System Simulation

CollectionsIndex+

CollectionsIndex+ is a standards-compliant collections management system for museums, archives, libraries and other organisations that have a need to catalogue, manage or share collections of objects, documents, images or films.

Features

• Modular, scalable, standards-based collections management system
• Spectrum, ISAD(G) and MARC 21 compliant modules
• Integrated Digital Asset Management options
• Public search-the-collections website, REST API and IIIF server
• Powerful reporting functionality
• International text support
• Workflow management
• Role-based permissions model
• Single Sign On integration option
• Data migration, training and collections consultancy services available

Benefits

• Manage object, archive, book and film collections in one system
• Catalogue consistently across collections using shared terminologies and authorities
• Manage images, audiovisual content and other digital assets
• Structure your collections management activities with CollectionsIndex+ workflows
• Create compelling Word and Excel reports
• Publish your collections on the web

£7,500 an instance a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at leads@ssl.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

316473323086074

Contact

Richard Beales
+442078367406
leads@ssl.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: CollectionsIndex+ Web Edition is designed for tablet, laptop or desktop use via any current-generation web browser. CollectionsOnline is a responsive website that gives a great user experience on mobile, tablet or laptop/desktop devices.
• System requirements:
  • Current-generation web browser with internet access.
  • The optional Office Export module requires a Microsoft Office licence.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response times are aligned with our service level agreement.; We will provide a help desk between 09:30 and 17:30 UK time (the support hours).; We respond to the most urgent, 'Critical' queries within four hours during support hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: All support is given by our in-house collections consultants and our team of engineers. Overwhelmingly, the people that support your system once you’re live will be the same team that you’ve got to know during the initial project. We do have some mechanisms that we use to help us best manage support requests and conversations, but you’re always more than welcome to phone or email individual members of staff directly. In addition to our standard 'Bronze' support package, we also offer enhanced 'Silver' and 'Gold' packages that come with the same support SLA obligations but also include discounted blocks of pre-paid consultancy time, which can be used for system enhancements, additional configuration, training or other services throughout the year. Support pricing varies according to the specific software modules purchased and the number of concurrent user licences required. For a standard CollectionsIndex+ system with one collections module, licensed for four concurrent users, annual support fees would typically cost between £750 and £2000 per year.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We normally include two training sessions with each system delivery. Training can be delivered remotely, on site or at our London office. Additional training can be purchased as required. We also provide a system manual, and have a growing library of video tutorials that are freely available to all users.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Users can download their data in a number of formats at any time, subject, as always, to their authorisation level in the system. System Simulation are always there to provide help and support and can export data for users when required.
• End-of-contract process: At contract end System Simulation will update our internal documentation to note the end of the contract. Where we are providing hosting services, we will take down those services, delete data and configuration from public-facing servers and stop backups; old backups will continue to be retained according to the usual backup retention policy which will result in automatic deletion after around several months.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.1 AA or EN 301 549
• API: Yes
• What users can and can't do using the API: As standard, the CollectionsIndex+ API supports read-only search and retrieval of collections records, including authorities and terminology records.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: The CollectionsIndex+ Views Manager allows users to create named subsets of CollectionsIndex+ fields, known as “views”, for themselves and others. Views can be marked as Public, accessible by all users of your CollectionsIndex+ system, or Private, for only that login. The current view is selected from a drop-down of available views. The selected view governs the the record view, the edit form and the field options in the advanced search. Once a view has been selected, that selection persists but is easily changed. Views are particularly useful for constraining the data shown to that required by particular types of users, different tasks or different collections. The Views Manager is flexible and easy to use. Views can be created for any record type including collection records (archives and objects), authority records, activity records etc. Views are normally independent of permissions.

Scaling

• Independence of resources: Where we are providing hosting services, we aim to over-resource our hosting platforms as well as sharing those resources between users. This means generally there is an excess of provision and allows for peaks of demand.

Analytics

• Service usage metrics: Yes
• Metrics types: On request we integrate CollectionsOnline with Google Analytics for tracking of public collections website usage.

