Business Process Approval Workflow Manager. Services Definition Document

Business Process Approval Workflow Manager Services Definition Document Introducing CoreStream CoreStream is a UK based provider of technology solutions focused on helping organisations manage risk, satisfy compliance obligations and ultimately operate more effectively. Our aim is simple; to make technology intuitive. Our leadership team has decades of combined experience in big 4 consultancies and has experience in procuring and implementing technology solutions as clients ourselves. We recognise the common frustrations of working with technology partners and use this understanding to ensure we structure projects to deliver quality output, on time and within budget. CoreStream has experience operating in a wide range of industries, including a wealth of experience in the public sector and financial services. We have strong and long-running relationships with a number of blue-chip clients which sees us renowned for delivering line-of-business applications that yield immediate results. CoreStream Ltd All Rights Reserved Page 1 of 10

Table of Contents 1. Overview... 3 1.1. Approval Workflow Sample Screenshot... 4 1.2. Workflow Dashboard Sample Screenshot... 5 1.3. Further Configuration and Development... 5 2. Information Assurance:... 5 3. Service Management... 6 3.1. Monitoring... 6 3.2. Data Backup and Recovery... 6 4. On-boarding and Off-boarding... 6 5. Pricing Overview... 7 6. Service Constraints... 8 7. Support Arrangements... 8 8. Training... 8 8.1. User Training:... 8 8.2. Super User Training... 8 9. Ordering and Invoicing Process... 9 10. Government ICT Blueprint Principles... 9 10.1. Information Strategy... 9 10.2. Greening Government... 9 CoreStream Ltd All Rights Reserved Page 2 of 10

1. Overview CoreStream workflow forms part of our integrated Governance, Risk and Compliance (GRC) suite, which is provided as Software as a Service (SaaS) to reduce complexity and implementation lead times. Our SaaS offering can even be deployed on premise behind your firewall. The workflow module provides a flexible environment for implementing approval processes within your organisation, with full control over data privacy, detailed audit trails and user-friendly dashboards. CoreStream Workflow is a flexible product, providing the ability to create Workflow perfectly aligned to the business processes to be brought on-line. Its aim is to reduce human error and focus stakeholders on the requirements of their specific roles, whilst ensuring that governance processes requiring explicit approvals are correctly followed and evidenced. The scope of supported processes is effectively unlimited. Some examples include: Approving or reviewing board papers and business cases; Reporting, reviewing and closing incidents; Approving Corporate Hospitality requests (anti-bribery and corruption); Approving marketing assets for publication; Approving holiday requests; Approving expenses; and Approving or reviewing policies. With simple additional training, customers can configure their own workflow processes directly through the interface and without resorting to coding. Key workflow functionality: Multi-stage and multi-directional workflow that maps to your existing business processes; Multiple question types and sub questions that are shown or hidden depending on answers to other questions; The ability to append comments to answers being reviewed, either to request further information or clarify areas of uncertainty; CoreStream Ltd All Rights Reserved Page 3 of 10

A function allowing users to upload attachments (as content to review or as evidence) to an approval process; Configurable email notifications; Simple yet sophisticated security to restrict workflow to the relevant parties; and Simple user dashboard to review the status of existing approval processes. Additional components of the CoreStream Platform can also be made available to support the workflow module Full details can be found on our website: www.corestream.co.uk 1.1. Approval Workflow Sample Screenshot CoreStream Ltd All Rights Reserved Page 4 of 10

1.2. Workflow Dashboard Sample Screenshot 1.3. Further Configuration and Development Whilst containing a rich out-of-the-box feature set, the CoreStream platform can be easily adapted to support our customers more bespoke requirements. Additional configuration can be performed either on a time and materials or fixed-price basis. 2. Information Assurance: The target level of assurance for this product is PGA impact level 3 (IL3) All operational data will be held by our hosting partners who are specialised G- Cloud framework suppliers, and accredited to IL3 CoreStream is ISO27001 certified via the British Assessment Bureau (BAB). UKAS approval audits are in progress, with full accreditation anticipated in May 2014. CoreStream Ltd All Rights Reserved Page 5 of 10

