FM:SYSTEMS EUROPE LIMITED

FM:Systems OccupEye – Digital Workplace: Space & Visitor Management, Utilisation, Booking and CAD

The OpenBlue suite provides a platform for workplace and facilities management, combining IWMS capabilities with AI-driven analytics, utilisation insight and energy optimisation. The solution supports hybrid working, optimises space performance, reduces operational costs, enhances employee and visitor experience through intuitive workflows, and advances sustainability objectives across IT and facilities teams.

Features

• Integrated IWMS for estate, space, asset, maintenance and estate management
• Evidence-based utilisation analytics using booking data and occupancy sensor inputs
• Portfolio reporting dashboards supporting business cases, and value for money
• Hybrid working enabled through secure desk, room and resource booking
• Employee and visitor management supporting secure access to government buildings
• Energy and sustainability monitoring supporting net zero targets and reporting
• Asset and equipment performance monitoring with predictive maintenance workflows enabled
• Vendor agnostic integrations across BMS, sensors and third party systems
• Cyber secure cloud hosting meeting UK government security principles requirements
• Role based access controls supporting governance, audit and data protection

Benefits

• Improves space planning decisions using accurate, real time utilisation insights
• Reduces operational costs by identifying underused space and assets quickly
• Simplifies hybrid working through intuitive booking and scheduling workflows tools
• Increases productivity by reducing time spent searching for workspaces available
• Supports sustainability reporting with reliable energy, occupancy and performance data
• Enhances user experience for employees and visitors across government buildings
• Improves governance through role based access, audit trails and controls
• Enables faster decision making with dashboards and portfolio level insights
• Reduces manual effort by automating facilities, maintenance and reporting processes
• Provides resilience and flexibility through scalable, secure multi cloud deployment

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at phil.yates@jci.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

260951902794775

Contact

Phil Yates
07588449421
phil.yates@jci.com

About the service

• Service categories:
  • Application Development and Deployment
    • Analytics and business intelligence
      • Business Intelligence
        • Business Intelligence
      • Advanced and predictive analytics
        • Advanced and predictive analytics
      • Location and geospatial data management and analytics
        • Location and geospatial data management and analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: The service can operate as both a standalone solution and an add-on or extension to existing software platforms. It integrates with existing IWMS, BMS, HR, access control, booking, sensor and energy management systems via open APIs, enabling organisations to extend current capabilities without replacing incumbent systems.
• Cloud deployment model: Hybrid cloud
• Service constraints: Yes, there are some constraints buyers should be aware of.; The service is delivered on standard, supported cloud infrastructure and requires compatible web browsers and network connectivity. Planned maintenance windows may be required for platform upgrades and security patching, with advance notice provided. Where optional integrations (for example sensors, BMS or access control systems) are required, these are dependent on the compatibility and availability of third-party hardware, software and APIs. Support for legacy or non-standard configurations may require additional assessment or professional services.
• System requirements:
  • Modern web browser supporting current security standards and encryption protocols
  • Reliable internet connectivity to access cloud hosted service securely
  • Supported operating systems for desktop and mobile device access
  • User authentication integrated with organisational identity management systems
  • Network firewall rules permitting secure outbound HTTPS traffic
  • API access for optional integrations with third party systems
  • Compatible sensor, BMS or access control systems for advanced integrations
  • Role based access configuration aligned to organisational governance policies
  • Secure endpoint devices compliant with organisational security standards
  • Standard antivirus and endpoint protection on user or managed devices

