INFOSHARE+ LIMITED

MasterGov Listed Building Register

The Listed Building Register module allows the Council to record details of the listing along with key asset information, date listed, grade, English Heritage reference number and designation. Site visits can be recorded along with photographs and other files. The module benefits from GIS integration and links to other modules.

Features

• Full application life cycle
• Integrated workflow
• GIS and Gazetteer integration
• Fully integrated with other modules in MasterGov suite
• Mobile and remote working
• Online public facing components
• Industry standard technologies
• Built-in Document Management (DMS)
• Auditing tools
• Real time reporting (including statutory)

Benefits

• Intuitive interface
• Device agnostic
• APIs available
• Microsoft Azure hosting
• Single source of truth
• Self-service online public interface
• Reduces internal IT costs
• Kept abreast of legislative changes
• Part of a suite of land & property software
• Developer led support putting customers first

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@def.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

514307665212902

Contact

Graeme Cooke
01915358400
enquiries@def.co.uk

About the service

• Service categories:
  • Applications
    • Content workflow and management
      • Capture
        • Capture
      • Document
        • Document
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Authentication uses Microsoft Entra ID only.
• System requirements: HTML5 compliant browser

User support

• Email or online ticketing support: Yes
• Support response times: Hours: Monday–Friday, 08:30–17:30 UK time (excluding UK Bank Holidays). Channels: Email, portal, telephone.; ; Priority - Description - Initial Response - Resolution Target; ---------------------------------------------------------------------------------------------------; Highest - Severe system malfunction - 4 hours - 8 hours; High - Blocking work - 4 hours - 16 hours; Medium - Workaround available - 16 hours - 80 hours; Low - Minor inconvenience - 40 hours - 240 hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: DEF operate a single support model.; ; DEF shall provide rectification of faults found in the Software. Faults shall be defined as deviations from the agreed specification. Where no specification pertains to a given identified fault, a discussion shall be entered between the authority and DEF where an agreement shall be reached on whether this is an enhancement or a fault.; ; The authority shall notify DEF of any problems found, using an agreed procedure. This shall involve the written logging of problems on a standard form. Any verbal notification (for example in urgent or out of hours cases) shall be confirmed in writing as soon as possible.; ; Should DEF become aware of faults affecting the operability of the installed Software, DEF undertakes to inform the authority as soon as possible, and to provide a resolution within the agreed timeframe for the identified faults consistent with the categorisation specified within this SLA. Faults that are identified but do not affect the operability of the software will be listed at the next maintenance release of the software that addresses these faults.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: DEF will deliver a show and tell session to all users initially to encourage buy in of the solution. Onsite admin training is provided via several workshop sessions to allow the customer to gain the skills required for customisation. Full end user training will be provided to all users ahead of go live.; ; Training will be delivered either in person at the customers premises or via Microsoft Teams.
• Service documentation: Yes
• Documentation formats: Other
• Other documentation formats: Online searchable Wiki
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the end of the contract DEF will provide the customer with a SQL Server BAK file and file extract of all associated documents from the DMS.
• End-of-contract process: At the end of the contract DEF will deliver data and associated documents back to the customer. Upon doing this all data documents held by DEF will be destroyed.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The MasterGov API, which is used by DEF's public facing functionality, has a series of pre-defined methods. These can be made available to customers and DEF can add additional methods as a chargeable service.
• API documentation: No
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customers can:; - add merge fields; - build templates for document production; - create custom fields; - add reports and dashboards; - add user roles; - update all drop down lists; - create workflow processes; - add layers to GIS; - create mobile working job templates; ; The above customisation is all managed within the MasterGov client without the need for IT skills.; ; System admin users would manage customisation.

Scaling

• Independence of resources: DEF operate a load balancing system with enough server resource to ensure that if all expected users were on a once there would be sufficient capacity.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data can be exported in a variety of formats using either the Query Builder or using MasterGov reporting (SSRS).
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • SQL Bak file
  • Shape file
  • Microsoft Excel
  • Microsoft Word
  • GeoPackage
  • XML
  • JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • SQL Server Bak file
  • Shape file
  • GeoPackage

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The solution has a guaranteed availability of 99.9%.
• Approach to resilience: The data centre is provided by Microsoft and this information is available on request.
• Outage reporting: DEF use email alerts to notify users of any outages.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces are restricted based upon permissions configured within the MasterGov system. Support channels are restricted on user ID and password. Access to the main system is controlled using Microsoft Entra ID.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: DEF has an Information Security & Data Protection Policy which details the policies and processes for the business. The policy document outlines the key processes and reporting channels. All staff have to sign to indicate that they have read and understand the policy. Any breach of the policy must be reported to a director. Any employee, or subcontractor, found to have breached the policy will be subject to disciplinary action.; ; The policy covers GDPR, sensitive personal data, information security, access requests and data security. The policy also covers the communication path for any losses of data.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: As the hosting platform is managed by Microsoft they manage changes to core infrastructure. DEF however manage changes to operating system updates. This is done on an agreed schedule with maintenance periods communicated to customers.; ; In terms of the DEF authored software, every change is logged in a source code management system and all changes detailed into comprehensive release notes which are sent to customers.; ; Only infrastructure changes impact security and each change is accessed on a case by case basis by our technical architects with, where applicable, input from Microsoft.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: DEF follow recommendations from Azure Security Centre on performing vulnerability assessments on the Azure virtual machines, container images, and SQL servers.; ; DEF use third-party solutions for performing vulnerability assessments on network devices and web applications. When conducting remote scans, DEF do not use a single, perpetual, administrative account. Credentials for the scan account are protected, monitored, and used only for vulnerability scanning.; ; DEF use Azure "Update Management" to ensure the most recent security updates are installed on Windows VMs. Although these are applied in schedule maintenance windows, DEF will provide urgent updates as required.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: DEF ingest logs via Azure Monitor to aggregate security data generated by endpoint devices, network resources, and other security systems. Within Azure Monitor, DEF use Log Analytics Workspace(s) to query and perform analytics, and use Azure Storage Accounts for long-term/archival storage.; ; DEF enable Diagnostic Settings on Azure resources for access to audit, security, and diagnostic logs. Activity logs, which are automatically available, include event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.; ; If the compute resource is owned by Microsoft, then Microsoft is responsible for monitoring it.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Security Centre assigns a severity to each alert to help prioritize which alerts should be investigated first. The severity is based on how confident Security Centre is in the finding or the analytic used to issue the alert as well as the confidence level that there was malicious intent behind the activity that led to the alert.; ; Security incident contact information will be used by Microsoft to contact DEF if the Microsoft Security Response Centre (MSRC) discovers that the data has been accessed by an unlawful or unauthorized party. Review incidents after the fact to ensure that issues are resolved.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Basic access to a demo instance of MasterGov to allow customers to check communications and evaluate the product.; ; No data migration, training or other DEF services are provided.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 5%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Schellman Compliance LLC
• ISO/IEC 27001 accreditation date: Wednesday 11 June 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: E32b6e28-bc57-492d-a953-3f91c5c0cc80
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: D44b4905-b220-4351-ace0-4ff5298adbb0
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@def.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.