BARKER ASSOCIATES (ESSEX) LIMITED

Total Estate Energy and Asset Management

The service collects all types of asset condition and compliance data via a mobile app. From this automated reports and dynamic business intelligence dashboards are produced accessible via the cloud that enables interactive analytics to be undertaken to optimise capital and maintenance investment decisions at block, building and estate level.

Features

• Customisable templates to collect data via mobile tablet.
• Real time utility monitoring tools
• Automated reports that are customisable
• Portfolio level reporting on estate condition and compliance
• Benchmarking reports on operational effectiveness
• Business Intelligence tools for analytics and capital investment planning
• Condition and Health and Safety compliance survey inspections and reports
• Provision of legal and H&S policy documentation with compliance monitoring
• 5 to 25 year lifecycle analysis updated as work completed.
• Creation of procurement packages from portfolio analystics

Benefits

• Gain a full understanding of your property portfolio
• Better manage lifecycle risk and optimise available funding
• Reduce the cost of surveys and maintaining property data
• Better oversight of all HSE compliancy issues across your estate
• Deliving savings from aggregated procurement packaging
• Improve chances of evidencing need for new government funding
• Reduce energy usage and waste
• Standardise and make more accessible property reporting across whole estate
• Benchmark your operational cost effectiveness with other service providers
• Ensure staff have uptodate statutory policies available in real time

£4,800 a licence a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jcoyles@barker-associates.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

703928130934069

Contact

Jonathan Coyles
07730436031
jcoyles@barker-associates.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: None

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Support via email is available form 08:00 to 18:00 Monday to Friday
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Single support level - 1 hr from 8am to 6pm Monday to Friday with individual specified account manager.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We have a three stage process to client engagement: Enable | during the initial client engagement we will have hopefully gained a detailed understanding of our clients requirements and the project initiation phase will ensure we enable our clients to understand what is possible with the solutions they have purchased form us. We will agree the collection and reporting tools they initially require to support there day to day operational requirements and take their data and embed it in our collection and dashoarding tools. Empower | once the raw client data is live we will support the client with a bespoke training plan to ensure they are empowered to use the tools we have provided . This usually takes the form of one to one and group training at client sites as we have found face to face training is more empowering than online training. Engage | we have found it essential to regularly engage with our clients to ensure that their questions are answered and support is provided so the full benefits of our solutions are employed. We therefore schedule monthly appointments with our clients.
• Service documentation: No
• End-of-contract data extraction: Data is provide to clients at the end of the contract in an excel compatible format at no cost if requested in 30 days of the contract expiring.
• End-of-contract process: At the end of the contract all user accounts will be deactivated within 4 hours and deleted within 48 hours. When the contract ends we will provide the data to clients in an excel format if requested during the first 30 days from the termination of the contract free of charge. At the end of the 30 days the data will be archived for a 12 month period; if the data is requested

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Data collection from surveys undertaken on mobile devices. Reporting of data on desktop but also accessible on mobile.
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: At the moment our approach to using the REST API has been on a client specific basis and as such we have not placed any limitations on what a client can do.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: We recognize the importance of user customisation to increase the adoption, knowledge sharing, and value discovery across individual public sector markets as shown in our School Benchmarking Service. We are able to offer a range of user personalisation from simple aspects of the solution such as client and user specific branding to the development of data capture solution and dashboard to support client specific key performance indicators. The customisation would normally be defined during the on boarding process but can be added at any point during the client relationship. Clients can develop there data collection templates and dashboards using excel and power bi templates which we provide; these however will be deployed to our cloud based solutions by our team in our standard service offering. In our bespoke offering clients are able to deploy templates and dashboards themselves however this will require further training and support.

Scaling

• Independence of resources: We closely monitor the service performance of the client solutions we put in place and the use of the Microsoft Azure server platform allows us to scale the solution to meet client demand almost instantaneously.