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: CollectionsIndex+ has inbuilt facilities for export of data in CSV, XML and RDF-TTL formats. Ingested digital assets can be retrieved in their native formats. The optional Office Export module allows data to be exported in Word or Excel format. We also offer an optional JSON/REST API.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Our hosting SLA includes a guarantee of at least 99.9% network up-time.
• Approach to resilience: Available on request.
• Outage reporting: Service outage and restoration events are reported by email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: Access is controlled by username and password which determines the authorisation level of the user and what interfaces and channels they can access. In cases where we implement customer SSO, the customer SSO system might implement further access control such as MFA.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials
• Information security policies and processes: Our staff are experienced qualified professionals who are required to follow relevant professional codes of practice. During data migration, information is stored on systems with no direct connection to the internet and we make use of encryption-at-rest and encryption-in-transit. We follow a series of industry best practice system hardening steps for all internet-connected servers. Systems are subject to automated monitoring which reports automatically to the supporting engineering staff who respond to anomalies. Multiple monitoring systems are deployed and reports are sent to multiple staff and at different levels of seniority.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Our software and configurations are held in a source code control system which records all changes. This record keeping is augmented by regular backups with a long-term retention policy. Changes are made in consultation with client user representatives to ensure changes are carried out in full sight. Changes are installed on public-facing systems after internal development, testing and release cycles. Security impact assessment is a permanent part of the development and release process.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Threat monitoring focuses on the different threat sources including internally-derived faults, faults in third-party software including operating system software, malware injection, and configuration errors. Our systems take at least daily updates automatically from reputable software support organisations such as operating system vendors. We run industry standard malware detection software on our servers. We monitor security alerts for any third-party software which can’t be automatically updated. We aim to deploy critical updates within 24 hours of discovery/announcement.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We run automated monitoring both on servers and remotely against our servers and these run continually. Alerts are sent to the relevant hosting and engineering teams and are responses are actioned immediately.
• Incident management type: Supplier-defined controls
• Incident management approach: We do not have scripted procedures for incident management, but have an experienced hosting team who divert all attention to incident management when necessary. We have processes for contacting affected clients to ensure they are kept up to date with incident management, and for recovery and restoration of services. Users all have access to our ticketing system which is the standard way to report an incident. Users can also e-mail or phone us.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  CollectionsIndex+ delivers excellent management of museum and archival collections which removes the need for physical access for some museum activities, reducing travel and increasing options for environmental benefits. CollectionsIndex+ on-line exhibitions allow the public to experience curated heritage experiences without travel.

  Covid-19 recovery

  CollectionsIndex+ delivers efficient management of community cultural assets to aid in reconnection with pre-covid times. CollectionsIndex+ CollectionsOnline public-facing web site allows communities to connect with cultures and traditions both their own and those of other communities. This helps to heal the disconnect of the pandemic and root communities and individuals in their heritage. It supports community mental health services such as reminiscence therapies. It allows museums and archives to deliver services on-line as well as through traditional physical visitor experiences. It also allows museum and archive staff to carry out work at home, supporting new post-pandemic working methods.

  Tackling economic inequality

  Museums have often been founded with the aim to provide equal access to the resources and inspiration needed to succeed. CollectionsIndex+ provides access to heritage materials which supports inspiration and creation of employment and new businesses, especially in the creative and design industries. ; ; CollectionsIndex+ is one of the very few Collections Management Systems owned and created in the UK. Its use supports a domestic capability and provides resilience against international competition. Cyber Security is critical to Collections Management where digital surrogates do not age and become an important part of the collection Collections Management Systems need to handle sensitive information including personal and financial (valuation) data. CollectionsIndex+ from System Simulation is founded in data security and delivers modern protection and security.

  Equal opportunity

  CollectionsIndex+ CollectionsOnline public-facing web site allows greater disabled access to collections, including the use of disability-supporting technologies such as screen-readers and facilitating engagement with collections without the need to travel. CollectionsIndex+ allows a greater set of roles for museum and archive staff to manage collections without traditional physical access. CollectionsIndex+ allows collection catalogues to be assessed and updated to reflect current attitudes to colonialism, slavery and gender.

  Wellbeing

  System Simulation provides flexibility to staff as to where they work – home or office, in order to support COVID-19 recovery and give support for the physical and mental health of our staff. ; ; CollectionsIndex+ CollectionsOnline enables public access to well-managed heritage collections, providing an important underpinning to community integration by sharing our common histories and educating ourselves and our neighbours about our shared and disparate heritage.

Pricing

• Price: £7,500 an instance a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We offer access to demonstration CollectionsIndex+ Web Edition and CollectionsOnline platforms on-request. These are populated with a sample, redacted, demonstration data set kindly provided by several of our existing clients. Users are free to remove, edit or create records for evaluation purposes.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at leads@ssl.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.