Emapsite Express OS

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: Emapsite Express OS is limited to Ordnance Survey data; the service can be extended and customised under the Express Custom by Emapsite service.
Emapsite Express OS is available under a tiered subscription model based on actual consumption/usage.
System requirements: No specific system requirements

User support

Email or online ticketing support: Email or online ticketing
Support response times: Email
office hours
4 hour response
ticket generated in internal ticketing system from email
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: SLA includes 4 support levels at no additional charge:
Cosmetic
Inquiry regarding a routine technical issue; information requested on application capabilities, navigation, installation or configuration; bug affecting a small number of users. Acceptable workaround available; standard support hours
Minor
System performance issue or bug affecting some but not all users. Short-term workaround is available, but not scalable; standard support hours
Major
Major functionality is impacted or significant performance degradation is experienced. Issue is persistent and affects many users and/or major functionality. No reasonable workaround available; extended support hours via email and phone messaging alerts inc weekends
Critical
Critical production issue affecting all users, including system unavailability and data integrity issues with no workaround available; extended support hours via email and phone messaging alerts 24*7

In addition all customers have a named account manager who will act as a conduit to appropriate technical, integration and cloud support resources.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: 1. Every organisation is registered in our database
2. At least one organisation member of staff needs to be registered in our database
3. Every user for every organisation should be registered; each person is given a unique username and password
4. Each user will be required to authenticate themselves with their username and password when accessing the Services for the first time whenever they invoke the service from within their application
5. Any organisation can register additional users at any time
6. Any new PSGA signatory will need to be forwarded to emapsite by the appropriate Contract Manager and the above process replicated
Service documentation: No
End-of-contract data extraction: Service migration of specific APIs is limited owing to nature of a model built on highly optimised web service components delivering content from very specific geographic data stacks. The services are highly interoperable and extensible, for example to other data stacks.
User data extraction includes the facility to retrieve all user interaction and user generated data including transaction logs and database schemas as applicable; any such data would typically be provided as CSV or XML.
Subject to audit requirements emapsite will purge and destroy consumer data from any computers, storage media or storage devices at the end of a subscription period.
Indicative time for de-provisioning (to close and off-board any service) is one week (though contractual obligations may have a different term in relation to cancellation of service).
End-of-contract process: Typically 3 months notice is required unless there is a material and persistent breach of any of the obligations agreed under a Call Off or other Contract under the G-Cloud framework or if a change of control of the Supplier causes conflicts of interest or other competition issues.
There are no additional costs at termination.

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: No
Service interface: No
User support accessibility: None or don’t know
API: No
Customisation available: No

Scaling

Independence of resources: Like most platforms we rely on over-provisioning for each service in line with the number of users and patterns of usage, spinning up additional resources as necessary for any specific service. In addition owing to typical usage levels we separate the WMS/WFS and the WMTS requests onto discrete hardware. Tile size constraints form part of the service level agreement.

Analytics

Service usage metrics: Yes
Metrics types: Overall service usage levels per customer organisation by product and format if required.
Reporting types: Regular reports

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: No
Datacentre security standards: Supplier-defined controls
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Other
Other data at rest protection approach: Data encryption
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Range of format options including shp, tab, dwg, dgn, dxf, gdb
Data export formats: CSV

Other
Other data export formats: Gml

Esri shapefile

Dwg

Dgn

Tab

Dxf

Gdb
Data import formats: Other
Other data import formats: Kml

Esri shapefile

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)

Legacy SSL and TLS (under version 1.2)
Data protection within supplier network: TLS (version 1.2 or above)

Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability: Internal auditing shows WMS/WMTS/WFS availability at 99.85% on 24*7*365 basis and 99.95% on a working hours basis.
emapsite offers a service credit package upto 10% of the per service delivery period contract value; this is assessed according to details agreed in the customer service level agreement and typically provides for a credit for failure to deliver required services to the agreed availability level for the specified service delivery period.
Approach to resilience: Emapsite Express OS sits within a Tier-3+ Microsoft Azure Datacenter.  This is a single region (UK West) with multiple availability zones.

As a business relying on online presence for 100% of our revenue and customer satisfaction emapsite takes business continuity seriously. 