Analytics

• Service usage metrics: Yes
• Metrics types: We are able to monitor and report on user access and if they have completed the tasks allocated to them. Reports are available by user and by client.
• Reporting types: Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Services built around a range of third party software

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v3.0
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: We have a standard set of dashboards which allow users to export data in the form or excel tables and pdf reports
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The solution is hosted on the Microsoft Azure platform and as such we are able to offer availability of 99.99%. Where we do not meet that availability we will offer clients a 25% credit on the daily charge
• Approach to resilience: The resilience of our solution is provide though our investment in the Microsoft Azure platform on which our solution are built.
• Outage reporting: Any outage issues will be reported to clients by email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management and support channels is limited by the permissions layers we apply to users. Currently only two members of our team are able to change user permission and have access to the management interface.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: 2-factor authentication

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI Certificate IS671379
• ISO/IEC 27001 accreditation date: 23/02/2018
• What the ISO/IEC 27001 doesn’t cover: The certification covers all our client facing services and our internal use of hardware and software.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our Information Security Policy has six distinct strands: Information | Information is valuable; classifying information as ordinary, confidential, restricted and personal enables us to better protect it. Ordinary being in the public domain restricted and personal being confidential to our clients, partners or staff. Encryption | a powerful data security tool, deployed on all devices, we also ensure devices can be remotely wiped. Passwords | Nothing guarantees password security. Staff are advised never to share passwords, ensure it is easy to remember but difficult to guess. It must contain upper and lower case letters, numbers and symbols and are changed every quarter. Software | we ensure all software is industry standard, with robust update schedules. Only using Microsoft, Apple, Adobe and Norton software, with apps only procured from Apple’s App store. Cloud | as providers of cloud services we treat security with utmost importance and have followed Microsoft’s advice to the letter deploying appropriate multi factor authentication and additional security. Hardware | hardware is configured to lock 3 minutes after last use, staff are advised to lock computers when away from them. Cloud services removed the need to transfer data via media as such we restrict external media access.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: We have a clear change management process developed with our development team who utilise a sandbox environment to test any solution before deployment. The six-step process is as follows: Identify | what is the change required? Define | what does this change mean for the current solution, security and services? Develop | how will the change be delivered, what will it look like and how much will it cost? Approve | Director approval of change Deploy | technical lead deploys solution to sandbox solution for approval Review | Director and technical lead review prior to deployment in live environment
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: We utilise the inbuilt protection offered by the Microsoft Azure platform to protect our cloud offering, which provides: Antimalware | protecting our cloud services, virtual machines, and Windows clients helping identify and remove viruses, spyware, and other malicious software, it also provides real-time protection, on-demand scanning, basic configuration management, and monitoring. Denial-of-service defences | protecting our servers against attacks using multiple machines trying to flood the resources of our servers. Advanced Threat Analytics | technology monitoring normal networks, systems, and users usage patterns, and employs machine learning to flag abnormal behaviour. Updates and patches are therefore managed by Microsoft.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Our servers run on the Microsoft Azure infrastructure, and uses the threat management protections that are built into Azure. Azure Security Center provides a centralized portal from which we secure our Azure deployments and prevent, detect, respond to threats, and increase visibility into the security of our Azure resources. The Azure Security Center also provides focused security recommendations and rapid deployment of integrated partner technologies. It uses behavioral analytics and machine learning for effective threat detection and helps you build an attack timeline for faster remediation. This means that we are able to resolve issue in under 24 hours
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: We do not have pre defined process at this stage for the bespoke solution however as we our servers run on the Microsoft Azure infrastructure, and uses the incident management tools that are built into Azure platform. This means that we are able to resolve issue in under 24 hours and reports are provide to end users vis email.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  We are focused on supporting the public sector decarbonize its estates we are working with organisations such as the Confederation of Schools Trust and Ashden to help schools get to Net Zero by 2030 rather than 2050.; ; To date we have support a number of schools achieve the government 2035 target for electricity decarbonisation in 2020

Pricing

• Price: £4,800 a licence a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We provide a demo site of outcomes and will undertake pilots with existing survey data

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jcoyles@barker-associates.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.