has a set of rights. Only users with appropriate rights can perform admin functions, and only within that database. |
| Access restriction testing frequency | At least every 6 months |
| Management access authentication |
|
Audit information for users
| Access to user activity audit information | Users have access to real-time audit information |
| How long user audit data is stored for | User-defined |
| Access to supplier activity audit information | Users have access to real-time audit information |
| How long supplier audit data is stored for | User-defined |
| How long system logs are stored for | User-defined |
Standards and certifications
| ISO/IEC 27001 certification | No |
| ISO 28000:2007 certification | No |
| CSA STAR certification | Yes |
| CSA STAR accreditation date | Available on request from Cloud Hosting suppliers |
| CSA STAR certification level | Level 5: CSA STAR Continuous Monitoring |
| What the CSA STAR doesn’t cover | Available on request from Cloud Hosting suppliers |
| PCI certification | Yes |
| Who accredited the PCI DSS certification | Trustwave |
| PCI DSS accreditation date | 08/01/2019 |
| What the PCI DSS doesn’t cover | We are assured by Trustwave that they cover ALL our PCI DSS needs. Everything that needs to be covered, is. Anything that is not covered falls into the category of not relevant. |
| Other security certifications | Yes |
| Any other security certifications |
|
Security governance
| Named board-level person responsible for service security | Yes |
| Security governance certified | Yes |
| Security governance standards | ISO/IEC 27001 |
| Information security policies and processes |
- Security vetting of all personnel - Partitioning of access rights by subject, by person, by role - Principle of 'need to know' applies to all InfoSec decisions - Periodic IS1/IS2 analyses of threats and attack vectors - InfoSec policies for internal IT, including CIA analyses, password policies, AV, multi-level filtering of incoming and outgoing communications, multiple layer firewalls (DMZs) |
Operational security
| Configuration and change management standard | Supplier-defined controls |
| Configuration and change management approach |
- All components are built in-house - All source code is managed by a SCCS with full change tracking - All service component builds are automated from the SCCS with no opportunity for external interference - All built components are digitally signed - SHA512 checksums for all components - All components installed on the third party Cloud Hosting are verified monthly to ensure they are unchanged |
| Vulnerability management type | Supplier-defined controls |
| Vulnerability management approach |
- Quarterly threat reviews - Annual IT Health Check, threat analyses and RMADS for the OFFICIAL/IL3 services - Security patches deployed as soon as possible, subject to agreement from user community to downtime - Otherwise deployed during an outage agreed with user community |
| Protective monitoring type | Supplier-defined controls |
| Protective monitoring approach |
- Automated 3-hourly review of all service components' digital signatures and SHA512 checksums - Discrepancy automatically raises an alert and suspends users' access - Automated rectification by unpacking replacement, original, component from secure area, validating its checksum and installing it |
| Incident management type | Supplier-defined controls |
| Incident management approach | Support calls are logged, characterised and prioritised and acknowledged. Calls are progressed to closure, or confirmed bug or accepted enhancement request. Escalation process available. Each customer can get a report of their support calls from us or from our website. |
Secure development
| Approach to secure software development best practice | Supplier-defined process |
Public sector networks
| Connection to public sector networks | Yes |
| Connected networks | Public Services Network (PSN) |
Pricing
| Price | £114.50 to £117.50 per user per month |
| Discount for educational organisations | Yes |
| Free trial available | Yes |
| Description of free trial | Full version of service available for one month. |
| Link to free trial | https://www.threesl.com/downloads/software.php |