Our approach is to ensure that we have in place a series of responses to any event that may disrupt any of our core services. This includes our: 

Datacenter procurement and provisioning strategy - Tier 3+ (with ISO 27001, HIPAA, FedRAMP, SOC 1, and SOC 2)

Our terms and conditions of employment reflect need to provide out of hours maintenance and tracking of out of hours monitoring tools 

services backed by Service Level Agreement to suit customer need  

internal quality assurance processes (with ISO9001 accreditation in train) that include provision of appropriate assurance around: 

service level agreement management 

receipt, preparation and update of data sets on the platform 

service maintenance protocols 

supplier relationships 

support, response, resolution and escalation processes 

automated alerts for a whole plethora of critical resources and services that customers rely on with 4 level escalation and response framework 

audited office and colocation access 

audited access logs and secure VPN 

patch and upgrade compliance including for security
Outage reporting: Vulnerability management – Azure uses Microsoft Security Response Center to identify, monitor and respond to incidents 24/7.

24/7 protective monitoring using Microsoft Monitoring Agent (MMA) and System Center Operations Manager. This provides real time alerts to security personnel.

Customers: emapsite's clustered load balanced virtualised cloud environment, complete with backup and with no single point of failure and appropriate failover procedures and licenses provides more than adequate business continuity model to capture and maintain customer data. Customers can request full audit trails relating to use of our website and underlying services.

Identity and authentication

User authentication needed: Yes
User authentication: Username or password
Access restrictions in management interfaces and support channels: No user access to management interfaces by default. All requests for change to interfaces are authenticated independently prior to roll out.
Access restriction testing frequency: At least once a year
Management access authentication: Dedicated link (for example VPN)

Audit information for users

Access to user activity audit information: Users contact the support team to get audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: British Assessment Bureau
ISO/IEC 27001 accreditation date: 27/06/2023
What the ISO/IEC 27001 doesn’t cover: From the Quality and Infosec Manual:
"To the extent that there need be exclusions:
• While the Company has a number of staff on home-working contracts it is satisfied that those contracts and the stipulations therein exclude additional teleworking controls (A.6.2.2 of ISO27001:2013).
• The Company is satisfied that system architecture including RAID storage, dual zones, load balancing, clustering and virtualisation together with near real time database mirroring make traditional formal “backup” procedures redundant (A12.3)"
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: Yes
Who accredited the PCI DSS certification: Elavon
PCI DSS accreditation date: 18/03/2024
What the PCI DSS doesn’t cover: Storage of credit card details (not stored).
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: A number of internal processes are subject to internal audit on an annual basis including data separation. In addition the following policies are integral elements of emapsite's Integrated Quality and Information Security Management Systems Assurance Manual underpinning the relevant controls within the Statement of Applicability:
- Access Control
- Business Continuity
- Change Management
- Data Security and Separation
- Impact Statement
- Incident Management
- Information Asset Management
- Information Classification
- Information Systems Security
- Operations Security
- Patch Management.
The policies inform system architecture and monitoring.
emapsite's Assurance Committee (AC) meets twice yearly to review the approach to risk and the currency of the controls and policies that surround that risk appetite and any specific new risks. The AC reports to the Board annually.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: The change control process includes the following phases:
• Logged Change Requests giving full tracking in code repository
• Identification, prioritisation and initiation of change
• Proper authorisation of change (Impact Statement as applicable to identify potential infosec issues )
• Requirements analysis
• Inter-dependency and compliance analysis (to consider infosec impacts)
• Impact Assessment
• Change approach
• Change testing
• User acceptance testing and approval
• Implementation and release planning
• Documentation
• Change monitoring
• Defined responsibilities
• Emergency change classification parameters.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Annual risk assessment process identifies threats (physical damage, natural events, loss of essential services, compromise of information, technical failure, unauthorised action and compromise of functions as well as HR centred risks) and vulnerabilities (hardware, software, network, personnel, site, organisation) to create the basis for high level scenario modelling and risk treatment process. At the same time perimeter and network monitoring tools together with WSUS and equivalent patching routines ensure day to day threat mitigation. Systems administrator oversight together with triggers and automation streamline processes while suppliers and industry sources provide topical information.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: Information classification is used to determine whether any data supplied by users and customers is high impact level data (in line with GPG13). Systems monitoring including access control logs and exception monitoring of external requests (for example for SQL injection or PPTP VPN login attempts from suspicious places) provides an understanding of how our IT systems is being used or abused by internal or external agents.
Incident management type: Supplier-defined controls
Incident management approach: For some common possible events we have pre-defined mitigation processes including auto screensaver for unlocked laptops and encrypted hard drives.
Incidents must be reported and logged. Those dealing with security incidents shall:

