C SOFTWARE LIMITED

NOMAD IMR

The IMR solution provides secure enhanced situational awareness through encrypted push to talk voice channels, chat groups with file share, real time location sharing via mapping, and SOS features. The capability supports multiple operating systems and is suitable for static and mobile operations.

Features

• VoIP Push to talk supporting physical and on screen buttons
• Optional GPS location sharing via internal mapping
• Online or Offline 2D/3D mapping
• Instant Messaging group or private chats with notifications
• File sharing of images, documents and from device cameras
• SOS alerting from physical or remote paired buttons
• Multiple operating system support for both clients and server

Benefits

• Real time situational awareness and status monitoring
• Speak, Share and publish content on the move
• Supports hands free operation
• Supports multiple client devices concurrently connected

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@csoftware.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

691281080601648

Contact

Robert Dorehill
01684210580
info@csoftware.co.uk

About your service

• Service categories:

  Applications

  Collaborative

  • Enterprise community
  • Team collaboration
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: Operating systems: ; The server supports Windows and Linux. ; The client supports Windows and Android.
• System requirements: Support for modern secure encryption protocols

User support

• Email or online ticketing support: Yes
• Support response times: Monday - Friday 0900-1700 via email or telephone, excluding weekends and public holidays.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We offer multiple support tiers, with differing response times and availability. Pricing varies by tier and service scope. All customers have access to technical support to assist with guidance, troubleshooting, and service optimisation.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide Documentation for using the client software. We can provide additional online or onsite training at an additional cost.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: The User can save their media content to their local devices
• End-of-contract process: The dedicated server will be terminated and all data removed.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We are committed to providing accessible documentation. All users can access our help materials effectively

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems:
  • Android
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Desktop version is designed for a Control Room (Ops / HQ) and has addition functionality and works with USB ancillaries for PTT and Tone control.
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: No

Scaling

• Independence of resources: Dedicated server instances are spun up per customer with the required resources to meet the number of users. Should the number of users increase, the instance resources will scale to meet demand.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: There is currently no exportable data, but this on the backlog to provide a feature for the user to export all data
• Data export formats: Other
• Other data export formats: Zip
• Data import formats: Other
• Other data import formats:
  • Spot Files (KML, KMZ, Spots, Dots)
  • Map Files (MB tiles, SQLite
  • Chat Files (Any)

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: At the time of writing for an individual EC2 instance, AWS commits to at least 99.5% availability per month. C Software can also offer multiple server instances as a fail over should redundancy be required.
• Approach to resilience: Region & Availability Zone (AZ) isolation; EC2 runs in multiple, physically separate AZs within a region. AZs have independent power, networking, and cooling, limiting blast radius.; ; Multi-AZ architectures; You can deploy instances across two or more AZs behind load balancers to tolerate AZ-level failures.; ; Elastic Load Balancing (ELB); Automatically distributes traffic and removes unhealthy instances, enabling seamless failover.; ; Auto Scaling; Detects instance failures and automatically replaces unhealthy instances; also scales capacity based on demand.; ; Stateless compute model; EC2 is designed to be replaceable, not repaired. Persistent state is externalised (EBS, S3, RDS), enabling fast recovery.; ; Durable storage separation; Compute and storage are decoupled. EBS volumes are replicated within an AZ; backups via snapshots to S3.; ; Network redundancy; Highly redundant regional networking with multiple paths and devices, reducing single points of failure.; ; Monitoring & health checks; CloudWatch and EC2 status checks detect hardware, network, and instance-level issues to trigger remediation.
• Outage reporting: Outages are communicated via email. Additional communication methods that better suite the customer can also be arranged.

Identity and authentication

• User authentication needed: Yes
• User authentication: Other
• Other user authentication: Users access the service using client software with encryption keys (info files) in combination with user-provided credentials. This ensures that only authorised users can decrypt and access data, enforcing end-to-end encryption and strict access control, while preventing unauthorised access even if transmission is compromised.
• Access restrictions in management interfaces and support channels: Access can be restricted by configuring Security Groups to allow only specific IP addresses or address ranges to reach management interfaces. Support channels can be limited similarly, permitting connections only from trusted networks or VPNs. Combined with least-privilege IAM roles and multi-factor authentication, this ensures that only authorised personnel can access sensitive management or support functions.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: CSA CSM version 4.0
• Information security policies and processes: Key policies include Security Operating Procedures, Access Control, Data Classification, Incident Response, and Acceptable Use. Processes cover user onboarding/offboarding with periodic access reviews, vulnerability management, and security awareness training.; ; The reporting structure flows from operational staff to the CISO or board equivalent governance committee, ensuring oversight and accountability. Policy enforcement is achieved through automated controls (e.g., access restrictions, audit logs), regular compliance audits, and monitoring of security incidents. Exceptions are documented and approved through formal channels.; ; To ensure adherence, staff are trained on policy requirements, and compliance is reinforced with routine reviews, internal audits, and reporting metrics. Non-compliance triggers corrective action plans, and continuous improvement is integrated via lessons learned from incidents or audit findings. This approach maintains both operational security and regulatory compliance.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Per CSA CCM v4.0 and SSAE-18 / ISAE 3402, configuration and change management require formally assessing security impact before changes via risk analysis and approvals. Changes are documented, tested, and authorised, with configurations baselined and version-controlled. All changes are logged, monitored, and reviewed, providing traceability, audit evidence, and continuous assurance of security effectiveness throughout the service lifecycle.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Potential threats are assessed through continuous vulnerability scanning, configuration reviews, and risk-based analysis of service assets. Patch deployment timelines are driven by severity, with critical fixes prioritized and deployed rapidly following testing and approval. Threat intelligence is sourced from vendor advisories, CVE databases, industry alerts, and internal monitoring, ensuring timely identification, remediation, and audit traceability.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring uses centralised logging, alerting, and continuous analysis to identify potential compromises through anomalies, security events, and policy violations. Suspected compromises trigger incident response procedures, including containment, investigation, and remediation. Incidents are prioritised by severity, with rapid response for high-risk events, documented actions, and post-incident reviews to ensure timely recovery and audit evidence.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We maintain predefined procedures for common security events, including detection, escalation, and remediation. Users report incidents via a dedicated email, or telephone. All incidents are logged, investigated, and tracked, with findings, actions, and lessons learned documented. Formal incident reports are produced for management and stakeholders, detailing impact, resolution, timelines, and preventive measures, ensuring auditability and continuous improvement.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Time limited (1 month) trial of the IMR Service can be provided with a connection file to load into the client (downloadable for App Store). There is also a fully functional demo server reset every 24 hours.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Wednesday 12 March 2025
• What the ISO 9001 doesn’t cover: Nothing
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ab8f3aca-7706-4928-b103-32a292439dbf
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 1fce04f8-8228-4ae4-8a95-5b837686ad02
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@csoftware.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.