Creative Networks

Door Access Control

Door Access Control regulates entry to buildings using key cards, biometrics, or PIN codes, bolstering security by limiting unauthorised access. It monitors and records entry and exit activity for auditing purposes.

Features

• Tightened security: Multi-factor authentication.
• Tailored access levels for personnel.
• Live monitoring of entry/exit activities.
• Smooth integration with existing systems.
• Flexible remote access control management.
• Automated alerts for dubious activities.
• Scalable solutions for any premises size.
• User-friendly interface for simple administration.
• Backup power options for uninterrupted operation.
• Detailed reporting for security analysis.

Benefits

• Enhanced security ensures safer workplaces, reducing unauthorised access risks.
• Efficient access management enhances staff productivity and workflow.
• Real-time monitoring enables proactive security measures, increasing situational awareness.
• Integration simplifies operations, reducing complexity and errors.
• Remote management facilitates flexible access control from any location.
• Automated alerts minimise response time to security breaches.
• Scalable solutions adapt to business growth and changing needs.
• User-friendly interface simplifies administration, saving time and resources.
• Backup power options ensure uninterrupted security operations.
• Comprehensive reporting aids compliance and decision-making processes.

£1,000.00 to £1,400.00 a unit

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at aj@creative-n.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

883084402517746

Contact

Azeem Javed
03303337337
aj@creative-n.com

Service scope

• Service constraints: Buyers should consider the service's constraints, including compatibility with specific hardware or software, scheduled maintenance windows, potential feature limitations, internet dependency for remote access, regulatory compliance requirements, possible downtime during updates, support limitations for legacy systems, vendor-specific terms, latency concerns based on location, and customisation limitations.
• System requirements:
  • Compatible hardware and OS for installation.
  • Adequate network bandwidth for data transmission.
  • Internet or network connectivity for remote management.
  • Required software licenses or subscriptions.
  • Compatibility with specific browsers or applications.
  • Sufficient storage capacity for data retention.
  • Integration with antivirus technology.
  • Compliance with data protection regulations.
  • Resources for ongoing maintenance and support.
  • Compatibility with virtualization or containerization platforms.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Support response times - 08:30 - 18:00 Weekdays, excluding Bank Holidays. Out of hours support available where necessary. 30 minutes to 8 hour response dependent on priority call, P1 - 30 mins, P2 - 1 hour, P3 - 4 hours, and P4 - 8 hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 A
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 A
• Web chat accessibility testing: We have not conducted any testing of web chat accessibility with users employing assistive technology.
• Onsite support: Onsite support
• Support levels: End-user training can be provided at an ad hoc cost. We provide a UK based Service Desk for support. Out of hours support is available. Our helpdesk is made up of 1st, 2nd and 3rd Line technical expertise. A Technical Account Manager will be assigned as standard as a part of our standard and premium IT Support, see our pricing schedule and SFIA Rate Card for details.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We assist users in adopting the service through a variety of resources tailored to their needs. Our user documentation offers step-by-step guides, FAQs, and troubleshooting tips for independent learning. Additionally, we provide interactive online training sessions and webinars led by experienced instructors to guide users through setup and configuration processes effectively. For those preferring personalised assistance, optional onsite training sessions can be arranged to address specific organisational requirements. Our dedicated technical support team is readily available to assist users with any inquiries or challenges they may encounter, offering prompt resolution via email, phone, or online chat. With these resources and support channels in place, we aim to ensure a smooth onboarding experience and empower users to harness the full capabilities of the service for their communication needs.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Exported upon request. Contact the Support Helpdesk or Technical Account Manager.
• End-of-contract process: At the end of the contract services will continue on a rolling 30 day agreement until either party serves notice. If it is decided the client will exit, Creative Networks will assist in transitioning and migration of services ensuring continuity and a smooth handover. We will, where applicable deliver an Exit Plan which sets out the proposed methodology for achieving an orderly transition of Services on the expiry or termination of the contract. The Exit Plan will contain at minimum: Separate mechanisms for dealing with Ordinary Exit and Emergency Exit. The management structure to be employed during both transfer and cessation of the services and a detailed description of both the transfer and cessation processes, including a timetable. Document how the Services will transfer including details of the processes, documentation, data transfer, systems migration, security and the segregation of technology components. Specify the scope of the Termination Services that may be required and any charges that would be payable for the provision of such Termination Services and detail how such services would be provided. Provide a timetable and identify critical issues and set out the management structure to be put in place and employed during the Termination Assistance Period.

