Idox Software Limited

Land and Conservation Management System (CMSi) - an Exegesis solution

CMSi is the software supported approach to management of land, property and assets that have conservation and amenity value. CMSi is used by public and private sector organisations including several government agencies in the UK and overseas such as Natural England, Natural Resources Wales and local authorities.

Features

• Manage sites for terrestrial and marine ecology, habitats and species
• Integrate information on tenure, assets, agreements, rights, contacts and buildings
• Suitable for statutory designated sites: SAC, SPA, RAMSAR, NNR, SSSI
• Suitable for local sites with no designation, including amenity sites
• Configurable plan structure and reporting, including graphs, maps and photographs
• Casework recording functionality, including monitoring and objective and target setting
• Internal mapping tools or integrates with ArcGIS, MapInfo or QGIS
• Built in species recording capabilities, with complete biodiversity recording extension
• Data export routines to PDF, Word, Excel, Access and XML
• Secure access for external usage and external publishing capabilities

Benefits

• Dynamic, continuously updated adaptive management plans with a logical structure
• Evidence-based audit trail of decisions made and management undertaken
• Ensures well-planned, evidence-based, objective and rational site management
• Fully supports conservation objectives and standard status monitoring techniques
• Integrates information from all aspects of site management
• Integrates with your GI data: vector/raster, point/polyline/polygon
• Share projects, plans and best practice with stakeholders and partners
• Upgradeable: new functionality developed by consortium members available to all
• Experienced support staff with technical and conservation knowledge
• Flexible scalable hosting arrangements, including Azure; secure backup and recovery

£116.23 a unit a year

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

496272253071589

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
frameworks@idoxgroup.com

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Private cloud
  • Hybrid cloud
• Service constraints: None.
• System requirements:
  • Remote Desktop Client
  • Internet connectivity
  • 1024x768 or greater screen
  • Keyboard recommended
  • Mouse recommended

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response within 24 hours, Monday to Friday during business hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: MATS (Maintenance and Technical Support) is provided for all clients at a single level, and includes direct access to our technical consultants and engineers. Technical Support constitutes assistance in solving any problems encountered by users in operating or configuring the supplied software. Costs depend on number of licences and which modules are licensed.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide training on-site or at our own training suite. We also deliver webinars and have online help pages.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Data is supplied as SQL Server database backup plus zipped folders/files.
• End-of-contract process: Decommissioning infrastructure and systems is undertaken for no charge within the contract. Preparation and supply of data may be subject to additional charges for time and materials.

Using the service

• Web browser interface: No
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: The CMSi API is a web services interface onto the main CMSi application and database. Typically, the API is used by development teams allowing web applications, mobile apps and other services to read and write information to the backend CMSi database. The API itself is a module sold as part of the CMSi system, but the main 'user' of the API is typically other developers/systems allowing them to access CMSi data.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: CMSi can be customised to meet the organisation's own working practices. It has translation functions so can be used in any language requiring no specialist technical skills. All terminology and labels can be changed to match client preferences. CMSi allows an organisation to create different user roles (e.g. ranger, site manager, ecologist, etc) and configure the system so that users only see the parts of the system they need. It includes a ‘My CMSi’ section which can be customised to give different users easy access directly into the parts of the system, activities and reports that they use most.

Scaling

• Independence of resources: Generally we only run one user on a Virtual Machine which allows us to ring fence appropriate resources for the Virtual Machine. We also have a number of monitoring systems in place to monitor both the response times of the systems (e.g. a web request) and also the performance of the hardware - both virtual and physical. These systems send out alerts if they detect a problem.

Analytics

• Service usage metrics: Yes
• Metrics types: User actions within CMSi are comprehensively logged and the logs are visible to System Administrators (and to a lesser extent to all users), and from these logs it is possible to see levels of usage of the overall system and its modules, plus activity of each user. Uses of the API are also logged. User activity on the hosted server is logged and available on request.
• Reporting types:
  • API access
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: There are several ways of exporting data. All modules permit advanced filtering of subsets of records and filtered sets can be exported to Microsoft Access and Excel formats where the schema and content of the exports can be extended/configured by the System Administrator. Reports can be exported to HTML, RTF, PDF and Excel formats. System Administrators can also export data directly from database tables to a wide range of formats include XML, CSV, and Microsoft Access/Excel and GIS formats using spatial tools.
• Data export formats: Other
• Other data export formats:
  • XLS
  • RTF
  • PDF
  • HTML
  • Microsoft Word
  • Microsoft Access mdb
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • ESRI Shapefile
  • MapInfo TAB
  • Microsoft Excel
  • WMS
  • Microsoft Word

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection between networks: We generally don't allow clients networks to connect to ours. Access is either via web browsers or SSL gateway. New client server setups would all support TLS 1.2 providing the client was capable. We also lock to client IPs wherever possible.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Each customer has separate logical access. Each administrative account on a customer VM has separate credential sets. In the case of RDWeb services, each customer has a separate (non-federated and not a single forest) ADDS instance.