3. Service Management 3.1. Monitoring CoreStream hosting provides 24 hours a day and seven days a week monitoring of the computing, operating and networking infrastructure to detect and correct abnormalities. This includes environmental monitoring, network monitoring, load-balancing monitoring, web server and database monitoring, firewall monitoring, and intrusion detection. 3.2. Data Backup and Recovery Backup schedule can be varied according to specific requirements. Our default offering provides for weekly full system, and daily incremental backups. 4. On-boarding and Off-boarding CoreStream workflow pricing is based on a basic platform license plus a per workflow process basis. Each purchase of a process includes 2 days consultancy and configuration which would generally provide ample time to launch the basic service As such, a typical engagement would follow a simple on-boarding process: Requirements meeting (FOC) Confirm order (per schedule 3 of the Framework contract) Consultancy and configuration (2 days included) Platform deployment (included) User acceptance testing Training (as required rate card applies) Launch Data migration into the service can be supported using standard file formats (XLS, Raw Text, XML). Migration activities will be charged per the standard rate card unless accommodated within configuration days included with the license purchase CoreStream Ltd All Rights Reserved Page 6 of 10

Upon termination of this service, the relevant framework and call-off contract terms apply. Data repatriation will be provided free of charge (in raw text, XML, or CSV formats) unless additional requirements are specified for delivery of the data in non-standard file formats or with transformations applied. In these cases time and materials will be chargeable per the standard rate card. Following repatriation, all customer data will be purged and destroyed. 5. Pricing Overview Pricing is based on number of workflow approval processes being supported and number of users, comprising: Monthly platform license fee including 1 workflow process Monthly fee for additional workflow processes Fee for registered users in excess of 1000 users only No mandatory support contracts (time and materials or monthly fees support packages are available) Component Platform License Fee Per User Charges Includes Workflow Manager 3k pcm Includes 1 workflow approval process. Additional charged at 1k pcm per process* * Volume licensing discounts by separate negotiation - Up to 1000 user accounts included - Additional blocks of 100 users 100 pcm* - Full platform set-up - 2 days configuration, development, training and/or data population Additional configuration can be performed either on a time and materials (please refer to the CoreStream pricing document for details) or on a fixed-price basis A minimum 2 year contract tenure applies. Pilot implementations can be arranged for a minimum 1 year period, although all consultancy and configuration will be charged per our rate card. CoreStream Ltd All Rights Reserved Page 7 of 10

6. Service Constraints Deployments of new functionality will result in short outages to the service. CoreStream will provide 48 hours notice and (unless unavoidable) ensure that deployments are managed out of hours An acceptable use policy also applies see terms and conditions for details. 7. Support Arrangements Standard user-support over email and the telephone is available during working hours (Monday to Friday, 9am to 5pm). Out of hours support is available upon request. 8. Training 8.1. User Training: User training will depend on the complexity of the workflow process(es) and the number of users to be trained. Training can often be accomplished on a train the trainer basis, and delivered within the complementary days included with the platform license. In the event that additional training is required, time and materials are charged in accordance with our standard rate card. Large scale, multi-channel training programme design and delivery including video guides, and webinar broadcasts can be devised as required. Please refer to the CoreStream training service offering on CloudStore for details. 8.2. Super User Training Super users are trained to be able to configure the workflow process themselves, reducing the need for additional configuration expenditure. This non-technical training typically takes 2 days. CoreStream Ltd All Rights Reserved Page 8 of 10

9. Ordering and Invoicing Process Upon receipt of a purchase order, CoreStream will provision the environment. All license fees are to be paid 12 months in advance. 50% of the first 12 months fee is due upon ordering the environment The remaining 50% is due at the point of launch. If additional services, or blocks of users are purchased mid-contract, the relevant fee is payable up the end of the current 12 month period, after which fees revert to 12 months in advance. Time and materials (Consultancy, Training etc) are invoiced monthly in arrears. Invoices are due for payment within 15 days the invoice date. Please refer to our full terms and conditions for details. 10. Government ICT Blueprint Principles 10.1. Information Strategy CoreStream SaaS services are designed and built to align with government Information and Communications Technology (ICT) information strategy principles, ensuring information is effectively managed, protected and made accessible through the use of open standards technology. Our focus on information governance is underpinned by our ISO27001 certification (UKAS accreditation pending). 10.2. Greening Government CoreStream takes its environmental responsibilities seriously, aligning its operations to the published ICT government greening principles. In support of these principles, CoreStream guarantees: All hosting services are fully carbon-neutral Non-essential travel will be minimised through the use of technology, such as video conferencing To remain paper-free where ever possible To reduce waste or to recycle wherever possible Hot-desking in its office locations to reduce its overall office footprint. CoreStream Ltd All Rights Reserved Page 9 of 10