Kapish Services Pty Ltd

Content Manager Cloud

Content Manager Cloud is a cloud-based solution, delivering OpenText enterprise content management system Content Manager as a fully managed and hosted service.

Content Manager Cloud brings corporate knowledge into a single, reliable, secure cloud which can be accessed anywhere, anytime, and from any device.

Features

• Document and Records Management
• Document Workflow and Collaboration
• Advanced Classification and Search
• Physical Records Management
• Retention and Disposal Management
• Secure Content Capture and Management
• Flexible API for Integration with Enterprise Systems
• Records and Information Governance

Benefits

• Centralised Document Management
• Integration with Business Applications
• Records Management Governance Compliance
• Enhanced Collaboration
• Enhanced Information Security
• Improved Document Management and Workflow

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@kapish.com.au. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

750566824576312

Contact

Colin Anderson
+61409 350 258
sales@kapish.com.au

About your service

• Service categories:

  Applications

  Content workflow and management

  • Document

  Content services

  • Enterprise Content Management Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Please refer to the "Content Manager Cloud - Service Specification"
• System requirements: Active license for OpenText Content Manager

User support

• Email or online ticketing support: Yes
• Support response times: Please refer to the "Content Manager Cloud - Service Specification" which provides detailed Service Level Agreements for responses to support questions.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Please refer to the "Content Manager Cloud - Service Specification" document for information about support levels.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Kapish provides a range of training options and user documentation options.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Upon termination or expiration of the Subscription, the Subscriber may request the export of all Subscriber Data. The Subscriber acknowledges that the complexity and cost of exporting the Subscriber Data cannot be fixed in advance and that the cost of doing so will be quantified at the time a transition plan is prepared, but Kapish agrees that the cost to export the Subscriber Data in Kapish’s standard format will not exceed 5 times the Subscriber’s monthly Access Fee as of the effective date of termination.
• End-of-contract process: Upon termination or expiration of the Subscription, the Subscriber may request the export of all Subscriber Data. The Subscriber acknowledges that the complexity and cost of exporting the Subscriber Data cannot be fixed in advance and that the cost of doing so will be quantified at the time a transition plan is prepared, but Kapish agrees that the cost to export the Subscriber Data in Kapish’s standard format will not exceed 5 times the Subscriber’s monthly Access Fee as of the effective date of termination.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile application provides most common user tasks with the desktop service providing all features.
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: All functionality that is available through the end user / client application is available via the API.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The client applications provide authorized users with the ability to fully customise the solution features to meet their records compliance obligations.

Scaling

• Independence of resources: Content Manager Cloud uses a single tenant deployment with no service co-mingling. This guarantees that users aren’t affected by the demand other users are placing on the service.

Analytics

• Service usage metrics: Yes
• Metrics types: Regular Service Review Meetings are held to review service quality, and to provide feedback on improvements required. This includes reporting on support tickets logged, response / resolution times and SLA performance.; ; The Customer can also access usage metrics via an API to feed real-time-dashboards and other reporting tasks using common reporting and visualisation tools such as Microsoft Power Bi.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: The Content Manager software enables an authorised user to import and export data to and from your Content Manager dataset:; ; Content Manager DataPort is an additional (no cost) module to Content Manager that you can access from the Content Manager client.; ; The Content Manager DataPort Project editor is the primary user interface for DataPort. This is the editor that is used to create and configure Import and Export project files which defines the Import or Export requirements.; ; To Export data, the user can process a preconfigured Export Project file using the Content Manager DataPort Engine.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Tab Delimited
• Data import formats:
  • CSV
  • Other
• Other data import formats: Tab Delimited