User support

• Email or online ticketing support: Yes
• Support response times: Response times vary by support level and incident severity. Under Basic Support, critical incidents receive an initial response within 4 business hours during standard business hours (Monday to Friday). Under Enterprise Support, critical system-down incidents receive an initial response within 2 hours, 24/7/365, including weekends and public holidays. Non-critical incidents are responded to within 2 business hours to 1 business day, depending on severity. Weekend and out-of-hours support applies to critical incidents for Enterprise Support customers only.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: FM:Systems and OpenBlue provide two primary support levels: Basic (Standard) Support and Enterprise (Premium) Support.; All customers receive Basic Support as part of their software subscription. This includes access to the online support hub and knowledge base, business-hours telephone support, and defined response times based on incident severity (e.g. 4 business hours for critical issues during business hours). Basic Support is designed for organisations with standard operational requirements.; ; Enterprise (Premium) Support is available at an additional cost and is intended for customers requiring enhanced service levels. It includes expedited response times, global support hours, 24/7/365 response for critical system-down incidents, regular support review calls, and a dedicated support contact who acts as the primary coordination point for complex environments.; ; Pricing for Enterprise/Premium Support is subscription-based and provided on request, dependent on scope, scale and deployment model. ; ; For customers requiring deeper, proactive engagement, Technical Account Managers (TAMs) are available as an optional professional service. TAMs provide ongoing technical guidance, optimisation support, integration oversight and strategic advice aligned to long-term platform use.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: FM:Systems and OpenBlue support users in getting started through a structured onboarding and enablement approach. This includes access to online user documentation and knowledge bases, step-by-step guides, and recorded training materials. Remote training sessions are provided as part of implementation to support administrators and end users, covering configuration, day-to-day use and best practices.; ; Where required, onsite training and workshops can be delivered through Professional Services, particularly for larger or more complex deployments. Ongoing support is available via the online support portal, email and telephone, and optional services such as Technical Account Managers provide continued guidance, optimisation and adoption support.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the end of the contract, users can extract their data in standard, non-proprietary formats. Data can be exported via built-in reporting and export tools, API access, or scheduled flat-file exports (e.g. CSV) depending on the data set.; ; FM:Systems / OpenBlue will support data extraction in line with agreed exit arrangements, including assistance with defining data scope, running final exports and securely transferring data to the customer or a nominated third party. Where required, Professional Services can provide additional support to ensure a controlled and complete handover.
• End-of-contract process: At the end of the contract, the service enters a managed off-boarding phase in line with the agreed contractual terms. Users retain access for the contract duration to export their data using standard tools, APIs or agreed data extracts. FM:Systems / OpenBlue will support the orderly handover and extraction of customer data, after which the service instance is scheduled for decommissioning and customer data is securely deleted in accordance with data protection and retention policies.; ; Included in the contract price:; • Access to the service until contract end; • Standard data export capabilities (reports, APIs, flat-file exports); • Secure decommissioning and data deletion following contract termination; ; Additional costs (if required):; • Bespoke or large-scale data extraction requests; • Data transformation, validation or migration support; • Extended access periods beyond contract end; • Professional Services support for exit planning or third-party handover; ; Any additional services are provided on request and agreed in advance to ensure transparency and cost control.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is designed to work on mobile devices via responsive web interfaces and dedicated mobile experiences where applicable. Core functionality such as viewing dashboards, booking desks and rooms, managing visitors, submitting and tracking support requests, and accessing reports is available on mobile. Desktop access provides a fuller administrative experience, including advanced configuration, detailed reporting, bulk data management and system administration features.
• Service interface: Yes
• Description of service interface: The service provides a secure, web-based user interface that allows users to access functionality for workplace management, booking, analytics, reporting, administration and support. The interface is role-based, accessible via standard web browsers, and designed to support both desktop and mobile use.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The service interface is designed to meet WCAG 2.2 AA accessibility standards. Accessibility testing includes internal reviews against WCAG success criteria, keyboard-only navigation testing, colour contrast verification, and responsive behaviour testing across devices. Testing has been carried out with commonly used assistive technologies, including JAWS and NVDA screen readers, Dragon voice activation software, ZoomText screen magnification, and Windows Magnifier, with accessibility considerations embedded into ongoing design, development and regression testing cycles.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: FM:Systems (as part of Johnson Controls OpenBlue) provides a comprehensive API integration capability, using a library of SOAP and REST APIs to enable secure data exchange and workflow automation with third-party systems such as ServiceNow, SAP, Workday, Active Directory, Office 365 and others.; ; Using the API, users can set up the service by integrating core data such as people, space, assets, organisational structures, bookings and service requests from source systems into FM:Systems. Users can also make changes by creating, updating or synchronising records, triggering workflows, and exchanging status updates (for example, work orders, moves or service requests) either in real time or on a scheduled basis. Bi-directional integrations are supported, including certified integrations such as the ServiceNow Integration Engine. ; ; Limitations: the API operates as a secure listener; external systems must initiate API calls. Some configuration, validation logic and complex workflow orchestration may require Professional Services support. Bulk or legacy integrations may use flat-file (CSV via SFTP) methods rather than APIs, and unsupported file formats (e.g. Excel) are not accepted.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: What can be customised:; Buyers can customise workflows, booking rules, forms, dashboards, reports, data fields, integrations, role-based permissions and notification rules. Configuration can be aligned to organisational policies, estate structures and operational processes.; ; How users can customise:; Customisation is primarily configuration-based and performed through the administrative interface, using built-in tools for workflow design, reporting, dashboards and integrations. APIs and integration tools can be used to extend or automate configurations. More complex customisations may be delivered through Professional Services.; ; Who can customise:; Authorised customer administrators can perform standard configuration and customisation activities. Advanced configuration, integrations or structural changes can be supported by FM:Systems / OpenBlue Professional Services where required.

