ccs-digitalmarketplace-frameworks 1.7.0 → 1.8.0

package/CHANGELOG.md

@@ -2,106 +2,6 @@
 
 Records breaking changes from major version bumps
 
-## 18.0.0
+## 1.8.0
 
-The search mappings G-Cloud 12 and DOS4/5 and the search scheme generator will now
-work with Elasticsearch 7, but will no longer work with Elasticsearch 6.
-
-## 17.0.0
-
-Removes the customer benefits record email from G-Cloud 11 manifest, as this is no longer used by CCS. This was only
-used in the G-Cloud Direct Award flow in the Buyer Frontend.
-
-## 16.0.0
-
-Removes the Documents section from the `display_service` G-Cloud 10 and G-Cloud 11 manifests. This will be replaced
-by a separate document template in the Buyer FE, allowing a combination of service documents and declaration documents.
-
-## 15.0.0
-
-Removed the `include_in_all` parameter from the `serviceIdHash` field in the
-search mappings, as `_all` has been deprecated in Elasticsearch 5.6 and will be
-removed in Elasticsearch 6. Consumers of the Elasticsearch search mappings will
-now need to ensure that searches do not include the `serviceIdHash` field to
-remain compliant.
-
-## 14.0.0
-
-Updated the `generate-validation-schemas` and `generate-assessment-schemas` scripts. These scripts now reflect the fact
-that we use JSON Draft 07 standard. The backwards incompatible change is that `exclusiveMaximum` is now an integer.
-Where we used both `exclusiveMaximum` and `maximum`, I've removed `maximum` in favour of solely using `exclusiveMaximum`
-to reduce the repetition. `maximum` by itself now signifies an inclusive maximum.
- 
-## 13.0.0
-
-Removed buyers guide links from the frameworks, as they are no longer framework-specific. The guide is tied
-to the direct award process as implemented for any G-Cloud-like framework on the Digital Marketplace.
-
-## 12.0.0
-
-All the `messages/dates.yml` files for frameworks have been removed. These dates are now stored directly on the
-`framework` record in the API as datetimestamps. Any frontends that load `dates.yml` files will need to instead
-look for dates in the framework record(s).
-
-## 11.0.0
-
-Removed the transformation of the status field entirely. The DOS search filters
-now use the `statusOpenClosed` field for filtering.
-
-Add the `statusOpenClosed` field to DOS3 mappings as well.
-
-## 10.0.0
-
-The `search_filters.yml` manifest has been renamed to `<doc type>_search_filters.yml`. Code which referenced a
-`search_filters.yml` prevously should probably now reference `services_search_filters.yml`.
-
-Also changes the mapping json `_meta` key `dmSortClause` to `dm_sort_clause` which it was supposed to be all along except
-the wrong version got merged (oops).
-
-## 9.0.0
-
-Upgraded the services mapping for G-Cloud 9 (and implicitly future iterations) to be compatible with Elasticsearch 5.x.
-This new mapping is incompatible with Elasticsearch 1.x, so any search-api instances using this version of the
-frameworks repository need to be deployed with an ES5 backend.
-
-## 8.0.0 (equivalent to 7.1.0)
-
-Applies a 'datetodatetimeformat' filter to some of the content in DOS2, which requires updated content-loader and dmutils.
-
-To pull this into the frontend apps, manually update requirements for dmutils >= 25.1.0, content-loader >= 4.2.0
-
-## 7.0.0
-
-PR: [#413](https://github.com/alphagov/digitalmarketplace-frameworks/pull/413)
-
-###
-
-New `date` field type. Creation and implementation.
-
-## 6.0.0
-
-PR: [#381](https://github.com/alphagov/digitalmarketplace-frameworks/pull/381)
-
-### What changed
-
-New `followup` key structure requires digitalmarketplace-content-loader@3.0.0
-
-## 5.0.0
-
-PR: [#330](https://github.com/alphagov/digitalmarketplace-frameworks/pull/330)
-
-### What changed
-
-We rename the `edit_brief_response` manifest to`legacy_edit_brief_response`.
-
-### Example app change
-
-Old
-```
-content_loader.get_manifest('digital-outcomes-and-specialists', 'edit_brief_response')
-```
-
-New
-```
-content_loader.get_manifest('digital-outcomes-and-specialists', 'legacy_edit_brief_response')
-```
+Add the G-Cloud 14 framework

