TMI Systems

Verto

Verto is a cloud-based work collaboration platform for everyone. It manages everything from simple day to day tasks through to major projects and programmes for over 100,000 public sector users. Verto is entirely user configurable supporting multiple business processes for Central and local government, NHS, and emergency services.

Features

  • Work Collaboration
  • Mobile working, messaging and file sharing
  • Portfolio, project and programme management
  • PMO management
  • Golden Thread reporting capability
  • Approvals, tasks and milestones
  • Benefit management
  • Resource management
  • Risk and issue management
  • Performance planning

Benefits

  • Control and governance
  • Combines work collaboration with project management
  • Mobile working
  • Significant cost and time saving
  • Real time management information
  • Links project outputs to performance outcomes
  • Automated reports

Pricing

£5.00 to £25.00 a person a month

Service documents

Framework

G-Cloud 12

Service ID

4 1 9 5 6 0 1 4 9 5 5 5 7 3 9

Contact

TMI Systems Chris Wright
Telephone: 01183346200
Email: enquiries@tmi-systems.com

Service scope

Software add-on or extension
No
Cloud deployment model
Public cloud
Service constraints
None
System requirements
Supported Versions of IE, Chrome & Safari

User support

Email or online ticketing support
Email or online ticketing
Support response times
Monday to Friday 9:00am to 5:30pm
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Onsite support
Support levels
Same business day
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Onsite, Online, Webex and documentation are provide to help users start using the service.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
A full database backup which will contain ALL user data will be supplied at the the end of contract.
End-of-contract process
A full Database backup of the customers data will be made available for secure download.
All data will be removed from our servers.
Additional bespoke extracts of portions of data may be chargeable.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Chrome
  • Safari 9+
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
The product is responsive to the device size being used to access it.
Service interface
No
API
No
Customisation available
Yes
Description of customisation
Users can customise dashboards, forms, workflow, notifications and colour palettes as long as they have been granted Administrative privileges.

Scaling

Independence of resources
Each customer runs in a separate application pool.
The platform scales horizontally and vertically.
All CPU and memory usage is monitored by each customer and escalated automatically to service agents if they are consuming too many resources.

Analytics

Service usage metrics
Yes
Metrics types
We can provide metrics showing number of
logins attempts
successful logins
unsuccessful logins
In all cases the IP address, browser type and device type is also stored.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Physical access control, complying with SSAE-16 / ISAE 3402
Data sanitisation process
Yes
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
In-house destruction process

Data importing and exporting

Data export approach
Users can export their data using our reporting engine. All reports can be exported in XML, CSV & Excel. This allows us to provide a report that can be run many times with differing parameters to facilitate extracts of data.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • Excel
  • PDF
  • Word
Data import formats
  • CSV
  • Other
Other data import formats
  • MS Project
  • XLS
  • XML

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
Help Desk – 9:00 a.m. – 5:30 p.m. Monday – Friday
Faults/Issues can be reported via email or phone. Any calls or emails that cannot be immediately resolved are logged on the TMI bug and issue tracker which allocates a unique reference and records the customer and individual raising the fault in addition to the description of the fault, etc.

Faults (System Unavailable) are given the highest priority and are aimed to be fixed within 60 minutes where possible.
Full details are provided within the enclosed SLA
Approach to resilience
Information is available on request.
Outage reporting
Email alerts to Administrative Users. These users are typically the Admin contacts for each of our customers.

Identity and authentication

User authentication needed
Yes
User authentication
Username or password
Access restrictions in management interfaces and support channels
Access to management interfaces is restricted to authorised staff who MUST access the platform using a VPN connection. No generic accounts are used for management or support tasks and all activities are logged.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
Between 1 month and 6 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
No
Security governance approach
We follow the standards laid out in ISO27001 and have begun the process of obtaining accreditation to the standard.
Information security policies and processes
We fully recognise that Information is a critical asset of our customers.
We have an information security policy, a staff IT usage policy & a Secure Data Handling policy. These documents are reviewed annually. All of our staff are given training (both initially and ongoing) that includes both data protection and information security. All staff must conform to these policies, breeches of these policies are taken very seriously and may result in disciplinary measures.

Any reports of suspected breeches to these policies can be made by ANY member of staff to ANY senior manager. All confirmed breeches are dealt with by a Director of the company.

During 2017 we will be reviewing our policies to ensure they meet the standards of the GDPR by May 2018.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Source control is used to manage both the code and the basic application configuration of all customers.
Any changes to LIVE services (software or server configuration) must go through our change control process which includes a Change Assessment Board. All changes must be documented and approved by the board prior to entering production.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Our development team monitor threats and assess the threat to our software as they become aware of a threat.

Any threats that expose a vulnerability in our software are patched as soon as practically possible and are treated as P1 issues within our helpdesk.

We constantly review current threats by monitoring both commercial and not for profit websites that publish details of the latest threats. We review which sites to use on a quarterly basis. In addition we subscribe to alerting sites.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Identifying compromises (or attempts) uses a multi-layer approach. Our ISP has an IDS which provides us reports as soon as it identifies any potential issues.
In addition our own application monitoring allows us to identify 'unusual' activity within the application.
Incidents of this type are treated as P1 by our helpdesk.
Incident management type
Supplier-defined controls
Incident management approach
We have a prescribed incident management process that covers all common incident type raised by our customers.
Users can report incidents to our helpdesk by phone or email. Alternatively the have the direct contact details of their account manager who can also start the incident management process.
Reporting on incidents will depend on it's severity. Minor incidents will simply be reported in the closure text of an incident. Major incidents involving any significant outages or security compromise will result in a Major Incident report.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks
No

Pricing

Price
£5.00 to £25.00 a person a month
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
A free 30 day trial is available through the VertoCloud website.
Link to free trial
https://vertocloud.co.uk

Service documents