ID	S65
Version	3.0.6
Type	Overarching Standard
Status	Effective
Effective Date	Nov 28, 2025
Contracting Vehicle(s)	GP IT Futures Tech Innovation DFOCVC Community Pharmacy Clinical Services

1 Introduction
- 1.1 Type 1 & Type 2 Catalogue Solutions
2 Baseline Assurance Standard Requirements
3 Further Requirements
4 Performance Regime Template For Type 2 Catalogue Solutions
5 Other Documents Referenced Within Components Of The Standard
6 Roadmap

Introduction

Sets out the requirements for Suppliers with regards to the delivery and management of services that support and provide their Solutions.

Type 1 & Type 2 Catalogue Solutions

The Service Management Standard comprises of Type 1 & Type 2 Catalogue Solutions which are defined in the Catalogue Agreement.

With regards to performance management, remedies associated with poor performance and, where applicable, Service Credits, this information is set out in:

For Type 1 Catalogue Solutions: in schedule 2.5 (Performance Levels) of the Framework Agreement that is appropriate to the Contracting Vehicle; and
For Type 2 Catalogue Solutions: in schedule 2.1 (Performance Levels) of the Call Off Agreement that is appropriate to the Contracting Vehicle

Baseline Assurance Standard Requirements

The Baseline Assurance Standard (BAS) provides a proportionate, risk-based assurance approach for Solutions; balancing safety against efficiency by combining a minimum set of essential Requirements from the DSIC Overarching Standards. Completing the BAS is the first step to achieving full assurance with the Overarching Standards allowing Supplier Solutions to be published on the Buying Catalogue. Upon meeting this Standard, Solutions are required to meet any remaining Further Requirements in the Overarching Standard as applicable to the Contracting Vehicle within a period of 12 months.

All Baseline Assurance Requirements can be found here. Each Solution will be assigned a category of A, B or C that determines the level of assurance applied to that Solution. See the relevant category column to understand the assurance required for each Requirement. For information on Solution Categories see Solution Categories for Assurance in DSIC.

The following table of Requirements are the Requirements in the Baseline Assurance Standard related to the Service Management Standard.

