IDOX SOFTWARE LTD

IDC Building Control

Created in collaboration with UK local authorities and key industry stakeholders, enabling the end-to-end management of the entire Building Control process including: Application Management, Planning Portal integration, Site Inspections, Enforcement Management, Complaints Management, Contraventions Reporting, Statutory Reporting, Plan checking/assessment, Invoicing, Time-recording, Enquiries Management, Building Control History, etc.

Features

• Mobile Working
• Shared Services
• Cloud based
• Remote access
• Managed Service
• SaaS delivery model
• Real-time reporting
• Online services
• Agile development methodology
• Digital transformation

Benefits

• Digitally transform service provision
• Enable easy access to online citizen services
• Work on the move via any mobile device
• Achieve economies of scale across a Shared Service
• Managed Service with no support boundaries
• No requirement for 3rd party solutions
• No requirement for mobile working extensions
• ISO 27001 and Cyber Essentials Plus accredited for complete security
• Constantly evolving solutions through Agile methodologies
• Predictable ICT costs with no hidden extras

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

133504602769222

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Relational Database Management Systems
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No constraints
• System requirements: Access to a modern web-browser

User support

• Email or online ticketing support: Yes
• Support response times: Our standard Service Desk is operational Monday to Friday during business hours (8.30 am - 5.30pm) although requests for support can be logged 24/7. Questions or requests for support are prioritised in accordance with their severity and urgency. Our SLA for support is available during the clarifications stage of G-Cloud procurement.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: None or don’t know
• Onsite support: Yes, at extra cost
• Support levels: According to our published SLA for support, available on request / during the G-Cloud clarifications stage.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: The standard implementation package typically includes the following service days (onsite or remote):; ; -Project Management; ; -Configuration Consultancy; ; -Training and associated Documentation; ; -Data Migration; ; -Development.; ; Training will be delivered by one of our experienced trainers. Users will be given instructor-led sessions followed up by specific training exercises, split by User Roles. We use the “Train the Trainer” approach – training key system "Super-Users" to deliver cascade training to their teams. Alternative training delivery options will be considered.; ; Training documentation provided will be as follows: ; ; -Product user manuals; ; - Training exercises and questionnaires; ; - Customised training documentation acting as a workbook for trainees; ; - An online help area which includes FAQs, videos, user manuals, release notes.; ; The solution also has a full online product knowledgebase that can be viewed by any authorised user within the system at any time, including out of hours, through the embedded help widget, it is fully searchable.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: If a customer chooses to move to an alternative supplier and requires an extract of the data, we can provide this information in a standard format for a cost of £5,000. If the data is required in a different format or there is a bespoke requirement with regards to the data extract then effort to meet such requirements will need to be estimated and the work costed accordingly.
• End-of-contract process: If a customer chooses to move to an alternative supplier and requires an extract of the data, we can provide this information in a standard format for a cost of £5,000. If the data is required in a different format or there is a bespoke requirement with regards to the data extract then effort to meet such requirements will need to be estimated and the work costed accordingly.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation is provided, however it has not been produced to any specific or formal accessibility standard.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The software is mobile by default and built using responsive technology. This enables users to enjoy the same experience regardless of the device in use. We also provide role based mobile apps if required for inspections.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Web browser
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Testing is carried out using the Web Accessibility Evaluation Tool (WAVE) which is developed and administered by WebAIM (Web Accessibility In Mind) at the Institute for Disability Research, Policy & Practice. This automated tool is also used by the Cabinet Office's Government Digital Services teams as part of their "GDS Way" in terms of building accessible services.
• API: Yes
• What users can and can't do using the API: Our solutions are provided with a full suite of RESTful Application Programming Interfaces (APIs) as part of the support and maintenance subscription agreement, enabling straight-forward integration with third party systems. We usually carry out these integrations (chargeable) in such a manner that the integration is minimally noticeable to the system user at a technical level, with the integration adopting consistent system workflows and UX features where applicable. We have 15+ years of experience in integrating with Local Government infrastructure through the utilisation of the API described.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The solution is highly configurable – it allows changes to business processes without the need for supplier input – System Administrators or users with the correct permissions can configure many elements of the solution via the Administration module including: Document templates and standard phrases; Communication codes; Enforcement types, applications types, inspection types; GDPR rules; Fees; Workflows and caseload management dashboards; Reports – statutory, user-defined, performance management, data imports and exports; Users accounts and permissions; Online portal services and public registers.