Scaling

• Independence of resources: The service is delivered using a multi-tenant cloud architecture with logical isolation between customers. Resources are segregated at the application and data layers, ensuring each customer’s data, configuration and workloads are isolated from others.; ; Platform capacity is actively monitored and scaled to manage demand, with performance controls, resource throttling and prioritisation in place to prevent one customer’s usage impacting another’s. Where required, dedicated or private environments can be provided to meet higher isolation, performance or security requirements.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides usage and performance metrics through dashboards and reports, including user activity, bookings, utilisation, workflow volumes and system usage trends. Metrics can be accessed by authorised users to support service monitoring, reporting and continuous improvement, and can also be exported for further analysis where required.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Additional controls include role-based access, secure key management and monitored backup and recovery processes.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Users can export their data using multiple supported methods. Standard exports are available through built-in reporting and data export tools, allowing users to download data in common formats such as CSV. Data can also be exported via secure APIs to extract structured data programmatically, or through scheduled flat-file exports (for example via secure SFTP) for larger datasets.; ; Where required, FM:Systems / OpenBlue can support managed data exports as part of agreed support or professional services, ensuring data is extracted securely, accurately and in line with contractual and data protection requirements.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: Network segmentation, firewalls and zero-trust security controls are applied to limit lateral movement and protect internal traffic