Applicable Contracting Vehicle(s)	ID	Requirement	Level	Applicable to Type 1 and/or Type 2 Catalogue Solutions	Category A	Category B	Category C
GP IT Futures Tech Innovation Community Pharmacy Clinical Services	SM005	The Supplier shall comply with the following Service Management Agent's documents: Incident Management Obligations.docx Change & Release Management Related Obligations.docx	must	Both	Self-certification with Supporting Evidence Supporting evidence to include: Reference that Severity guidelines for Severity 1 and Severity 2 Incidents have been added to the Incident Management Process document. Reference that the Service Bridge will be notified within 20 minutes for both Severity guidelines and updated every hour for Severity 1 and every 1.5 hours for a Severity 2.	Self-certification with Supporting Evidence Supporting evidence to include: Reference that Severity guidelines for Severity 1 and Severity 2 Incidents have been added to the Incident Management Process document. Reference that the Service Bridge will be notified within 20 minutes for both Severity guidelines and updated every hour for Severity 1 and every 1.5 hours for a Severity 2.	Self-certification
DFOCVC	SM005a	The Supplier shall comply with the following Catalogue Authority documents: DFOCVC - Incident Management Related Obligations.docx DFOCVC - Change & Release Management Related Obligations.docx	must	Type 2 only	Self-certification with Supporting Evidence Supporting evidence to include: Reference that Severity guidelines for Severity 1 and Severity 2 Incidents have been added to the Incident Management Process document. Reference that the Service Bridge will be notified within 20 minutes for both Severity guidelines and updated every hour for Severity 1 and every 1.5 hours for a Severity 2.	Self-certification with Supporting Evidence Supporting evidence to include: Reference that Severity guidelines for Severity 1 and Severity 2 Incidents have been added to the Incident Management Process document. Reference that the Service Bridge will be notified within 20 minutes for both Severity guidelines and updated every hour for Severity 1 and every 1.5 hours for a Severity 2.	Self-certification
GP IT Futures Tech Innovation Community Pharmacy Clinical Services	SM006	The Supplier shall measure the performance of each Catalogue Solution against each of the Service Levels applicable to the Catalogue Solution. Catalogue Solution Service Levels.docx	MUST	Both	Full Assessment Supporting evidence to include: Confirmation you have read, reviewed and will comply to any applicable Service Levels for the Solution as set out in the Catalogue Solutions Service Levels document. Availability target SLAs. Demonstration of how performance is monitored via a Live Witness Assessment.	Self-certification with Supporting Evidence Supporting evidence to include: Confirmation you have read, reviewed and will comply to any applicable Service Levels for the Solution as set out in the Catalogue Solutions Service Levels document. Availability target SLAs.	Self-certification
DFOCVC	SM006a	The Supplier shall measure the performance of each Catalogue Solution against each of the Service Levels applicable to such Catalogue Solution as set out in the Catalogue Solution Service Levels document. DFOCVC Catalogue Solution Service Levels.docx	must	Type 2 only	Full Assessment Supporting evidence to include: Confirmation you have read, reviewed and will comply to any applicable Service Levels for the Solution as set out in the DFOCVC Catalogue Solutions Service Levels document. Availability target SLAs. Demonstration of how performance is monitored via a Live Witness Assessment.	Full Assessment Supporting evidence to include: Confirmation you have read, reviewed and will comply to any applicable Service Levels for the Solution as set out in the DFOCVC Catalogue Solutions Service Levels document. Availability target SLAs. Demonstration of how performance is monitored via a Live Witness Assessment.	Self-certification
GP IT Futures Tech Innovation Community Pharmacy Clinical Services	SM007	The Supplier shall operate a process for managing Planned Downtime in accordance with the requirements for the same set out in the relevant Catalogue Solution Service Levels document. Catalogue Solution Service Levels.docx	must	Type 1 only	Self-certification with Supporting Evidence Supporting evidence to include: Documentation on Change Management which describes your approach for managing planned downtime.	Self-certification with Supporting Evidence Supporting evidence to include: Documentation on Change Management which describes your approach for managing planned downtime.	Self-certification
DFOCVC	SM007a	The Supplier shall operate a process for managing Planned Downtime in accordance with the requirements for the same set out in Catalogue Solution Service Levels document. DFOCVC Catalogue Solution Service Levels.docx	must	Type 2 only	Self-certification with Supporting Evidence Supporting evidence to include: Documentation on Change Management which describes your approach for managing planned downtime.	Self-certification with Supporting Evidence Supporting evidence to include: Documentation on Change Management which describes your approach for managing planned downtime.	Self-certification
GP IT Futures Tech Innovation DFOCVC Community Pharmacy Clinical Services	SM013	The Supplier shall ensure that all data used within the Supplier Service Management Toolsets and Supplier Performance Management Toolsets is retained for a minimum of two years or the duration of the Call Off Agreement (whichever is longer) in a manner that can be accessed by the Supplier and provided to the Service Management Agent within 48 hours of any request.	MUST	Both	Self-certification	Self-certification	Self-certification
GP IT Futures Tech Innovation DFOCVC Community Pharmacy Clinical Services	SM014	To the extent the Service Management Agent can not access data as required, the Supplier must make such data available to the Service Management Agent no later than 24 hours after the Service Management Agent has requested such data (this time period excludes weekends and Bank Holidays), or where that the data is required urgently (such as to respond to a Parliamentary question), no more than 4 hours from the request being made by the Service Management Agent to the Supplier. The Service Management Agent shall act reasonably and give due regard to the impact on the Supplier when making such requests.	MUST	Both	Self-certification	Self-certification	Self-certification

Further Requirements

Suppliers must complete assurance for these Requirements in addition to Requirements in the Baseline Assurance Standard in order to achieve full compliance with the Service Management Standard. Suppliers can complete these at the same time as requirements within the Baseline Assurance Standard or following the publication on the Buying Catalogue subject to meeting the timelines laid out by the Authority.

Applicable Contracting Vehicle(s)	ID	Requirement	Level	Applicable to Type 1 and/or Type 2 Catalogue Solutions	Category A	Category B	Category C