Availability and resilience

• Guaranteed availability: Availability (other than for scheduled maintenance) is guaranteed to be better than 99.9%.
• Approach to resilience: Power and internet feeds are duplicated provided to us by the datacentre. We run dual firewalls in an Active / Passive setup. We have duplicate HyperV servers so a Virtual Machine could quickly be started on another server in the event of hardware failure of the Hyper V server. Virtual Machine storage is backed up to separated storage. We have Hyper V replica SQL Server. We run high availability S2D cluster. We have 2 core switches in IRF.
• Outage reporting: We report on an (independently hosted!) status page also available as RSS feed. We can also arrange for emails from our various monitoring systems to be sent direct to clients if they wish.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces and support channels are restricted to authenticated users (username and password over https).
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Username or password
  • Other
• Description of management access authentication: We use restricted IP addresses for all management access.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: QMS International
• ISO/IEC 27001 accreditation date: 27/05/2021
• What the ISO/IEC 27001 doesn’t cover: Certification covers all functions and services of Idox Software Ltd.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: All divisions of Idox, follow the ISO27001 accredited Information Security Management System of Idox Software Ltd. ; This ISMS covers all business functions including but not limited to, information systems, networks, physical environment, incident/threat management, project & contract management and personnel management. Information security awareness training is conducted to ensure policies are communicated and ongoing annual internal reviews and auditing is conducted to ensure processes are followed. The system and controls are also externally verified an certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the information security manager, the appropriate head of business and a board representative.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: IT change management processes are carried out using Change Requests and records are maintained within the Change Management system. All concerned parties are informed of the status of the request as changes or progress is made as applicable.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network/bandwidth utilisation and unusual server/network/perimeter activity. The alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Incidents or suspected incidents are raised to internal service desk and reviewed by the information security manager. They are allocated a risk reference, entered into the information security risk log and tracked until closure. In the case of major incidents, an Incident Response Team will be formed as required with key personal required to investigate and take necessary actions, and a major incident report will be produced.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  Idox has adopted the metrics set out in the 3 scopes of the Greenhouse Gas Protocol. We have a target to achieve net zero carbon emissions for these scopes by 2040 by eliminating, reducing or offsetting carbon emissions.; ; In Scope 1: we will eliminate all equipment in offices which produce direct emissions and replace these with energy efficient, electric alternatives. We will eliminate emissions from company owned vehicles by replacing these with electric alternatives. ; ; In Scope 2: we will reduce electricity usage through Energy Savings Opportunity Scheme audits and will eliminate the purchase of electricity which does not come from renewable sources. ; ; In Scope 3: we will reduce business travel through remote working and on line collaboration tools. We will eliminate travel by private vehicles which produce emissions and we will offset emissions from public transport used for business travel and from hotel stays either by choosing operators offering direct offset or by engaging in a compensating carbon offset programme. We will eliminate waste by removing single use plastic products and reduce waste from our offices by ensuring effective recycling of waste, including paper and will offset any non-recyclable waste by engaging in a compensating carbon offset programme. We will eliminate waste from surplus equipment by passing this on for re-use in support of our social contribution wherever possible, where this is not possible we will reduce waste by fully recycling the equipment and we will offset residual emissions in a compensating carbon offset programme.; ; We are strengthening Idox’s performance as an all-round responsible business that makes a valuable contribution to society, has good governance embedded in its culture and processes, and is on target to achieve net zero carbon emissions.; ; Our gross GHG emissions of CO2 (tCO 2e) are reported yearly in our published Annual Report.
• Tackling economic inequality:

  Tackling economic inequality

  Idox is focused on building a sustainable business that will benefit its customers, employees, shareholders, wider society and the environment. We take our environmental, social and governance (ESG) responsibilities very seriously. We have implemented substantial changes across our business to create a more diverse, transparent and sustainable business. In future, we will do more to measure and drive our performance. ; ; How we will deliver social and economic benefits to Buyers and the wider community: We will address the social value requirements and the delivery of social and economic benefits to Buyers and their communities on a contract by contract basis. We understand that social value forms part of contract commitments to our public sector Buyers. We work collaboratively with customers to support the specific targets and outcomes that are a priority with their boundaries. ; ; Examples of social value we can deliver to our Buyers: We can: facilitate skills workshops; make financial donations to fund places on training courses, fund community projects that work to tackle economic inequality, reduce the digital skills gap and create training opportunities for those who face barriers to employment and/or who are located in deprived areas, and support educational attainment; donate used IT equipment to VCSEs to support people in deprived areas; provide work experience placements in some localities. ; ; We have a robust social value process and methodology which includes an annual review meeting where we can review our social value delivery performance with the Buyer. This annual review ensures we can understand the customer’s priorities and set appropriate targets for the year ahead, and continuously improve how we deliver social value, based on customer and community feedback and collaboration.
• Equal opportunity:

  Equal opportunity

  Diversity, Equality and Inclusion (DEI) are more than just words for us. They’re the hard-and-fast principles guiding how we build our teams, cultivate leaders and create a company that’s the right fit for every person inside of it. Our values and culture underpin our commitment to putting our people first. ; ; At Idox we foster both a top-down and grassroots approach where we strive to create workplaces that reflect the communities we serve, and where everyone feels empowered to bring their full, authentic self to work.; ; Our guidance to our employees and suppliers concerned with recruitment, training, promotion and service delivery is outlined in our Equality and Diversity Policy which covers our responsibilities under the Equalities Act and how we deliver them. We are happy to provide a full copy of the policy upon request.; ; Idox has established clear goals to get to a gender balanced workforce by 2027. In order to tackle the issue of under representation in leadership, Idox is particularly focused on increasing the proportion of women in the people-leader tiers of the business to both correlate with the gender ratio of the company in general and to support the overall reduction of the gender pay gap specifically. ; ; Our policies and initiatives that support Diversity, Equality and Inclusion include: Flexible working policy; Family friendly policies; Idox Elevate - a programme sponsored by Idox plc board members, committed to championing a truly inclusive culture; Pay Gap reporting - We publish our gender pay gap report annually on our website; Fair Pay - Idox is an accredited Living Wage Employer.

Pricing

• Price: £116.23 a unit a year
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.