• analyse and establish the cause of the incident and take necessary steps to prevent recurrence
• ongoing reporting to all affected parties
• identify problems arising from the incident and to prevent/reduce further impact
• ensure all system logs are securely maintained
• ensure only authorised personnel have access to systems and data
• ensure all corrective and preventative measures are implemented and monitored for effectiveness

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Equal opportunity
Wellbeing

Fighting climate change

The Idox Group has adopted the 3 scopes of the Greenhouse Gas Protocol (GHG). Working within the three scopes Idox commits to net-zero carbon emissions by 2040. Our business-wide three-step approach to carbon emissions will eliminate emissions, or where this is impractical, will prioritise reducing the emissions impact of our activities and will offset emissions that cannot be eliminated or further reduced by engaging in a compensating carbon offset programme. Scope 1: Eliminate all equipment in offices which produce direct emissions. Replace with energy-efficient, electric alternatives. Eliminate emissions from company-owned vehicles. Replace with electric alternatives Offer employees access to salary-sacrifice EV scheme. Scope 2: Reduce electricity usage by implementing Energy Savings Opportunity Scheme recomendations. Eliminate the purchase of non-renweablby sourced electricity. Scope 3: Reduce business travel through remote working and on-line collaboration tools. Eliminate travel by private vehicles which produce emissions. Offset emissions from public transport used for business travel and from hotel stays either by choosing operators offering direct offset or through a carbon-offset programme. Eliminate waste by removing single-use plastic products and reduce waste from offices through effective recycling. Offset non-recyclable waste trhough a carbon-offset programme. Eliminate waste from surplus equipment by passing this on for re-use in support of our social contribution wherever possible. Where this is not possible, reduce waste by fully recycling the equipment and offset residual emissions in a carbon-offset programme. We are strengthening our performance as an all-round responsible business that makes a valuable contribution to society, has good governance embedded in its culture and processes, and is on target to achieve net zero carbon emissions. Our gross GHG emissions of CO2 (tCO 2e) are reported yearly in our published Annual Report.

Covid-19 recovery

The Idox Group is continuing to work on finding the optimal working pattern for our colleagues post-Covid. We have to make sure that we have the right blend of home /office work, and essential/non-essential travel, that allows our colleagues to be efficient but also continue to benefit from the lifelong development and learning opportunities that are an important part of corporate, office life. Employers must work hard and creatively to enable appropriate new ways of working that meet all these new requirements without allowing a drop in the most important thing, excellent customer service. To meet the changing needs of the workplace, Idox looked at how the post-COVID period affected working environments and how this related to its office estate. With the sharp increase in home working and subsequent move away from highly-populated office environments, Idox closed some long-lease main office property and instead opened short-lease serviced offices. This allowed us to be much more flexible in the way that we can adapt our property holdings to meet the needs and distribution of employees, while reducing carbon footprint in terms of our office utilities and travel times. We have also increased the frequency of online workshops, chat lounges, management team broadcasts and staff surveys, allowing both remote and office based colleagues to participate in group activities and maintain a sense of company camaraderie, inclusion and wellbeing. Idox has produced a white paper looking at how the workplace has to change in response to the COVID-19 pandemic. The white paper: • sets out the challenges and legal requirements facing businesses of getting back to work safely and efficiently • looks at how businesses can prepare for reopening and implement these plans • provides hints, tips and guidance on reopening facilities to be ‘COVID-secure’ The white paper is available at: https://www.idoxgroup.com/idox-insights/computer-aided-facilities-management-insights/getting-back-to-business/