Using the service

• Web browser interface: Yes
• Using the web interface: Through the web interface, users can perform various tasks including service setup, making changes, monitoring and reporting, and integration with other systems. This involves configuring access control policies, defining user roles, modifying permissions, monitoring activity logs, generating reports, and setting up integrations via intuitive graphical interfaces. However, there are limitations to what users can do: certain administrative functions may only be accessible through alternative methods, access to features may be restricted based on user roles, and complex configurations may require additional technical expertise. Despite these limitations, the web interface provides a convenient and user-friendly way for users to manage the service, offering flexibility and accessibility for most common tasks related to service setup, configuration, and monitoring. Advanced users or administrators may need to supplement web interface functionalities with other tools or methods to perform more specialised or complex tasks.
• Web interface accessibility standard: WCAG 2.1 AA or EN 301 549
• Web interface accessibility testing: Creative Networks have not conducted any web interface testing with assistive technology users.
• API: Yes
• What users can and can't do using the API: Users can utilise the API to perform a range of tasks including service setup, changes to access control settings, user management, system configuration, integration with other applications, and automation of routine tasks. Through the API, users can dynamically create and configure access control policies, define user roles and permissions, and establish integration with external systems. They can make changes such as adding or removing users, modifying access levels, and updating security policies via API calls. Additionally, users can seamlessly integrate the service with other applications, facilitating data exchange and interoperability. Automation of tasks like user provisioning and security policy enforcement is also achievable using API endpoints. However, some administrative actions may not be available through the API, necessitating manual intervention through the service interface. Moreover, API usage might be constrained by factors like rate limits or access restrictions based on subscription tiers or service agreements. It's crucial for users to consider potential dependencies or impacts on integrated systems when making changes through the API, necessitating careful planning and testing to prevent disruptions.
• API automation tools:
  • Ansible
  • Chef
  • SaltStack
  • Terraform
  • Puppet
• API documentation: Yes
• API documentation formats: PDF
• Command line interface: Yes
• Command line interface compatibility:
  • Linux or Unix
  • Windows
  • MacOS
• Using the command line interface: Through the command line interface (CLI), users can set up the service, make changes to access control settings, monitor activities, and integrate with other systems. This involves executing commands to configure policies, define user roles, modify permissions, view logs, generate reports, and configure integrations. While the CLI provides flexibility and control, it may be less user-friendly for novice users due to its reliance on command syntax and parameters. Additionally, some graphical features available in the web interface may not be accessible through the CLI, limiting visibility for certain aspects of the service. Advanced configurations may also be more challenging to execute, requiring additional expertise. Despite these limitations, the CLI offers a powerful tool for efficient service management, particularly for users comfortable with command-line environments and seeking automation capabilities.

Scaling

• Scaling available: Yes
• Scaling type: Automatic
• Independence of resources: Suppliers guarantee user experience by designing scalable systems, employing load balancing, isolating resources, monitoring performance, and offering SLAs. These measures ensure fair access, prevent resource monopolisation, and maintain consistent performance even during peak demand.
• Usage notifications: Yes
• Usage reporting: Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
• Reporting types: Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: Less than once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Backup and recovery

• Backup and recovery: Yes
• Backup controls: Users control backups by specifying what data to backup, setting backup schedules, defining retention policies, and selecting backup methods. This includes backing up different items on different schedules, such as files, databases, or system snapshots, and retaining backups for specified periods. Advanced options may allow users to execute custom scripts or hooks for additional automation. These controls enable users to tailor backup strategies to their specific data protection needs, ensuring data integrity, compliance, and resilience against data loss.
• Datacentre setup: Single datacentre with multiple copies
• Scheduling backups: Users contact the support team to schedule backups
• Backup recovery: Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Contact hello@creative-n.com for more information on our SLA agreements.
• Approach to resilience: This service is resilient with redundancy, failover mechanisms, load balancing, geographic distribution, data backup, security measures, and continuous monitoring. Redundant components ensure continuous operation, while failover mechanisms switch to backups during failures. Load balancing optimises performance, and geographic distribution minimises regional outages. Regular backups and robust recovery processes protect against data loss. Security measures safeguard against cyber threats. Continuous monitoring allows for proactive issue identification and mitigation. Overall, these design elements ensure the service remains highly available, reliable, and secure, even in the face of unforeseen challenges or disruptions.
• Outage reporting: Email alerts