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.95% Availability.; ; Solution Availability is defined as the Content Manager Cloud, Content Manager production application being available for access and use by the Customer and its Authorized Users over the Internet. ; ; Kapish will provide the Customer with access to the Content Manager Cloud, Content Manager production application on a twenty-four hour, seven days a week (24 x 7) basis.; ; In any billing month where the availability of the Service falls below the Service Levels, Service Credits will be applied to the following billing month’s invoice.
• Approach to resilience: The Content Manager Cloud solution is hosted on the Microsoft Azure platform and uses the Region Pair or Zonal disaster recovery model based on the purchased service Tier. If one of the regions or zones were to experience a disaster or failure, then the services in that region will automatically failover to that region’s secondary region in the pair. ; ; The Content Manager Cloud platform is built on and takes advantage of the resilience and elastic scale of the Azure public cloud offering uptime SLAs up to 99.95%. The solution is deployed with redundancy built-in at every layer of the solution to avoid any single point of failure with the high availability configuration capable of handling baseline load. Each solution component in every tier is accessed via a load balancer which is configured with appropriate health probes to detect any failure events in the backend pool of servers. Health probe failures will be automatically alerted to the service desk for triage and remediation.; ; Please refer to the Microsoft Service Trust portal for an extensive exploration of the physical controls and certifications applicable to the Azure Service.
• Outage reporting: Kapish monitors Content Manager Cloud components 24 x 7 x 365 for availability. Kapish uses a centralized notification system to deliver proactive communications about application changes, outages, and scheduled maintenance. ; ; Where applicable, alerts and notifications are available to the Customer via email to the Customer's nominated contact.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: The solution is operated according to the principle of least privilege where staff are granted the minimum level of access required to perform the functions of their roles. All team members are direct employees of Kapish, have undergone nationally coordinated criminal history checks.; ; Access control mechanisms are implemented as part of the hosted managed services such teams operating the solution have no access to customer data by default. Technical controls and approval processes to enable access to customer data ensure that data is used only for its intended purpose.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: Infosec Registered Assessors Program (IRAP) - Information Security Manual (ISM) for Protective Security Policy Framework (PSPF) to the PROTECTED level.
• Information security policies and processes: Kapish maintains a full suite of policies and processes as part of its ISO27001 compliant Information Security Management System including:; ; • Security Incident Response; • Data Protection; • Network Security; • Cryptography; • Cyber Security; • Acceptable Use; • Patch and Vulnerability Management; • Privacy Management; • Secure Development; • Supplier Risk Management; • System Security Management
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: As part of Kapish’s ISO27001 certified Information Security Management System, Kapish maintains a Change Management policy document. This document prescribes the processes for requesting, evaluating, approving, communicating, implementing and monitoring all change is managed through a Change Advisory Board (CAB) process. The Security Operations Team forms part of the CAB and is required to review and approve all changes with a view to maintaining or improving the system security posture. ; Kapish has made significant investment in deployment and operational automation with scripts managed under source control. All changes to CMC automation are managed through the change control process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: As part of Kapish’s ISO27001 certified Information Security Management System, Kapish maintains a Vulnerability and Patch Management policy document. One practical manifestation of this policy is the use of centrally managed, agent-based vulnerability scanning to ensure the ongoing alignment of environments with the target hardening state and patch level compliance for the environment. The automated vulnerability and compliance tooling is used to ensure continuous compliance, with alert raised and logged for compliance correction to ensure ongoing system security and stability.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Content Manager Cloud has a multi-layered approach to Intrusion Detection (IDS) and Intrusion Prevention (IPS). To perform Protocol Aware IPS we employ a next-generation firewall appliance with a customised ruleset for Content Manager. For IDS we forward all traffic logs to our centralised Security Information and Event Management (SIEM) system for analysis by our Security Operations Centre.; ; Content Manager Cloud endpoints are equipped with Endpoint Detection and Response (EDR) systems which performs both signature-based scanning and application behavioural monitoring for advanced malware detection. The results of any detections by the EDR system are continuously monitored by our Security Operations Centre.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: As part of Kapish’s ISO27001 certified Information Security Management System, Kapish maintains a Cyber Security Incident Management Policy that prescribes the arrangements for handling security incidents including: ; ● Roles and Responsibilities ; ● Breach Identification ; ● Breach Classification ; ● Loss Containment ; ● Threat Eradication ; ● Remediation, Restoration & Recovery ; ● Review & Learnings.; Under the direction of the Chief Information Security Officer, the policy is tested as part of a holistic annually security assessment. The security assessment is conducted by an independent third-party consulting group. The assessment is followed by a report which covers key findings, recommendations and lessons learned.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 7.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Intertek SAI Global
• ISO/IEC 27001 accreditation date: Monday 26 November 2018
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: IRAP Assessed for ISM-PROTECTED

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@kapish.com.au. Tell them what format you need. It will help if you say what assistive technology you use.