TMI Systems


Verto is a fully configurable work collaboration and programme management service with 100,000 public sector users. Verto provides collaboration, performance planning, portfolio, project and programme management and a full PMO solution. It supports shared service and ICS transformation programmes, grant/bid management and a range of business processes across an organisation


  • Work Collaboration
  • Mobile working, messaging and file sharing
  • Portfolio, project and programme management
  • PMO management
  • Golden Thread reporting capability
  • Approvals, tasks and milestones
  • Benefit management
  • Resource management
  • Risk and issue management
  • Performance planning


  • Control and governance
  • Combines work collaboration with project management
  • Mobile working
  • Significant cost and time saving
  • Real time management information
  • Links project outputs to performance outcomes
  • Automated reports


£11.00 to £25.00 per person per month

Service documents

G-Cloud 11


TMI Systems

Chris Wright


Service scope

Service scope
Software add-on or extension No
Cloud deployment model Public cloud
Service constraints None
System requirements Supported Versions of IE, Chrome & Safari

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Monday to Friday 9:00am to 5:30pm
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support No
Onsite support Onsite support
Support levels Same business day
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started Onsite, Online, Webex and documentation are provide to help users start using the service.
Service documentation Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction A full database backup which will contain ALL user data will be supplied at the the end of contract.
End-of-contract process A full Database backup of the customers data will be made available for secure download.
All data will be removed from our servers.
Additional bespoke extracts of portions of data may be chargeable.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Chrome
  • Safari 9+
Application to install No
Designed for use on mobile devices Yes
Differences between the mobile and desktop service No difference
Service interface No
Customisation available Yes
Description of customisation Users can customise dashboards, forms, workflow, notifications and colour palettes as long as they have been granted Administrative privileges.


Independence of resources Each customer runs in a separate application pool.
The platform scales horizontally and vertically.
All CPU and memory usage is monitored by each customer and escalated automatically to service agents if they are consuming too many resources.


Service usage metrics Yes
Metrics types We can provide metrics showing number of
logins attempts
successful logins
unsuccessful logins
In all cases the IP address, browser type and device type is also stored.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations United Kingdom
User control over data storage and processing locations No
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least once a year
Penetration testing approach ‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest Physical access control, complying with SSAE-16 / ISAE 3402
Data sanitisation process No
Equipment disposal approach In-house destruction process

Data importing and exporting

Data importing and exporting
Data export approach Users can export their data using our reporting engine. All reports can be exported in XML, CSV & Excel. This allows us to provide a report that can be run many times with differing parameters to facilitate extracts of data.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • Excel
  • PDF
  • Word
Data import formats CSV

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network IPsec or TLS VPN gateway

Availability and resilience

Availability and resilience
Guaranteed availability Help Desk – 9:00 a.m. – 5:30 p.m. Monday – Friday
Faults/Issues can be reported via email or phone. Any calls or emails that cannot be immediately resolved are logged on the TMI bug and issue tracker which allocates a unique reference and records the customer and individual raising the fault in addition to the description of the fault, etc.

Faults (System Unavailable) are given the highest priority and are aimed to be fixed within 60 minutes where possible.
Full details are provided within the enclosed SLA
Approach to resilience Information is available on request.
Outage reporting Email alerts to Administrative Users. These users are typically the Admin contacts for each of our customers.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication Username or password
Access restrictions in management interfaces and support channels Access to management interfaces is restricted to authorised staff who MUST access the platform using a VPN connection. No generic accounts are used for management or support tasks and all activities are logged.
Access restriction testing frequency At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for At least 12 months
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for At least 12 months
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications No

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified No
Security governance approach We follow the standards laid out in ISO27001 and have begun the process of obtaining accreditation to the standard.
Information security policies and processes We fully recognise that Information is a critical asset of our customers.
We have an information security policy, a staff IT usage policy & a Secure Data Handling policy. These documents are reviewed annually. All of our staff are given training (both initially and ongoing) that includes both data protection and information security. All staff must conform to these policies, breeches of these policies are taken very seriously and may result in disciplinary measures.

Any reports of suspected breeches to these policies can be made by ANY member of staff to ANY senior manager. All confirmed breeches are dealt with by a Director of the company.

During 2017 we will be reviewing our policies to ensure they meet the standards of the GDPR by May 2018.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach Source control is used to manage both the code and the basic application configuration of all customers.
Any changes to LIVE services (software or server configuration) must go through our change control process which includes a Change Assessment Board. All changes must be documented and approved by the board prior to entering production.
Vulnerability management type Supplier-defined controls
Vulnerability management approach Our development team monitor threats and assess the threat to our software as they become aware of a threat.

Any threats that expose a vulnerability in our software are patched as soon as practically possible and are treated as P1 issues within our helpdesk.

We constantly review current threats by monitoring both commercial and not for profit websites that publish details of the latest threats. We review which sites to use on a quarterly basis. In addition we subscribe to alerting sites.
Protective monitoring type Supplier-defined controls
Protective monitoring approach Identifying compromises (or attempts) uses a multi-layer approach. Our ISP has an IDS which provides us reports as soon as it identifies any potential issues.
In addition our own application monitoring allows us to identify 'unusual' activity within the application.
Incidents of this type are treated as P1 by our helpdesk.
Incident management type Supplier-defined controls
Incident management approach We have a prescribed incident management process that covers all common incident type raised by our customers.
Users can report incidents to our helpdesk by phone or email. Alternatively the have the direct contact details of their account manager who can also start the incident management process.
Reporting on incidents will depend on it's severity. Minor incidents will simply be reported in the closure text of an incident. Major incidents involving any significant outages or security compromise will result in a Major Incident report.

Secure development

Secure development
Approach to secure software development best practice Conforms to a recognised standard, but self-assessed

Public sector networks

Public sector networks
Connection to public sector networks No


Price £11.00 to £25.00 per person per month
Discount for educational organisations No
Free trial available Yes
Description of free trial A free 30 day trial is available through the VertoCloud website.
Link to free trial

Service documents

pdf document: Pricing document pdf document: Skills Framework for the Information Age rate card pdf document: Service definition document pdf document: Terms and conditions
Service documents
Return to top ↑