Metadata Consulting Ltd

MetadataWorks

MetadataWorks configuration, product hosting and support on pre-configured Azure / AWS / Proprietary Cloud.

Features

• MetadataWorks Cloud Configuration
• MetadataWorks Cloud Support
• MetadataWorks Cloud Database
• MetadataWorks Cloud Backup
• MetadataWorks Cloud Adapters
• MetadataWorks Cloud API

Benefits

• Improved Data Findability
• Improved Data Accessibility
• Improved Data Interoperability
• Improved Data Reusability
• Improved Data Quality
• Collaborate on and Share Data Standards

£12,000 to £600,000 a licence a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

• Modern Slavery statement

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adam@metadataworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

355472482499879

Contact

Adam Milward
07590549421
adam@metadataworks.co.uk

Service scope

• Service constraints: MetadataWorks operate a monthly maintenance and update cycle
• System requirements: MetadataWorks License

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Initial response and triage within 4 hrs.; Standard support hours are 9-5 Mon-Fri (exc BH).
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Operational Hours 24x7x365 ; Business Support Hours (Service Support Hours) 9-5 Mon-Fri (exc BH) ; ; Planned Maintenance Downtime Outside of Business Support Hours ; Availability (in business support hours) 99.50% ; Unplanned downtime (mins per month) 58 minutes ; Times to Resolve ; Incident Resolution Times (in business support hours): ; Sev1 (loss of system or major function affecting multiple ; users, no workaround) 4 hrs ; Sev2 (loss of major function affecting single user, or major ; function with workaround) 8 hrs ; Sev3 (minor functional impact) 24 hrs (Mon - Fri 9-5 ex BH) ; Sev4 (no impact on function) 72 hrs (Mon - Fri 9-5 ex BH) ; - Resolution may be provision of workaround or fix. ; Problem Fix Times ; Sev1 30 working days or an agreed release ; Sev2 60 working days or an agreed release ; Sev3 120 working days or an agreed release ; Sev4 240 working days or an agreed release ; RTO - Recovery Time Objective ; Maximum expected recovery time following a service outage 24 hours ; RPO - Recovery Point Objective. 24 hours
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onsite training, online training, and/or user documentation is available
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Users can extract data as an Excel document or SQL database.
• End-of-contract process: MetadataWorks include a standard excel extract / SQL data export. Any additional processing or organisation of the data is at an additional cost.

Using the service

• Web browser interface: Yes
• Using the web interface: MetadataWorks provides a web interface to publish and manage metadata
• Web interface accessibility standard: WCAG 2.1 AAA
• Web interface accessibility testing: MetadataWorks use WCAG 2.1 AAA automated testing tools as well as internal audits on a quarterly basis.
• API: Yes
• What users can and can't do using the API: Users can integrate with MetadataWorks using our secured API documented in Swagger
• API automation tools: Terraform
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type: Manual
• Independence of resources: MDW uses dedicated infrastructure with independent resource to ensure that demand is not affected by usage on other services.
• Usage notifications: Yes
• Usage reporting: Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
• Reporting types: Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: MetadataWorks

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: In-house destruction process

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Files
  • Database
• Backup controls: MDW backups on a daily basis. Additional schedules are available on request
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Users contact the support team to schedule backups
• Backup recovery: Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: 99.5%
• Approach to resilience: Available on request.
• Outage reporting: Email alerts

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: MetadataWorks can be restricted using several different mechanisms based on user requirements. More information available on request.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: 19/11/2021
• What the ISO/IEC 27001 doesn’t cover: Available on request
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO27001 audited and certified processes. Risks and internal audits are presented to Directors monthly.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: MetadataWorks operate a 27001 audited security management process that includes configuration management, service tracking and change management, including security impact assessments.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: MetadataWorks operate a 27001 audited security management process that includes vulnerability management. More information can be supplied on request.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: MetadataWorks operate a 27001 audited security management process that includes protective monitoring. More information can be supplied on request.
• Incident management type: Undisclosed
• Incident management approach: MetadataWorks operate a 27001 audited security management process that includes incident management. More information can be supplied on request.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Third-party
• Third-party virtualisation provider: AWS/Azure/Other
• How shared infrastructure is kept separate: Available on request

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: MetadataWorks use AWS servers. See https://sustainability.aboutamazon.com/environment/the-cloud?energyType=true

Social Value

• Fighting climate change:

  Fighting climate change

  Policy available on request
• Covid-19 recovery:

  Covid-19 recovery

  Policy available on request
• Tackling economic inequality:

  Tackling economic inequality

  Policy available on request
• Equal opportunity:

  Equal opportunity

  Policy available on request
• Wellbeing:

  Wellbeing

  Policy available on request

Pricing

• Price: £12,000 to £600,000 a licence a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Free trial is available on request based on agreed terms.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

• Modern Slavery statement

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adam@metadataworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.