Applicable Contracting Vehicle(s)	ID	Requirement	Level	Applicable to Type 1 and/or Type 2 Catalogue Solutions	Category A	Category B	Category C
GP IT Futures Tech Innovation DFOCVC	SM001	The Supplier is fully accountable and responsible for the quality, service management and provision of its Catalogue Solution(s).	MUST	Both	Self-certification	Self-certification	Self-certification
GP IT Futures Tech Innovation DFOCVC	SM002	The Supplier shall act in an open, honest and professional manner at all times, when engaging with all stakeholders including the Service Management Agent.	MUST	Both	Self-certification	Self-certification	Self-certification
GP IT Futures Tech Innovation DFOCVC	SM003	The Supplier shall execute service management in accordance with industry good practice applicable to the technology and business criticality of the Catalogue Solution(s) provided.	MUST	Both	Full Assessment Supporting evidence to include: Incident resolution times for Severity 3, 4 and 5 and any Service Request SLAs in place. ISO20000 accreditation certification. Evidence of alignment to ITIL good practice. Additional supporting evidence could include: Incident Management process. Problem Management process. Change Management process.	Self-certification with Supporting Evidence Supporting evidence to include: Incident resolution times for Severity 3, 4 and 5 and any Service Request SLAs in place. Evidence of alignment to ITIL good practice. Additional supporting evidence could include: Incident Management process. Problem Management process. Change Management process. ISO20000 accreditation certification.	Self-certification with Supporting Evidence Supporting evidence to include: Incident resolution times for Severity 3, 4 and 5 and any Service Request SLAs in place. Evidence of alignment to ITIL good practice. Additional supporting evidence could include: Incident Management process. Problem Management process. Change Management process. ISO20000 accreditation certification.
GP IT Futures Tech Innovation DFOCVC	SM004	The Supplier must deliver an ITIL aligned Service Desk and shall classify all fulfilment requests as either an Incident or a Service Request.	MUST	Both	Full Assessment Supporting evidence to include: Provide all service desk functions, communication channels, core hours, service failure definitions. Documentation which states the Service Desk details/contacts/working hours. Demonstration of an Incident, Problem and Change request within your tool set via a Live Witness Assessment.	Self-certification with Supporting Evidence Supporting evidence to include: Provide all service desk functions, communication channels, core hours, service failure definitions. Documentation which states the Service Desk details/contacts/working hours. Video demonstration/screenshots of an Incident, Problem and Change request within your tool set.	Self-certification with Supporting Evidence Supporting evidence to include: Provide all service desk functions, communication channels, core hours, service failure definitions. Documentation which states the Service Desk details/contacts/working hours. Video demonstration/screenshots of an Incident, Problem and Change request within your tool set.
GP IT Futures Tech Innovation DFOCVC	SM008	The Supplier must operate and publish an effective escalation process for the Service Management Agent, other Suppliers, Service Recipients, Call Off Ordering Parties and other NHS stakeholders to utilise which must be in accordance with the Escalation Management Obligations Document. Escalation Management Obligations.docx	MUST	Both	Self-certification with Supporting Evidence Supporting evidence to include: Documentation detailing your escalation process.	Self-certification	Self-certification
GP IT Futures Tech Innovation	SM009	The Supplier must provide up to 5 (the Service Management Agent shall determine how many within this constraint) of the Service Management Agent's service management staff with remote, read only and real-time access to the Supplier Service Management Toolsets to the extent necessary to monitor the management of the services delivered under the Contracting Vehicle.	MUST	Type 1 only	Full Assessment Supporting evidence to include: Details of which Service Management Toolsets access will be provided and how it encompasses the breadth of the Service Management data required. Additional supporting evidence could include: Complete history of an Incident from logging to resolution and this information will include (but is not limited to): Incident reference, Contact channel, Customer name, Short description, Full description, Status of Incident, Priority, Categorisation, Created date/time, Incident notes, End date/time, Escalation date/time, SLA status, Assignment group, Clinical safety flag. Complete history of a Problem record from logging to resolution and this information will include (but is not limited to): Problem reference, Short description, Full description, Status of Problem, Priority, Categorisation, Created date/time, Problem notes, End date/time, SLA status, Assignment group, Clinical safety flag, Workaround and related or linked cases.	Full Assessment Supporting evidence to include: Details of which Service Management Toolsets access will be provided and how it encompasses the breadth of the Service Management data required. Additional supporting evidence could include: Complete history of an Incident from logging to resolution and this information will include (but is not limited to): Incident reference, Contact channel, Customer name, Short description, Full description, Status of Incident, Priority, Categorisation, Created date/time, Incident notes, End date/time, Escalation date/time, SLA status, Assignment group, Clinical safety flag. Complete history of a Problem record from logging to resolution and this information will include (but is not limited to): Problem reference, Short description, Full description, Status of Problem, Priority, Categorisation, Created date/time, Problem notes, End date/time, SLA status, Assignment group, Clinical safety flag, Workaround and related or linked cases.	Self-Certification
GP IT Futures Tech Innovation	SM010	The Supplier shall provide training to the Service Management Agent's service management staff referred to in requirement SM009 to the extent required for them to be able to utilise the Supplier Service Management Toolsets effectively and to interpret the information accessed accurately.	MUST	Type 1 only	Full Assessment Supporting evidence to include: Details of a training approach.	Full Assessment Supporting evidence to include: Details of a training approach.	Self-certification
GP IT Futures Tech Innovation	SM011	The Supplier must provide up to 5 (the Service Management Agent shall determine how many within this constraint) of the Service Management Agent's service management staff with remote, read only and real-time access to the Supplier Service Performance Toolsets used by the Supplier's staff to monitor the performance of the services delivered under the Contracting Vehicle.	MUST	Type 1 only	Self-certification with Supporting Evidence Supporting evidence to include: Five logins to the Supplier Service Performance Toolsets used to monitor the performance of services delivered under the Contracting Vehicle.	Self-certification with Supporting Evidence Supporting evidence to include: Five logins to the Supplier Service Performance Toolsets used to monitor the performance of services delivered under the Contracting Vehicle.	Self-certification
GP IT Futures Tech Innovation	SM023	The Supplier must provide a monthly capacity report that covers all relevant services and offerings.	must	Type 1 only	Self-certification	Self-certification	Self-certification
GP IT Futures