Tackling economic inequality

The Idox Group takes environmental, social and governance responsibilities very seriously. Social value forms part of contract commitments to our public sector Buyers; we work with our customers to support their priority targets and outcomes. Examples of social value we deliver: Facilitate skills workshops; Financial donations to fund places on training courses, Fund community projects that work to tackle economic inequality, Reduce the digital skills gap, creating training opportunities for those who face barriers to employment and/or who are located in deprived areas, Support educational attainment, Donate used IT equipment to VCSEs to support people in deprived areas, Provide work experience placements. Our robust social value process includes annual reviews of social value delivery performance. These reviews ensure we understand customers’ priorities and set appropriate yearly targets, continuously improving how we deliver social value. We create socially responsible and valuable opportunities for our teams to give back. Each year we offer colleagues one day paid volunteering leave and provide opportunities to support charities and causes throughout the year. Idox fully supports the UK Government initiative to implement a structured approach to providing direct, impactful social value contributions. This approach is also being replicated in other, local Government contracts. Through our tenders we have committed to local social value contributions, providing local employment including apprenticeships and work placements, support for healthy meals for children outside term time and in direct donation to local initiatives aligned with customers’ social value priorities. We also provide small charities free access to Idox’s My Funding Central which typically saves these organisation £50p.a. but which can help them access funding opportunities worth upwards of £10,000. The service is specifically aimed at charities and voluntary organisations with incomes below £1M and is free-to-use for organisations with incomes below £30,000.

Equal opportunity

The Idox Group strives to create workplaces that reflect the communities we serve, where everyone feels empowered to bring their full, authentic self to work. Our guidance to employees and suppliers concerned with recruitment, training, promotion and delivery is outlined in our Equality and Diversity Policy which covers our responsibilities under the Equalities Act and how we deliver them. We can provide a copy of the policy. We have clear goals to achieve a gender-balanced workforce by 2027. To tackle under-representation in leadership, we are particularly focused on increasing the proportion of women in the people-leader tiers of the business to correlate with the gender ratio of the company in general and to support the overall reduction of the gender pay gap specifically. Our policies and initiatives that support Diversity, Equality and Inclusion include: • Flexible working • Family friendly policies • Pay Gap reporting, published annually on our website; • Fair Pay, Idox is an accredited Living Wage Employer. In 2020, Idox launched Elevate, a programme sponsored by Idox board members, championing a truly inclusive culture. The team is particularly focused on building gender equality at all levels of the organisation and challenging us all to be more inclusive. With initiatives that will build a diverse, gender-balanced workforce and develop the skills and confidence of our colleagues, Elevate advocates equality and diversity in our organisation. The pillars we work within to achieve this are: Terms of employment: Ensuring that we start from a position of equality and good foundations in HR and that Elevate is championed from the top down. Organisation attractiveness: Creating an inclusive culture that attracts a more diverse workforce and promotes inclusion internally. Recruitment: Develop a more diverse approach to recruitment. Employee development: Supporting career progression across the organisation and moves into leadership positions.

Wellbeing

Since its launch during the pandemic in 2020, Workplace Wellbeing has become a staple source of support and community within Idox. In 2023, the group continued to raise awareness of topics impacting our colleague’s mental health, as well as offering one-to-one support for those in need. Comprising five colleagues, the team hosted seven live broadcasts. Covering everything from mentoring vulnerable young people, to stress and improving fitness, the team continued to be a key resource for our people with 98% of our colleagues being familiar with the initiative according to our BeHeard survey. As we prioritise the wellbeing of our employees, our employee assistance programme continues to act as a crucial resource in providing counselling, GP consultations and general advice. We have worked closely with the team at Zurich to provide support workshops and information sessions for our teams. These have been well attended and well-received and we continue to work on how best we can support our employees to live a full balanced life where they feelsafe.We provide all colleagues with time and resources to support charities and good causes, which we believe allows people to reflect their own interests whilst supporting Idox values to be a socially responsible and sustainable business. Workplace Wellbeing programme initiatives provide support to our colleagues and help create support and connectivity, we also encourage colleagues to initiate and drive engagement across the business through shared interest. These have continued to be very popular with colleagues again in FY23 and have included photography groups, walking, cycling, knitting and other hobbies and pastimes.

Pricing

Price: £4,999 a licence a year
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: Free access to all PSGA data. Trials can run for up to 3-months for non production purposes.

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Emapsite Express OS

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents