IDOX SOFTWARE LTD

Conservation Management System international (CMSi) - an Exegesis solution from Idox Geospatial

The software supported approach to Conservation and Biodiversity management of land, property and assets. Used by public and private sector organisations to protect, monitor, and improve land and marine habitats. This includes several government agencies in the UK and overseas such as Natural England, Natural Resources Wales and CapeNature.

Features

• Manage sites for terrestrial and marine ecology, habitats and species
• Integrate information on tenure, assets, agreements, rights, contacts and buildings
• Suitable for statutory designated sites: SAC, SPA, RAMSAR, NNR, SSSI
• Suitable for local sites with no designation, including amenity sites
• Configurable plan structure and reporting, including graphs, maps and photographs
• Casework recording functionality, including monitoring and objective and target setting
• Internal mapping tools or integrates with ArcGIS, MapInfo or QGIS
• Built-in species recording capabilities, with complete biodiversity recording extension
• Data export routines to PDF, Word, Excel, Access and XML
• Offline mobile survey capability and map centric web user interface

Benefits

• Dynamic, continuously updated adaptive management plans with a logical structure
• Evidence-based audit trail of decisions made and management undertaken
• Ensures well-planned, evidence-based, objective and rational site management
• Fully supports conservation objectives and standard status monitoring techniques
• Integrates information from all aspects of site management
• Integrates with your GI data: vector/raster, point/polyline/polygon
• Share projects, plans and best practice with stakeholders and partners
• Upgradeable: new functionality developed by consortium members available to all
• Experienced support staff with technical and conservation knowledge
• Flexible scalable hosting arrangements, including Azure; secure backup and recovery

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

240631154262714

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Relational Database Management Systems
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: None
• System requirements:
  • Remote Desktop Client
  • Internet connectivity
  • Modern browser
  • 1024x768 or greater screen
  • Keyboard recommended
  • Mouse recommended

User support

• Email or online ticketing support: Yes
• Support response times: Response within 1 hour, Monday to Friday during business hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: MATS (Maintenance and Technical Support) is provided for all clients at a single level, and includes direct access to our technical consultants and engineers. Technical Support constitutes assistance in solving any problems encountered by users in operating or configuring the supplied software. Costs depend on number of licences and which modules are licensed.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide training on-site or at our own training suite. We provide comprehensive online documentation. We provide technical support for use and configuration of the application.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Data is supplied as SQL Server database backup plus zipped folders/files, available for download via secure FTP.
• End-of-contract process: Data is supplied as described above. The service is soft-ceased, then removed completely after a suitable period (e.g. 3 months). Additional work to supply different data formats or data transfer mechanism may be charged.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: CMSi Web is the ‘online’ application of the CMSi family that has been designed for use on mobile, tablet and desktop devices. It presents an intuitive, map-centric interface and streamlined workflows for conservation management planning. It achieves this while retaining the power and customisation options of core CMSi. CMSi Survey App is a mobile-friendly surveying application that is fully integrated with CMSi for viewing, editing, and capturing new data and images in the field.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Forms over data with digital assets and interactive mapping. Data and geospatial APIs for systems interoperability.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: None
• API: Yes
• What users can and can't do using the API: The CMSi API enables integrations with other applications. This can include accessing geospatial data from CMSi as OGC WMS/WFS web serices, and it also enables remote web applications, mobile apps and other services to read and write information to the backend CMSi database.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: CMSi can be customised to meet the organisation's own working practices. It has translation functions so can be used in any language requiring no specialist technical skills. All terminology and labels can be changed to match client preferences. CMSi allows an organisation to create different user roles (e.g. ranger, site manager, ecologist, etc) and configure the system so that users only see the parts of the system they need. It includes a ‘My CMSi’ section which can be customised to give different users easy access directly into the parts of the system, activities and reports that they use most. Configuration is undertaken by trained system administrators.

Scaling

• Independence of resources: Generally we host each customer on a separate Virtual Machine environment, which allows us to ring fence appropriate resources and ensure isolation. We also have monitoring systems in place for the loading and response times of the environments, sending out alerts if problems are detected.

Analytics

• Service usage metrics: Yes
• Metrics types: User actions within CMSi are comprehensively logged and the logs are visible to System Administrators (and to a lesser extent to all users), and from these logs it is possible to see levels of usage of the overall system and its modules, plus activity of each user. Uses of the API are also logged. User activity on the hosted server is logged and available on request.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: There are several ways of exporting data. All modules permit advanced filtering of subsets of records and filtered sets can be exported to Microsoft Access and Excel formats where the schema and content of the exports can be extended/configured by the System Administrator. Reports can be exported to HTML, RTF, PDF and Excel formats. System Administrators can also export data directly from database tables to a wide range of formats include XML, CSV, and Microsoft Access/Excel and GIS formats using spatial tools.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XML
  • Shapefile
  • PDF
  • GML
  • GeoJSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • ESRI Shapefile
  • MapInfo TAB
  • ESRI geodatabases
  • Excel
  • DBF
  • GeoPackage

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: The application is accessed over HTTPS. Data is encrypted in transit using TLS 1.3 encryption where possible with a fallback to TLS 1.2 where TLS 1.3 is not supported. Data is encrypted at rest with AES-256GCM. We also enable i.p. restriction and VPN access if required.
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability (other than for scheduled maintenance) is guaranteed to be better than 99.9%.
• Approach to resilience: Power and internet feeds are duplicated provided to us by the datacentre. We run dual firewalls in an Active / Passive setup. We have duplicate HyperV servers so a Virtual Machine could quickly be started on another server in the event of hardware failure of the Hyper V server. Virtual Machine storage is backed up to separated storage. We have Hyper V replica SQL Server. We run high availability S2D cluster. We have 2 core switches in IRF.
• Outage reporting: We provide an independently hosted status page, with notifications/alerts also available as RSS feed. Customers have own status dashboards, and receive emails from our various monitoring systems.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces and support channels are restricted to authenticated users (username and password over https), with IP restrictions and VPN for access, and MFA.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Username and strong password plus MFA. We use restricted IP addresses for all management access.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: All divisions of Idox follow the ISO27001 accredited Information Security Management System of Idox Software Ltd. ; This ISMS covers all business functions including but not limited to, information systems, networks, physical environment, incident/threat management, project & contract management and personnel management. Information security awareness training is conducted to ensure policies are communicated and ongoing annual internal reviews and auditing is conducted to ensure processes are followed. The system and controls are also externally verified an certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the information security manager, the appropriate head of business and a board representative.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: IT change management processes are carried out using Change Requests and records are maintained within the Change Management system. All concerned parties are informed of the status of the request as changes or progress is made as applicable.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network/bandwidth utilisation and unusual server/network/perimeter activity. The alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incidents or suspected incidents are raised to internal service desk and reviewed by the information security manager. They are allocated a risk reference, entered into the information security risk log and tracked until closure. In the case of major incidents, an Incident Response Team will be formed as required with key personal required to investigate and take necessary actions, and a major incident report will be produced.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.