Availability and resilience

• Guaranteed availability: The service is designed for high availability and is hosted on resilient, enterprise-grade cloud infrastructure. The minimum service level for software availability is 99.5% per calendar month, with a target availability of 99.9%, excluding planned maintenance and force majeure events. Availability is monitored continuously.; ; Clients are notified by email via the Support channel of any scheduled maintenance occurring outside peak business periods and of any unplanned service outages. The service provider is responsible for the availability of both the application and supporting infrastructure. By utilising the AWS cloud platform, the service is architected to eliminate single points of failure that could impact availability.; ; Where availability falls below the guaranteed level, service credits may be applied in accordance with the contract and SLA terms, calculated as a percentage of the affected monthly service charge and applied to future invoices.; ; Backups are taken regularly and stored on Amazon S3. In the event of data loss, restoration is performed in line with Business Continuity objectives:; • Recovery Time Objective (RTO): 8 hours from the initial outage; • Recovery Point Objective (RPO): 4 hours from the initial outage; ; Planned maintenance is communicated in advance and designed to minimise disruption.
• Approach to resilience: The service is designed for resilience across application, data and infrastructure layers, aligned with the government’s cloud security principle on asset protection and resilience. It is hosted on enterprise-grade public cloud infrastructure (AWS), using multiple availability zones to remove single points of failure and support continued operation in the event of component or site-level issues.; ; The application is deployed using redundant compute, load balancing and automated health monitoring, allowing services to fail over without user intervention. Data is stored on highly durable, replicated cloud storage, with regular automated backups and tested restoration processes aligned to defined Business Continuity objectives.; ; Datacentre resilience, including physical security, power, cooling and environmental controls, is provided by the third-party cloud provider and complies with recognised industry standards. Detailed datacentre and architectural information can be made available on request where appropriate.; ; Resilience is further supported through continuous monitoring, incident management, capacity management and controlled change processes to minimise disruption and ensure rapid recovery from incidents.
• Outage reporting: The service reports outages through direct customer communications and support channels. Email alerts are issued to registered contacts via the Support channel for unplanned outages and scheduled maintenance. Customers can also view incident status and updates through the online support portal.; ; The service does not currently provide a public outage dashboard or outage-reporting API. Outage information, progress updates and resolution notifications are communicated directly to affected customers to ensure accuracy and relevance.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access controls and the principle of least privilege. Only authorised users can access administrative functions and sensitive data, with elevated privileges limited to approved administrators.; ; All access requires user authentication, with optional SSO and configurable permission levels. Support channels are restricted to registered users, who can only view and manage tickets for their organisation. Access is logged, monitored and regularly reviewed to ensure compliance with security and operational policies.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO/IEC 27001 (via AWS hosting environment); SOC 2; FedRAMP (US); Physical access controls aligned to recognised cloud security standards (for example CSA CCM–aligned controls)
• Information security policies and processes: The organisation follows a formal information security governance framework aligned to recognised industry standards and regulatory requirements. This includes documented policies covering information security management, access control, data protection and privacy, incident response, vulnerability management, change management and business continuity.; ; Security governance is overseen by a named board-level executive with responsibility for information security, supported by senior security and compliance leaders. This reporting structure ensures security risks, incidents and compliance matters are regularly reviewed at executive level and escalated where required.; ; Policies and processes are enforced through a combination of technical controls, operational procedures and assurance activities. These include role-based access controls, encryption, monitoring and logging, secure development practices, and defined incident and breach management processes. Compliance is validated through regular internal reviews, independent audits (including SOC 2), annual penetration testing, and continuous security monitoring provided by the cloud hosting platform. Staff receive security awareness training, and adherence to policies is reinforced through documented procedures, audit evidence and ongoing management oversight.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: The service operates formal configuration and change management processes aligned to UK Government non-functional requirements and operational security best practice. Service components (including application code, configurations, integrations and infrastructure) are tracked throughout their lifecycle using version control, configuration records and segregated environments for development, test and production.; ; All changes follow a defined change assessment process that evaluates scope, risk and potential security impact before approval. Security assessment includes access control, data protection, integration risk and service availability. Higher-risk changes require enhanced review and testing prior to deployment. Emergency changes are documented and subject to post-implementation review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: The organisation operates a vulnerability management process aligned to the government’s Operational Security principle. Potential threats are assessed through continuous monitoring, automated vulnerability scanning, independent penetration testing and risk-based review of applications and infrastructure. Vulnerabilities are evaluated for severity, exploitability and business impact.; ; Patching is prioritised by risk, with critical vulnerabilities addressed as a priority through controlled emergency or expedited change processes, and lower-risk issues remediated through scheduled release cycles.; ; Threat intelligence is sourced from cloud provider security advisories (for example AWS), software vendors, penetration test results, independent security research and recognised vulnerability databases such as CVE.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The organisation operates protective monitoring aligned to the government’s Operational Security principle. Potential compromises are identified through continuous log monitoring, automated alerts, intrusion detection and anomaly analysis across applications and infrastructure.; ; When a potential compromise is detected, incidents are triaged and investigated immediately, with containment, remediation and recovery actions taken as required. Security incidents are logged, escalated and managed through a formal incident response process.; ; Response times are risk-based, with critical security incidents prioritised and addressed urgently, including out-of-hours response where necessary. Post-incident reviews are completed to improve controls and monitoring effectiveness.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: No
• Incident management approach: The organisation operates a formal incident management process aligned to the government’s Operational Security principle. Pre-defined procedures exist for common events such as service outages and security incidents to ensure consistent response.; ; Users report incidents via the online support portal, email or telephone. Incidents are logged, prioritised by impact and urgency, and escalated where required.; ; During an incident, users receive status updates, and where appropriate a post-incident report is provided, outlining the issue, impact, resolution actions and any preventative measures.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI
• ISO/IEC 27001 accreditation date: Monday 4 March 2024
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: BSI
• ISO 9001 accreditation date: Friday 5 May 2023
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Provided
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at phil.yates@jci.com. Tell them what format you need. It will help if you say what assistive technology you use.