IDOX SOFTWARE LTD

Countryside Access Management System (CAMS) - an Exegesis solution from Idox Geospatial

The Countryside Access Management System (CAMS) is a complete database and map management system designed to simplify the task of maintaining National Trails, Cycle Routes, Rights of Way, promoted paths and open access land. Already used by over 70 local authorities and other organisations throughout the UK, and The Ramblers.

Features

• Create detailed path inventories and maintain the definitive map
• Manage assets, furniture, surface details, maintenance, enquiries and contractors
• Record access basis, ownership, provenance, issues and Section 31(6) Deposits
• Add condition survey data to path and open access land
• Plan inspection and regular maintenance regimes, plus fault reporting management
• Plan projects to assist with workload and volunteer management
• Link records to geographical information, photographs and documents
• Full path mapping capabilities, integrating with ArcGIS, MapInfo or QGIS
• Legal module for PPOs, DMOs, cases, consultation, plans, notices, orders
• Design conforms with Public Rights of Way (PROW) standard BS7666

Benefits

• One stop shop for all PROW and access data management
• Easily report on network state, work done and pending costs
• Use data to inform stakeholders and other interest groups
• Extensible structure to suit customers with different goals and expectations
• Integrate with external systems, allowing easy synchronisation
• Experienced support staff with technical and public access knowledge
• Free interactive training webinars covering all aspects of CAMS
• Fully mature product with a large active user group
• Guide future development and network at CAMS user group meetings
• Flexible scalable hosting arrangements, including Azure; secure backup and recovery

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

879099252116783

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Relational Database Management Systems
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: None
• System requirements:
  • Remote Desktop Client
  • Internet connectivity
  • Modern browser
  • 1024x768 or greater screen
  • Keyboard recommended
  • Mouse recommended

User support

• Email or online ticketing support: Yes
• Support response times: Response within 1 hour, Monday to Friday during business hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: MATS (Maintenance and Technical Support) is provided for all clients at a single level, and includes direct access to our technical consultants and engineers. Technical Support constitutes assistance in solving any problems encountered by users in operating or configuring the supplied software. Costs depend on number of licences and which modules are licensed.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide training on-site or at our own training suite. We provide comprehensive online documentation. We provide technical support for use and configuration of the application.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Data is supplied as SQL Server database backup plus zipped folders/files, available for download via secure FTP.
• End-of-contract process: Data is supplied as described above. The service is soft-ceased, then removed completely after a suitable period (e.g. 3 months). Additional work to supply different data formats or data transfer mechanism may be charged.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: CAMS Mobile allows data management without a permanent connection to the data repository. CAMS Mobile provides a reduced functionality compared to Desktop.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Forms over data with digital assets and interactive mapping. Data and geospatial APIs for systems interoperability.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: None
• API: Yes
• What users can and can't do using the API: The API allows creation and editing of data in CAMS including textual, map and image data. It allows the application to integrate with other applications. Submitted data is held in holding tables giving users control over which data is brought into the definitive dataset. The API allows CAMS data to be accessed and used in other applications.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: CAMS is a highly customisable system. Via configuration files and system tables in the database administrative users are able to control which components are available, user permissions throughout the application and how data is presented to the users. Configuration is undertaken by trained system administrators.

Scaling

• Independence of resources: Generally we host each customer on a separate Virtual Machine environment, which allows us to ring fence appropriate resources and ensure isolation. We also have monitoring systems in place for the loading and response times of the environments, sending out alerts if problems are detected.

Analytics

• Service usage metrics: Yes
• Metrics types: The application maintains an audit of data editing.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Export tools are provided as part of the application.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XML
  • Shapefile
  • PDF
  • GML
  • GeoJSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • ESRI Shapefile
  • MapInfo TAB
  • ESRI Geodatabases
  • Excel
  • DBF
  • Geopackage

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: The application is accessed over HTTPS. Data is encrypted in transit using TLS 1.3 encryption where possible with a fallback to TLS 1.2 where TLS 1.3 is not supported. Data is encrypted at rest with AES-256GCM. We also enable i.p. restriction and VPN access if required.
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability (other than for scheduled maintenance) is guaranteed to be better than 99.9%.
• Approach to resilience: Power and internet feeds are duplicated provided to us by the datacentre. We run dual firewalls in an Active / Passive setup. We have duplicate HyperV servers so a Virtual Machine could quickly be started on another server in the event of hardware failure of the Hyper V server. Virtual Machine storage is backed up to separated storage. We have Hyper V replica SQL Server. We run high availability S2D cluster. We have 2 core switches in IRF.
• Outage reporting: We provide an independently hosted status page, with notifications/alerts also available as RSS feed. Customers have own status dashboards, and receive emails from our various monitoring systems.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces and support channels are restricted to authenticated users (username and password over https), with IP restrictions and VPN for access, and MFA.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Username and strong password plus MFA. We use restricted IP addresses for all management access.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: All divisions of Idox follow the ISO27001 accredited Information Security Management System of Idox Software Ltd. ; This ISMS covers all business functions including but not limited to, information systems, networks, physical environment, incident/threat management, project & contract management and personnel management. Information security awareness training is conducted to ensure policies are communicated and ongoing annual internal reviews and auditing is conducted to ensure processes are followed. The system and controls are also externally verified an certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the information security manager, the appropriate head of business and a board representative.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: IT change management processes are carried out using Change Requests and records are maintained within the Change Management system. All concerned parties are informed of the status of the request as changes or progress is made as applicable.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network/bandwidth utilisation and unusual server/network/perimeter activity. The alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incidents or suspected incidents are raised to internal service desk and reviewed by the information security manager. They are allocated a risk reference, entered into the information security risk log and tracked until closure. In the case of major incidents, an Incident Response Team will be formed as required with key personal required to investigate and take necessary actions, and a major incident report will be produced.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.