package/frameworks/g-cloud-14/assessment/declaration/extra.schema.json

@@ -0,0 +1,14 @@
+{
+    "definitions": {
+        "baseline": {
+            "allOf": [
+                {
+                    "anyOf": [
+                        {"properties": {"servicesHaveOrSupportCloudHostingCloudSoftware": {"enum": ["Yes"]}}},
+                        {"properties": {"servicesHaveOrSupportCloudSupport": {"enum": ["Yes"]}}}
+                    ]
+                }
+            ]
+        }
+    }
+}

package/frameworks/g-cloud-14/manifests/declaration.yml

@@ -0,0 +1,200 @@
+-
+  name: Providing suitable services
+  slug: providing-suitable-services
+  editable: True
+  prefill: False
+  description: |
+    You must answer these questions to confirm that your services are suitable for G-Cloud 14.
+
+    Except for questions [[servicesHaveOrSupportCloudHostingCloudSoftware]] and [[servicesHaveOrSupportCloudSupport]],
+    if you can’t answer ‘yes’ to every question in this section,
+    it’s very unlikely that your application will be accepted.
+
+    You must answer ‘yes’ to at least one of questions
+    [[servicesHaveOrSupportCloudHostingCloudSoftware]] or [[servicesHaveOrSupportCloudSupport]], or answer ‘yes’ to both.
+    
+    You must be able to truthfully answer every question for your application to be considered eligible.
+    The Crown Commercial Service may ask for proof after you’ve submitted your application.
+
+  questions:
+    - servicesHaveOrSupportCloudHostingCloudSoftware
+    - servicesHaveOrSupportCloudSupport
+    - servicesDoNotInclude
+    - offerServicesYourselves
+    - fullAccountability
+
+-
+  name: What it means to be on G-Cloud 14
+  slug: what-it-means-to-be-on-g-cloud-14
+  editable: True
+  prefill: False
+  description: |
+    If you make an application to G-Cloud 14, you’re agreeing to the terms and conditions in the legal documentation.
+
+    You must be able to truthfully answer ‘yes’ to every question on this page for your application to be considered eligible.
+
+    If you can’t answer ‘yes’ to every question on this page, it’s very unlikely that your application will be accepted.
+
+  questions:
+    - termsOfParticipation
+    - termsAndConditions
+    - canProvideFromDayOne
+    - unfairCompetition    
+    - 10WorkingDays
+    - MI
+    
+-
+  name: Grounds for mandatory exclusion
+  slug: grounds-for-mandatory-exclusion
+  editable: True
+  prefill: True
+  description: |
+    You must be able to truthfully answer ‘no’ to every question in the ‘Grounds for mandatory exclusion’ section.
+
+    It’s very unlikely that your application will be accepted if you answer ‘yes’ to any question.
+
+    In questions [[conspiracy]] to [[organisedCrime]], you must answer for anyone who ‘represents, supervises
+    or has control in your organisation or a partner or parent organisation’. This includes:
+    <ul class="list-bullet">
+    <li>members of your group of economic operators and their proposed subcontractors</li>
+    <li>any directors or partners</li>
+    <li>anyone who has powers of representation, decision or control</li>
+    </ul>
+
+    Check that your organisation complies with <a href="https://www.legislation.gov.uk/uksi/2015/102/regulation/57" target="_blank">Regulation 57(1) of the Public Contracts
+    Regulations 2015</a>.
+  questions:
+    - conspiracy
+    - corruptionBribery
+    - terrorism
+    - organisedCrime
+
+-
+  name: Grounds for discretionary exclusion
+  slug: grounds-for-discretionary-exclusion
+  editable: True
+  prefill: True
+  description: |
+    You must be able to truthfully answer ‘no’ to every question under ‘Grounds for discretionary exclusion’
+    for your bid to be considered eligible. If you can’t answer ‘no’, your bid may not be accepted.
+
+    If you do answer ‘yes’, you must provide full details of any subsequent event or remedial action that
+    you think the Crown Commercial Service (CCS) should take into consideration. CCS will use the information
+    you provide to consider whether or not you will be able to proceed any further with this procurement.
+
