Verto is a fully configurable work collaboration and programme management service with 100,000 public sector users. Verto provides collaboration, performance planning, portfolio, project and programme management and a full PMO solution. It supports shared service and ICS transformation programmes, grant/bid management and a range of business processes across an organisation
- Work Collaboration
- Mobile working, messaging and file sharing
- Portfolio, project and programme management
- PMO management
- Golden Thread reporting capability
- Approvals, tasks and milestones
- Benefit management
- Resource management
- Risk and issue management
- Performance planning
- Control and governance
- Combines work collaboration with project management
- Mobile working
- Significant cost and time saving
- Real time management information
- Links project outputs to performance outcomes
- Automated reports
£11.00 to £25.00 per person per month
- Pricing document
- Skills Framework for the Information Age rate card
- Service definition document
- Terms and conditions
|Software add-on or extension||No|
|Cloud deployment model||Public cloud|
|System requirements||Supported Versions of IE, Chrome & Safari|
|Email or online ticketing support||Email or online ticketing|
|Support response times||Monday to Friday 9:00am to 5:30pm|
|User can manage status and priority of support tickets||No|
|Phone support availability||9 to 5 (UK time), Monday to Friday|
|Web chat support||No|
|Onsite support||Onsite support|
|Support levels||Same business day|
|Support available to third parties||Yes|
Onboarding and offboarding
|Getting started||Onsite, Online, Webex and documentation are provide to help users start using the service.|
|End-of-contract data extraction||A full database backup which will contain ALL user data will be supplied at the the end of contract.|
A full Database backup of the customers data will be made available for secure download.
All data will be removed from our servers.
Additional bespoke extracts of portions of data may be chargeable.
Using the service
|Web browser interface||Yes|
|Application to install||No|
|Designed for use on mobile devices||Yes|
|Differences between the mobile and desktop service||No difference|
|Description of customisation||Users can customise dashboards, forms, workflow, notifications and colour palettes as long as they have been granted Administrative privileges.|
|Independence of resources||
Each customer runs in a separate application pool.
The platform scales horizontally and vertically.
All CPU and memory usage is monitored by each customer and escalated automatically to service agents if they are consuming too many resources.
|Service usage metrics||Yes|
We can provide metrics showing number of
In all cases the IP address, browser type and device type is also stored.
|Supplier type||Not a reseller|
|Staff security clearance||Other security clearance|
|Government security clearance||Up to Baseline Personnel Security Standard (BPSS)|
|Knowledge of data storage and processing locations||Yes|
|Data storage and processing locations||United Kingdom|
|User control over data storage and processing locations||No|
|Datacentre security standards||Complies with a recognised standard (for example CSA CCM version 3.0)|
|Penetration testing frequency||At least once a year|
|Penetration testing approach||‘IT Health Check’ performed by a CHECK service provider|
|Protecting data at rest||Physical access control, complying with SSAE-16 / ISAE 3402|
|Data sanitisation process||No|
|Equipment disposal approach||In-house destruction process|
Data importing and exporting
|Data export approach||Users can export their data using our reporting engine. All reports can be exported in XML, CSV & Excel. This allows us to provide a report that can be run many times with differing parameters to facilitate extracts of data.|
|Data export formats||
|Other data export formats||
|Data import formats||CSV|
|Data protection between buyer and supplier networks||TLS (version 1.2 or above)|
|Data protection within supplier network||IPsec or TLS VPN gateway|
Availability and resilience
Help Desk – 9:00 a.m. – 5:30 p.m. Monday – Friday
Faults/Issues can be reported via email or phone. Any calls or emails that cannot be immediately resolved are logged on the TMI bug and issue tracker which allocates a unique reference and records the customer and individual raising the fault in addition to the description of the fault, etc.
Faults (System Unavailable) are given the highest priority and are aimed to be fixed within 60 minutes where possible.
Full details are provided within the enclosed SLA
|Approach to resilience||Information is available on request.|
|Outage reporting||Email alerts to Administrative Users. These users are typically the Admin contacts for each of our customers.|
Identity and authentication
|User authentication needed||Yes|
|User authentication||Username or password|
|Access restrictions in management interfaces and support channels||Access to management interfaces is restricted to authorised staff who MUST access the platform using a VPN connection. No generic accounts are used for management or support tasks and all activities are logged.|
|Access restriction testing frequency||At least once a year|
|Management access authentication||
Audit information for users
|Access to user activity audit information||Users have access to real-time audit information|
|How long user audit data is stored for||At least 12 months|
|Access to supplier activity audit information||Users contact the support team to get audit information|
|How long supplier audit data is stored for||At least 12 months|
|How long system logs are stored for||Between 1 month and 6 months|
Standards and certifications
|ISO/IEC 27001 certification||No|
|ISO 28000:2007 certification||No|
|CSA STAR certification||No|
|Other security certifications||No|
|Named board-level person responsible for service security||Yes|
|Security governance certified||No|
|Security governance approach||We follow the standards laid out in ISO27001 and have begun the process of obtaining accreditation to the standard.|
|Information security policies and processes||
We fully recognise that Information is a critical asset of our customers.
We have an information security policy, a staff IT usage policy & a Secure Data Handling policy. These documents are reviewed annually. All of our staff are given training (both initially and ongoing) that includes both data protection and information security. All staff must conform to these policies, breeches of these policies are taken very seriously and may result in disciplinary measures.
Any reports of suspected breeches to these policies can be made by ANY member of staff to ANY senior manager. All confirmed breeches are dealt with by a Director of the company.
During 2017 we will be reviewing our policies to ensure they meet the standards of the GDPR by May 2018.
|Configuration and change management standard||Supplier-defined controls|
|Configuration and change management approach||
Source control is used to manage both the code and the basic application configuration of all customers.
Any changes to LIVE services (software or server configuration) must go through our change control process which includes a Change Assessment Board. All changes must be documented and approved by the board prior to entering production.
|Vulnerability management type||Supplier-defined controls|
|Vulnerability management approach||
Our development team monitor threats and assess the threat to our software as they become aware of a threat.
Any threats that expose a vulnerability in our software are patched as soon as practically possible and are treated as P1 issues within our helpdesk.
We constantly review current threats by monitoring both commercial and not for profit websites that publish details of the latest threats. We review which sites to use on a quarterly basis. In addition we subscribe to alerting sites.
|Protective monitoring type||Supplier-defined controls|
|Protective monitoring approach||
Identifying compromises (or attempts) uses a multi-layer approach. Our ISP has an IDS which provides us reports as soon as it identifies any potential issues.
In addition our own application monitoring allows us to identify 'unusual' activity within the application.
Incidents of this type are treated as P1 by our helpdesk.
|Incident management type||Supplier-defined controls|
|Incident management approach||
We have a prescribed incident management process that covers all common incident type raised by our customers.
Users can report incidents to our helpdesk by phone or email. Alternatively the have the direct contact details of their account manager who can also start the incident management process.
Reporting on incidents will depend on it's severity. Minor incidents will simply be reported in the closure text of an incident. Major incidents involving any significant outages or security compromise will result in a Major Incident report.
|Approach to secure software development best practice||Conforms to a recognised standard, but self-assessed|
Public sector networks
|Connection to public sector networks||No|
|Price||£11.00 to £25.00 per person per month|
|Discount for educational organisations||No|
|Free trial available||Yes|
|Description of free trial||A free 30 day trial is available through the VertoCloud website.|
|Link to free trial||https://vertocloud.co.uk|