Scaling

• Independence of resources: We are committed to ensuring that our quality of service does not decrease as our customer base expands. To this end, we ensure we have adequate resources in place to deliver on the contracts that we secure. Infrastructure is designed with scaling in mind so we are able to easily scale up with additional hardware for example as required.

Analytics

• Service usage metrics: Yes
• Metrics types: Service metrics available will be as agreed in the contract documents/service level agreements, Details available on demand.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: Data is encrypted at rest with AES-256GCM.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Details available on demand.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: Other
• Other protection between networks: Enforce Https protocol &; Deploy Firewalls to monitor and control incoming and outgoing network traffic
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The software application is accessible on a 24/7 basis, and guaranteed availability is calculated within the service hours 08.00 to 18.00 Monday to Friday, excluding UK Public Holidays.; ; The service will be available for a minimum of 99% of the annual period. The percentage of online availability will be calculated on a monthly basis and will be a reflection of the availability of the services over the total number of hours for the month. The services will be available outside of the service hours (but not guaranteed under the standard Service Level Agreement).
• Approach to resilience: Idox solutions are designed to be scalable and are deployed in over 350 local authority departments throughout the UK. The Idox Cloud solution is provided via AWS technologies that are quickly scalable and adaptable to changing needs. File storage is based on S3 elastic storage for growth on demand, databases auto scale using Amazon RDS functionality, and web tier is containerised and scales as demand increases/decreases. The solution also makes use of AWS Multi-AZ (availability zones) providing resilience in the event of hardware failures or DR at the primary datacentres.; ; The environment and software are monitored, and any anomalies are notified to the support team.; ; As a true Cloud solution, we do not release new versions of the software but rather development is performed and released on an iterative basis as and when improvements become available. We use an Agile/continuous improvement and deployment method, which allows us to be more flexible to market and legislative changes without impacting our customers with traditional "major" updates having to be implemented.
• Outage reporting: All communication in the event of an availability incident will be to a customer's nominated contacts via our Service Desk, updates will be communicated via the customer portal, email or phone depending on the priority level of the incident.; ; In the event of a major solution outage, the worst case scenario is less than 24 hours of data loss. By increasing the backup frequency this can be reduced. We would be delighted to discuss backup frequency with a customer as part of contract negotiations

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: All customer users are authenticated via username and password, and two factor authentication if required. SAML or OAuth integration to Azure Active Directory is also supported although this is not mandatory to access the system.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We recognise that information security important in the development and implementation of all systems delivered to our customers, to Idox as a corporate entity, and to our supply chain.; ; To ensure a consistent and effective approach, we operate an externally audited and certified, organisation wide Information Security Management System (ISMS) which implements and enforces controls on all business functions covering but not limited to information systems, networks, physical environment, incident/threat management, project and contract management and personnel management. ; ; Our systems and controls are also externally verified and certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the Information Security Manager, the appropriate Head of Business and a board representative.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes to the service are carried out using change requests and are maintained within the change management system. The change management process incorporates a business case / justification for the change, a backout plan, and a final approval with scheduling for the change to be implemented. They will be assessed for security or service impacts during this process, before deployment to a separate QA environment where they are checked for verification before release to production.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: All changes to the service are carried out using change requests and are maintained within the change management system. The change management process incorporates a business case / justification for the change, a backout plan, and a final approval with scheduling for the change to be implemented. They will be assessed for security or service impacts during this process, before deployment to a separate QA environment where they are checked for verification before release to production.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network / bandwidth utilisation and unusual server / network / perimeter activity. Alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Our incident management process is central to our ISO 27001 Information Security Management System. In line with our Incident Management Policy and Process, incidents are raised to the Service Desk or detected by monitoring such as SIEM, triaged and escalated as required. Tickets are allocated a reference number and tracked to conclusion. Results are monitored, documented and preventative action taken to prevent re-occurrence. The incident team maintain contact with internal/external stakeholders within predefined timeframes. For GDPR-related incidents this is 24 hours from confirmation.; ; Security incidents raised to the internal incident register are subject to regular reviews by the senior team.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.