Qubix International Ltd

Qubix Oracle Enterprise Resource Planning (ERP) Applications

Qubix is one of the UK's leading implementation and managed service providers for Oracle Enterprise Resource Planning (ERP), Analytics, and EPM (Enterprise Management) solutions. Established in 1987 we have over 1000 successful engagements we are perfectly positioned to assist the UK government with their cloud strategy.

Features

• Budget Creation and Adjustment
• Forecast Creation and Tracking
• NHSI Plan Creation and Tracking
• 'What-if' Scenario Planning (e.g. for post-Covid operational change)
• Tracking Actual performance vs Forecast or Budget
• Pay modelling and driving toward performance targets
• Full dashboarding, reporting and 'burst' report sending
• Spreadsheet and MS Office Integration
• Full data integration technology with CloudBridge
• Master Data (Metadata) management capability with CloudBridge

Benefits

• Effective and rapid Budget Creation across Trusts
• Effective and rapid Forecast Creation across Trusts
• Track Actual performance compared to Budget and Forecast
• Improve change planning with
• Burst Reports to stakeholders automatically saving time
• Improve the accuracy of forecasts and budgets
• Reduce the FP&A cycle period allowing more analysis time
• Make finance teams more efficient and operate with fewer people
• Make organisational change more efficient and predictable

£256 a person a month

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Framework

G-Cloud 12

Service ID

275155559436773

Contact

Paul Johnston
01483 480222
paul.johnston@qubix.com

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Qubix Oracle Enterprise Resource Planning (ERP) Applications Product uses Oracle Oracle Fusion ERP to provide its capabilities.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The service is configurable. Customers may wish to introduce constraints (such as using fewer modules) to save money.
• System requirements: Client would purchase an Oracle Fusion ERP License

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Platform Service is 24x365; ; Functionality Support provision is available 24x365 or as limited hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Core Product Service Support is provided by Oracle Corporation, and provides an unlimited level of Support engagement over the course of the contract. ; ; Functionality Support is provided by Qubix International. A number of different arrangements are possible based on either a consumption credits model or a Full Service Agreement-based model. ; The standard contract is a consumption-based model, where the customer is supplied credits that they can consume on support tickets, change, or training. Credits are supplied free with the service, with additional at £625 per credit (4 hours). Service Agreement-based provision is by agreement and depends on the Service Catalogue options chosen. Genertally, clients with this service do not need to purchase additioal credits beyond the free provision. ; ; Qubix and Oracle provide Account Managers. These resources have technical knowledge, but likely will not change configurations.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: User adoption is at the heart of our delivery framework and this is achieved in a number of ways :; ; 1) Full communication of service to all parties; 2) Conference Room Pilots throughout an implementation; 3) Continuous Improvement; 4) Training analysis, online and offline training and on-line documentation; 5) Exposure to new product functionality via briefings; ; Training Phase within an implementation :; ; Training on Core ERPM Technology to all relevant parties (on-site, live classroom or remote we-classroom - both with system access); ; Training on capabilities, best practice and usage to exec team (on-site or remote coaching); ; Training on Platform to IT Team (usually remote); (Option) Access to Qubix Academy web-based training resource (web-based training); ; Ongoing Training through :; ; 1) Regular health-checks / support checks; 2) Exposure to new product functionality via briefings; 3) Access to Qubix Academy (web-based training); 4) Access to additional free and paid-for Qubix and Oracle training
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The system is securely torn-down at end-of-life, so only data that needs to be retained needs to be removed from the service. ; ; There are 2 options to achieve this:; 1. Extract Data with web interface.; 2. Use of API to extract data
• End-of-contract process: Teardown of systems and removal of data is provided on contract termination.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: All of the core ERP functionality is present across desktop and mobile devices.
• Service interface: Yes
• Description of service interface: There is a web interface (Enterprise Manager) to manage the overall Cloud Service, though icustomer's users might not need to access this.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: The console is provided by Oracle Corp. Oracle is committed to providing accessible technology and this is built into their standard testing regime. ; ; Policy information on same is provided here:; https://www.oracle.com/corporate/accessibility/; ; Details of testing programmes are available here:; https://www.itic.org/dotAsset/00943b29-0586-4a9b-bd20-371fc5fb59f2.pdf
• API: Yes
• What users can and can't do using the API: There are API Layers to the ERP Cloud technology.; The ERP technology provides very wide functional coverage, and the API layer exposes this in a modular way with various endpoints available. These are documented here:; https://docs.oracle.com/en/cloud/saas/financials/19d/farfa/rest-endpoints.html
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The service is fully customisable. This is achieved via the application front-end, by administrators or configured. This is performed mainly at implementation phase, and subsequently maintained. ; For example, core customisation would be the set-up of Chart of Accounts, Ledgers and Subledgers. ; ; All components have role-based security. To make the changes listed above a user would have to have Administrator-level access. There are 3 systems in the landscape to allow safe flow of change to the Live system.