Identity and authentication

• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Supplier defined controls.
• Access restriction testing frequency: Less than once a year
• Management access authentication: Username or password
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Less than 1 month
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Less than 1 month
• How long system logs are stored for: Less than 1 month

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UKAS
• ISO/IEC 27001 accreditation date: 24/10/2022
• What the ISO/IEC 27001 doesn’t cover: Areas not covered by ISO/IEC 27001 certification include specific business processes unrelated to information security, certain third-party services or suppliers, or compliance with other industry-specific regulations.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Organisations adhering to ISO 27001 establish robust information security practices. They develop policies aligned with ISO 27001 requirements, covering areas like access control, data protection, and incident response. Through risk assessments, they identify and prioritise security risks, implementing controls to mitigate them. Employees receive training on security policies and procedures to enhance awareness and compliance. Monitoring and review processes ensure the effectiveness of security controls, with regular audits and assessments conducted. A designated individual or team oversees the implementation and maintenance of the Information Security Management System (ISMS), reporting to senior management or the board. To ensure policy adherence, organisations employ various mechanisms such as audits, reviews, and ongoing monitoring. Non-compliance issues prompt corrective actions and improvements to the ISMS. By following these practices, organisations demonstrate their commitment to information security and continuously strive to enhance their security posture in line with ISO 27001 standards.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Management approach ; Creative Network's have in place a Change Management Process that follows the ISO 20000 Standard. A change is proposed with the Change Manager and then added to the Changes-overview. The change is scheduled to be executed and a roll back plan is created (if necessary). Rollback is actioned immediately upon confirmation as per following the rollback matrix, resources are freed and announcements are published. Periodically, the overview of archived changes is checked.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Creative Network's have a Vulnerability Management process that implements the following: Receives information about zero day threats from the National Cyber Security Center; Subscribe to newsletters from vendors and used products, in contact with special interest groups; Technical vulnerabilities are handled either using the Incident management process or the Change management process; Patches are tested following the Installation of software on operational systems.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: All devices have a monitoring agent on them which can identify potential issues and report back to our service desk. If an issue is identified we have an internal 4 hour SLA to ensure remedial actions are carried asap, the seriousness of an incident will be assessed on discovery so that any priority issues can be responded to quickly. We have multiple alert systems in place and monitor them constantly. We exclusively use Linux for phone system hosting. We automatically patch daily as and when required.
• Incident management type: Supplier-defined controls
• Incident management approach: Fully developed Business Continuity and Disaster Recovery management process developed in line with ISO 22301. Creative Network's have a pre-defined Incident Management Process in place where by an incident is reported with the Incident Manager and then added to the Incidents-overview. After which, relevant log files (from all systems affected) and evidence is gathered. The incident is corrected by implementing a patch, temporary fix or workaround. It is determine whether future occurrences of the incident can be prevented, e.g. by modifying/strengthening one or more controls. Periodically, the overview of archived incidents is checked for apparent trends and effectivity of corrections.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Third-party
• Third-party virtualisation provider: Hyper-V
• How shared infrastructure is kept separate: Different organisations sharing the same infrastructure are kept apart through isolation mechanisms including virtualization, network segmentation, access controls, resource allocation, security policies, and monitoring. Each organisation operates within its own virtual environment with dedicated resources and configurations. Network segmentation prevents communication between organisations, while access controls restrict access to organisation-specific resources. Resource allocation ensures fair distribution, and security policies enforce compliance with organisational standards. Continuous monitoring and auditing detect anomalies and ensure adherence to policies, maintaining separation and data integrity.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Our Data Centre follows the ISO 14001 standard. We have in place a robust environmental management system • Procuring consumed energy from sustainable energy sources wherever possible

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Wellbeing

  Fighting climate change

  By offering remote access management, our service minimises the need for physical presence, reducing carbon emissions associated with travel. Additionally, our scalable solutions are designed to be energy-efficient, contributing to overall sustainability efforts.

  Covid-19 recovery

  Our system supports Covid-19 recovery efforts by enabling touchless entry through biometric or card-based authentication, reducing the risk of virus transmission via shared surfaces. Furthermore, remote management capabilities facilitate compliance with social distancing guidelines.

  Wellbeing

  Enhanced security provided by our service promotes a safer working environment, fostering employee wellbeing. Real-time monitoring and automated alerts ensure prompt response to security breaches, alleviating concerns about workplace safety.

Pricing

• Price: £1,000.00 to £1,400.00 a unit
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at aj@creative-n.com. Tell them what format you need. It will help if you say what assistive technology you use.