IDOX SOFTWARE LTD

National and Bespoke Funding and Policy Content Solutions

Configurable national or regional content and software solutions. Includes, but not restricted to; national and regional funding and policy information portals and xml feeds.

Features

• Configured to Customer Requirements
• Ongoing support from Idox Project Management team
• Fully Hosted and Maintained
• Flexible solutions
• Combination of content and software expertise
• Funding information
• National and regional portals
• XML Feeds

Benefits

• Efficient solution to your strategic requirements
• Cost-effective provision of support
• Support the wider business, community and public sector
• Access to Idox's large content resource pool

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

287553558031983

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Applications

  Content workflow and management

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Standard Maintenance window between 4.00am and 8.00am Thursdays.
• System requirements: Web browser

User support

• Email or online ticketing support: Yes
• Support response times: Our standard Service Desk is operational Monday to Friday during business hours (8.30 am - 5.30pm) although requests for support can be logged 24/7. Questions or requests for support are prioritised in accordance with their severity and urgency. Our SLA for support is available during the clarifications stage of G-Cloud procurement.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: Named Account Manager is included in prices quoted.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We work with the host organisation to position and re-brand the portal. We also offer support in marketing the offering to the local community.We can offer a range of onboarding support, as required. Including delivery of a training session, support in marketing the offering, user videos and guides.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: We can provide user data in CSV format.
• End-of-contract process: The organisation subscription expires and the portal can no longer be accessed. User specific data is purged from the system within 1 month of licence expiry to comply with GDPR guidelines.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: All functionality & content is accessible on the mobile device versions but the display has been re-ordered for ease of use.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Browser interfaces, as above. The offering is a unique solution in each case.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The solution interface is designed to adhere to the highest standards of user experience and accessibility. This ensures that all users, regardless of their needs or the devices they use, can navigate and interact with the platform seamlessly.
• API: No
• Customisation available: Yes
• Description of customisation: These are customised services, so can be adapted to a client's specification.

Scaling

• Independence of resources: Our service is used by very large organisations both in the UK and internationally, it is highly robust and performance is not unduly impacted by large volumes of users.

Analytics

• Service usage metrics: Yes
• Metrics types: Regular reporting is available, both via the product for System Administrators, and through the Idox Account Management team. The reports cover a wide range of user activity and are provided as regular reports.
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Data is encrypted on all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Via CSV
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 98% availability per 30 day period
• Approach to resilience: Our data centre is Tier 3 and meets all associated standards of resilience. Nighty offsite encrypted backups take place to allow data recovery to new hardware in a DR scenario.
• Outage reporting: Outages are reported via the Service Desk

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Management access is permitted only from internal networks which require two factor authentication. Access control lists restrict access to the environment.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We recognise that information security important in the development and implementation of all systems delivered to our customers, to Idox as a corporate entity, and to our supply chain.; ; To ensure a consistent and effective approach, we operate an externally audited and certified, organisation wide Information Security Management System (ISMS) which implements and enforces controls on all business functions covering but not limited to information systems, networks, physical environment, incident/threat management, project and contract management and personnel management. ; ; Our systems and controls are also externally verified and certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the Information Security Manager, the appropriate Head of Business and a board representative.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes to the service are carried out using change requests and are maintained within the change management system. The change management process incorporates a business case / justification for the change, a backout plan, and a final approval with scheduling for the change to be implemented. They will be assessed for security or service impacts during this process, before deployment to a separate QA environment where they are checked for verification before release to production.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network / bandwidth utilisation and unusual server / network / perimeter activity. Alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Our incident management process is central to ISO27001 Information Security Management System. In line with Incident Management Policy/Process, incidents are raised to the Service Desk or detected by monitoring such as SIEM, triaged and escalated as required. All tickets are allocated a reference number and tracked to conclusion. Results are monitored, documented and preventative action taken to prevent re-occurrence. The incident team maintain contact with relevant internal and external stakeholders within predefined timeframes. For GDPR related incidents this is 24 hours from confirmation.; Security incidents raised to the internal incident register are subject to regular reviews by the senior team.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.