+    In questions [[taxEvasion]] to [[misleadingInformation]], ‘a partner organisation’ includes members
+    of your group of economic operators or their proposed subcontractors.
+
+    CCS can also exclude you if you are guilty of serious
+    misrepresentation in providing any information referred to within
+    regulations
+
+      - <a href="https://www.legislation.gov.uk/uksi/2015/102/regulation/23" target="_blank" rel="noopener noreferrer">section 23 (opens in new tab)</a>
+      - <a href="https://www.legislation.gov.uk/uksi/2015/102/regulation/24" target="_blank" rel="noopener noreferrer">section 24 (opens in new tab)</a>
+      - <a href="https://www.legislation.gov.uk/uksi/2015/102/regulation/25" target="_blank" rel="noopener noreferrer">section 25 (opens in new tab)</a>
+      - <a href="https://www.legislation.gov.uk/uksi/2015/102/regulation/26" target="_blank" rel="noopener noreferrer">section 26 (opens in new tab)</a>
+      - <a href="https://www.legislation.gov.uk/uksi/2015/102/regulation/27" target="_blank" rel="noopener noreferrer">section 27 (opens in new tab)</a>
+    
+    of the <a href="https://www.legislation.gov.uk/uksi/2015/102/contents" target="_blank" rel="noopener noreferrer">Public Contracts Regulations 2015 (new tab)</a>
+    or if you fail to provide any such information it requests.
+  questions:
+    - taxEvasion
+    - environmentalSocialLabourLaw
+    - bankrupt
+    - graveProfessionalMisconduct
+    - distortingCompetition
+    - conflictOfInterest
+    - distortedCompetition
+    - significantOrPersistentDeficiencies
+    - seriousMisrepresentation
+    - witheldSupportingDocuments
+    - influencedContractingAuthority
+    - confidentialInformation
+    - misleadingInformation
+    - mitigatingFactors
+    - multiqunspentTaxConvictions
+    - multiqGAAR
+
+-
+  name: Working with government
+  slug: working-with-government
+  editable: True
+  prefill: True
+  description: |
+    You must be able to truthfully answer ‘yes’ to every question under ‘Working with government’ for your bid to be
+    considered eligible.
+
+    If you cannot truthfully answer ‘yes’ or ‘not applicable’ to every question under ‘Working with government’ your application is unlikely to be accepted.
+  questions:
+    - socialValueModel
+    - employersInsurance
+    - helpBuyersComplyTechnologyCodesOfPractice
+    - publishContracts
+    - supplierCodeOfConduct
+    - protectPersonalData
+
+
+-
+  name: How you apply
+  slug: how-you-apply
+  editable: True
+  prefill: False
+  description: |
+    You must be able to truthfully answer ‘yes’ to every question on this page for your application to be considered eligible.
+
+    If you can’t answer ‘yes’ to every question on this page, it’s very unlikely that your application will be accepted.
+
+  questions:
+    - readUnderstoodGuidance
+    - understandTool
+    - understandHowToAskQuestions
+
+-
+  name: Application accuracy
+  slug: application-accuracy
+  editable: True
+  prefill: False
+  description: |
+    You must confirm the accuracy of the information in this declaration and in your service descriptions. We might
+    ask for proof after you’ve submitted your application.
+
+  questions:
+    - accurateInformation
+    - informationChanges
+    - accuratelyDescribed
+    - proofOfClaims
+    - dunsNumberCompanyRegistrationNumber
+
+-
+  name: How you’ll deliver your services
+  slug: how-youll-deliver-your-services
+  editable: True
+  prefill: False
+  description: |
+    The Crown Commercial Service will use this information to manage your participation in G-Cloud&nbsp;14.
+  questions:
+    - multiqSubcontracting
+    - staffDeliveringServices
+
+
+-
+  name: Modern slavery
+  slug: modern-slavery
+  editable: True
+  prefill: False
+  questions:
+    - multiqModernSlavery
+
+-
+  name: Contact details
+  slug: contact-details
+  editable: True
+  prefill: True
+  description: |
+     The Crown Commercial Service will use the primary contact information to contact your organisation if it has any questions about your application.
+  questions:
+    - contact
+    - contactsRole
+    - primaryContactEmail
+    - contactEmailContractNotice
+    - multiqWebAddress

package/frameworks/g-cloud-14/manifests/display_service.yml

@@ -0,0 +1,286 @@
+- name: Planning
+  questions:
+    - planningService
+    - planningServiceDescription
+    - planningServiceCompatibility
+    - planningServiceCompatibilityList
+
+- name: Training
+  questions:
+    - training
+    - trainingDescription
+    - trainingServiceSpecific
+    - trainingServiceSpecificList
+
+- name: Setup and migration
+  questions:
+    - setupAndMigrationService
+    - setupAndMigrationServiceDescription
+    - setupAndMigrationServiceSpecific
+    - setupAndMigrationServiceSpecificList
+
+- name: Quality assurance and performance testing
+  questions:
+    - QAAndTesting
+    - QAAndTestingDescription
+
+- name: Security testing
+  questions:
+    - securityTesting
+    - securityTestingWhat
+    - securityTestingWhatOther
+    - securityTestingAccredited
+    - securityTestingAccreditations
+    - securityTestingAccreditationsOther
+    - securityTestingCCP
+
+- name: Ongoing support
+  questions:
+    - ongoingSupport
+    - ongoingSupportServices
+    - ongoingSupportDescription
+
+- name: Service scope
+  questions:
+    - serviceAddOnType
+    - serviceAddOnDetails
+    - cloudDeploymentModel
+    - serviceConstraintsHostingAndSoftware
+    - serviceConstraintsSupport
+    - systemRequirements
+
+- name: User support
+  questions:
+    - emailOrTicketingSupport
+    - emailOrTicketingSupportResponseTimes
+    - emailOrTicketingSupportPriority
+    - emailOrTicketingSupportAccessibility
+    - phoneSupport
+    - phoneSupportAvailability
+    - webChatSupport
+    - webChatSupportAvailability
+    - webChatSupportAccessibility
+    - webChatSupportAccessibilityDescription
+    - webChatSupportAccessibilityTesting
+    - onsiteSupport
+    - supportLevels
+    - supportAvailableToThirdParty
+
+- name: Onboarding and offboarding
+  questions:
+    - gettingStarted
+    - documentation
+    - documentationFormats
+    - documentationFormatsOther
+    - endOfContractDataExtraction
+    - endOfContractProcess
+
+- name: Using the service
+  questions:
+    - browsersAccess
+    - browsersSupported
+    - installation
+    - installationCompatibleOperatingSystems
+    - mobile
+    - mobileDifferences
+    - webInterface
+    - webInterfaceUsage
+    - webInterfaceAccessibility
+    - webInterfaceAccessibilityDescription
+    - webInterfaceAccessibilityTesting
+    - serviceInterface
+    - userSupportAccessibility
+    - serviceInterfaceDescription
+    - serviceInterfaceAccessibility
+    - serviceInterfaceAccessibility2
+    - serviceInterfaceAccessibilityDescription
+    - serviceInterfaceTesting
+    - APIHosting
+    - APISoftware
+    - APIUsage
+    - APIAutomationTools
+    - APIAutomationToolsOther
+    - APIDocumentation
+    - APIDocumentationFormats
+    - APISandbox
+    - commandLineInterface
+    - commandLineOS
+    - commandLineUsage
+    - customisationAvailable
+    - customisationDescription
+
+- name: Scaling
+  questions:
+    - scaling
+    - scalingType
+    - independenceOfResources
+    - usageNotifications
+    - usageNotificationsHow
+
+- name: Analytics
+  questions:
+    - metricsHosting
+    - metricsSoftware
+    - metricsSoftwareDescription
+    - metricsHostingWhat
+    - metricsHostingWhatOther
+    - metricsHostingHow
+    - metricsSoftwareHow
+
+- name: Resellers
+  questions:
+    - resellingType
+    - resellingOrganisations
+
+- name: Staff security
+  questions:
+    - staffSecurityClearanceChecks
+    - governmentSecurityClearances
+
+- name: Asset protection
+  questions:
+    - dataStorageAndProcessing
+    - dataStorageAndProcessingLocations
+    - dataStorageAndProcessingUserControl
+    - datacentreSecurityStandards
+    - penetrationTesting
+    - penetrationTestingApproach
+    - protectionOfDataAtRest
+    - protectionOfDataAtRestOther
+    - dataSanitisation
+    - dataSanitisationTypeHosting
+    - dataSanitisationTypeSoftware
+    - equipmentDisposalApproach
+
+- name: Backup and recovery
+  questions:
+    - backup
+    - backupWhatData
+    - backupControls
+    - backupDatacentre
+    - backupScheduling
+    - backupRecovery
+
+- name: Data importing and exporting
+  questions:
+    - dataExportHow
+    - dataExportFormats
+    - dataExportFormatsOther
+    - dataImportFormats
+    - dataImportFormatsOther
+
+- name: Data-in-transit protection
+  questions:
+    - dataProtectionBetweenNetworks
+    - dataProtectionBetweenNetworksOther
+    - dataProtectionWithinNetwork
+    - dataProtectionWithinNetworkOther
+
+- name: Availability and resilience
+  questions:
+    - guaranteedAvailability
+    - approachToResilience
+    - outageReporting
+
+- name: Identity and authentication
+  questions:
+    - userAuthenticationNeeded
+    - userAuthenticationHosting
+    - userAuthenticationSoftware
+    - userAuthenticationDescription
+    - accessRestrictionManagementAndSupport
+    - accessRestrictionTesting
+    - managementAccessAuthentication
+    - managementAccessAuthenticationDescription
+    - devicesUsersManageTheServiceThrough
+
+- name: Audit information for users
+  questions:
+    - auditBuyersActions
+    - auditBuyersActionsStorage
+    - auditSuppliersActions
+    - auditSuppliersActionsStorage
+    - howLongSystemLogsStored
+
+- name: Standards and certifications
+  questions:
+    - standardsISOIEC27001
+    - standardsISOIEC27001Who
+    - standardsISOIEC27001When
+    - standardsISOIEC27001Exclusions
+    - standardsISO28000
+    - standardsISO28000Who
+    - standardsISO28000When
+    - standardsISO28000Exclusions
+    - standardsCSASTAR
+    - standardsCSASTARWhen
+    - standardsCSASTARLevel
+    - standardsCSASTARExclusions
+    - standardsPCI
+    - standardsPCIWho
+    - standardsPCIWhen
+    - standardsPCIExclusions
+    - standardsCyberEssentials
+    - standardsCyberEssentialsPlus
+    - accreditationsOther
+    - accreditationsOtherList
+
+- name: Security governance
+  questions:
+    - boardLevelServiceSecurity
+    - securityGovernanceAccreditation
+    - securityGovernanceStandards
+    - securityGovernanceStandardsOther
+    - securityGovernanceApproach
+    - informationSecurityPoliciesAndProcesses
+
+- name: Operational security
+  questions:
+    - configurationAndChangeManagementType
+    - configurationAndChangeManagementProcesses
+    - vulnerabilityManagementType
+    - vulnerabilityManagementApproach
+    - protectiveMonitoringType
+    - protectiveMonitoringApproach
+    - incidentManagementType
+    - incidentManagementApproach
+
+- name: Secure development
+  questions:
+    - secureDevelopment
+
+- name: Public sector networks
+  questions:
+    - publicSectorNetworks
+    - publicSectorNetworksTypes
+    - publicSectorNetworksOther
+
+- name: Separation between users
+  questions:
+    - virtualisation
+    - virtualisationImplementedBy
+    - virtualisationTechnologiesUsed
+    - virtualisationTechnologiesUsedOther
+    - virtualisationThirdPartyProvider
+    - virtualisationSeparation
+
+- name: Energy efficiency
+  questions:
+    - energyEfficientDatacentres
+    - energyEfficientDatacentresDescription
+
+- name: Social Value
+  questions:
+    - multiqfightingClimateChange
+    - multiqcovid19Recovery
+    - multiqtacklingEconomicInequality
+    - multiqequalOpportunity
+    - multiqwellbeing
+
+- name: Pricing
+  questions:
+    - price
+    - educationPricing
+    - freeVersionTrialOption
+    - freeVersionDescription
+    - freeVersionLink

package/frameworks/g-cloud-14/manifests/download_results.yml

@@ -0,0 +1,5 @@
+- name: Service data for results download
+  questions:
+    - serviceName
+    - serviceDescription
+    - price

package/frameworks/g-cloud-14/manifests/edit_service.yml

@@ -0,0 +1,30 @@
+-
+  name: Service attributes
+  editable: False
+  questions:
+    - id
+    - lotName
+
+-
+  name: Service name
+  editable: True
+  questions:
+    - serviceName
+
+-
+  name: About your service
+  editable: True
+  questions:
+    - serviceDescription
+
+-
+  name: Service features and benefits
+  editable: True
+  questions:
+    - multiqServiceFeaturesAndBenefitsHostingAndSoftware
+    - multiqServiceFeaturesAndBenefitsSupport
+
+- name: Documents
+  editable: True
+  questions:
+    - serviceDefinitionDocumentURL