Scaling

• Independence of resources: The Oracle platform uses various controls to prevent noisy neighbours from impacting provision of service. The way this is achieved requires a full architecture overview, put simply it virtualises customers independently and ensures that provision is ring-fenced to these virtual notes, and that hardware provision for these nodes is distributed effectively, and onto physical hardware that is not over-subscribed.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics are available across the service. Key examples include:; ; 1. Usage; The system tracks all user interactions, and it is possible to audit who has been working on all areas of the system.; 2. Security metrics (user logons, resets, etc); 3. Support ticket status; 4. Support Credits used (for functional support via Qubix)
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Oracle Corporation

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users can export data via the web GUI, and this can be exported to their devices or to cloud object storage. It is also possible to use the spreadsheet link for this purpose. ; Also, there is a Data management layer that allows all sorts of ETL, import/export jobs to be built and run. ; Data import/export is a platform capability, so there are many options to achieve this task, and the best one to use would depend on the amount of data and if the task was going to be repeated.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XML
  • Xls, xlsx
  • Pdf
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Xls, xslx
  • XML
  • We can handle almost anything else via CloudBridge conversions

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: SLA for the technology components is 99.95% . ; This commitment is described in this linked document:; https://www.oracle.com/assets/saas-public-cloud-services-pillar-3610529.pdf; ; If availability targets are not upheld, Service credits are applicable. The level of these depends on the level of service requested, since they are calculated as a percentage of these fees. This is described in section 2 of the linked document.
• Approach to resilience: The architecture design of the Oracle Cloud Infrastructure (SaaS EPM Cloud Components) is world-class in terms of design for resilience. ; There is redundancy at all hardware layers within an availability domain (data centre) and across availability domains. Local fault domains ensure that resources are allocated to the appropriate hardware, and that there is no resource bottlenecks on this hardware. ; In addition to this underpinning resilience, resources can be created with multiple servers that are front-ended with load balancers (or Oracle RAC for the Database). This will remove any single point of failure from the set-up. ; This linked document has additional details:; https://docs.oracle.com/en/solutions/design-ha/index.html#GUID-D246FCD4-A9A1-47BB-9D72-A27633D539BD
• Outage reporting: The Oracle SaaS platform reports service availability on a (customer accessible) Dashboard, and administrators get emails of service issues.; The system availability status can be made available via an API.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: The Security layer for the PaaS Cloud is entirely independent of the Application Technology and Data Layer. This means there are not the usual issues with hierarchical security management where you always need (technical) administrators with access to data. ; For this reason, there is role-based access layer that allows provision of the correct level of access to all of the components, including Support Channels and Management consoles.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: EY/CertifyPoint BV, Amsterdam, Netherlands
• ISO/IEC 27001 accreditation date: 2019
• What the ISO/IEC 27001 doesn’t cover: All the components in the solution are covered by the above Certification. ; ; However, extension services such as the training platform and support console (which are from other providers) are not.
• ISO 28000:2007 certification: No
• CSA STAR certification: Yes
• CSA STAR accreditation date: 2018
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: All the components in the solution are covered by the above Certification. ; ; However, extension services such as the training platform and support console (which are from other providers) are not.
• PCI certification: Yes
• Who accredited the PCI DSS certification: Not disclosed
• PCI DSS accreditation date: 2019
• What the PCI DSS doesn’t cover: The Analytics Component and the CloudBridge integration are not covered (these, in any case, can't be covered, as they have flexible data storage options that could lead to non-compliance against a standard based on customer use).
• Other security certifications: Yes
• Any other security certifications:
  • Cyber Essentials Plus certification
  • DISA SRG—Defense Information Systems Agency, Security Requirements Guide
  • CJIS—Criminal Justice Information Services
  • UK NHS DSPT
  • United Kingdom Cloud Security Principles

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: There are several dozen security compliance standards that the solution is compliant it, including:; UK NHS DSPT; United Kingdom Cloud Security Principles; Data Privacy Act; GDPR—General Data Protection Regulation; A full list is contained here:; https://www.oracle.com/uk/cloud/cloud-infrastructure-compliance/
• Information security policies and processes: The overall security policies are the responsibility of the Qubix Operations Director, who is a member of the Qubix Board. There are different policies in place for the various different aspects of security, such as password policies on builds, and asset security. ; For the implementation of security policies this is led by either Product Managers (if building or changing products) or Project Managers for individual project implementations.; We occasionally use 3rd parties for independent testing against policy (for example penetration testing of our products or systems).

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Qubix has robust change and configuration management that allows it to build complex technology products and manage these across a wide install base. ; Products are comprised of features, which can be independently introduced, changed, deprecated, and removed from the product. Features have their own version control and code management. The products also have their own versioning, as do the underpinning platform components. We use a variety of in-house (such as our corporate Wiki) and commercial tools (such as GitHub) to manage and deploy these configurations.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Some aspects of the Oracle SaaS Cloud are not disclosed in order to protect overall security. However, some relevant facts are:; Patches are kept up-to-date in a monthly cycle + emergency patches. Functionality updates are quarterly.; Oracle has an entire corporate area looking at vulnerability management and threat and threat vector identification is handled has part of this overall security management of its Cloud.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: There is a full application-monitoring layer built into the Oracle ERP SaaS cloud. This will raise alerts for admins, and can also be linked to wider service monitoring technology. This protects the infrastructure and application layers. In terms of service response, this means there is practically no delay between service impact and rectification teams being made aware. ; In addition to this, we have Service Monitoring technology built into the CloudBridge, which will raise alerts instantly on service impact to Business Functionality (BPM Alerting).
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: The IM process is essentially an ITIL-aligned, structured process where the primary objectives are:; 1. An easy and pleasant experience for the users.; 2. Effective and efficient routing of the problem to the people that can address it.; 3. Fastest possible end-to-end solution of the issue.; Users can log calls via eMail, web form, or phone.; Incident reports are provided monthly, and if there has been a major incident as soon as that report is prepared.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Price: £256 a person a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF