ECOM SCOTLAND LIMITED

eNetAssess

eNetAssess is a digital assessment system for creating and managing bespoke tests and exams in a secure environment. It provides practice (formative) or exam (summative) testing. The system has test creation, question authoring, centre management, scheduling, authentication, invigilation and verification, through to final reporting, analysis and certification.

Features

• Mobile enabled delivery for mock and in-field (observational) assessments
• eProctoring and remote invigilation compliant to industry standards
• Secure kiosk mode with internet monitoring and auto reconnection
• Automatic marking, eMarking, eVerification and AI-assisted question authoring
• Assignment options for evidence gathering portfolio
• Extensive question-type range: MCQ, essay, case study, rubric, bespoke
• Booking Management System (BMS) module including ecommerce
• Comprehensive report suite for learner, examiner and test centre
• Customisation with organisation branding and styling
• Certification and/or credentialling to OpenBadges

Benefits

• Reduced management time and costs compared to paper assessment
• Better accessibility, remote supervision and real-time feedback
• Reduced test creation, design and item development costs
• Eliminate paper print and postage or courier costs
• Reduce quality assurance and site audit fees
• Reduce marking times compared to paper assessment
• Provide immediate feedback with insight to learners
• Responsive design supports bring your own device (BYOD)
• Create tests on-screen, output to paper
• Deliver tests on-screen offline for locations with weak connectivity

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@ecomscotland.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

910828902715430

Contact

Wendy Edie
01383 630032
tenders@ecomscotland.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations

  Service industry and public sector operations

  • Healthcare
  • Education
  • Public Order and Safety
  • Police
  • Defence
  • Social Security Administration
  • Adult Social Care
  • Children's Social Care
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Limitations may include; Clients SSL, licensing and browser limitations.
• System requirements:
  • A stable internet connection of 5Mbps minimum
  • A browser that supports HTML5

User support

• Email or online ticketing support: Yes
• Support response times: ECom provides informed and timely responses to most enquiries within 24 hrs. Weekends and other circumstances can occasionally extend response times to up to 72 hrs. eCom provides access to experts aligned with the needs of your stakeholder groups, face-to-face direct support from our teams when preferred or needed, engagement with real people who know (and are involved in) your projects, and service levels aligned with your needs and expectations.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: Customers are provided with a named Account Manager who acts as the primary point of contact for service delivery, relationship management and ongoing service reviews. The Account Manager supports onboarding, coordinates change requests, provides roadmap updates and acts as an escalation point for service issues.; ; Operational support is delivered through a centralised helpdesk service providing incident management, service requests and technical assistance. Users can log support requests via email and a web-based service desk portal. Tickets are triaged by priority and severity and responded to within defined service levels.; ; Support services are available during standard UK business hours, with extended coverage and priority response available for critical incidents by agreement. High-severity incidents are escalated to specialist technical teams and management as required.; ; Customers receive regular service communication including incident updates, planned maintenance notifications and service review meetings where appropriate. All support activity is logged and tracked to resolution, with reporting available on request to support governance and continuous service improvement.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide consultation or content workshops that can be held face to face or via webcall.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: When the project is complete users are sent the SCORM file package for their course as well as any created assets as part of the contract i.e storyboards, graphics, videos.
• End-of-contract process: Included in the price is access to all assets built upon behalf of the client i.e SCORM, storyboards, graphics, videos etc. Additional costs may occur if changes are to be made at a later date.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service provides a responsive candidate interface supporting both desktop and mobile devices for appropriate assessment activity. Mobile access is primarily intended for learners undertaking low-stakes assessments, revision tests and evidence capture, with simplified navigation and touch-friendly controls. Administrative, authoring, invigilation and reporting interfaces are optimised for desktop and laptop use, reflecting the need for extended sessions, complex configuration and enhanced security controls. For high-stakes or proctored assessments, desktop devices may be required to ensure compatibility with secure browser controls, kiosk mode and remote invigilation tools.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: ELearning is available either through the contracted authoring tool or accessed via the client's agreed LMS or website.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We routinely test using screen readers including NVDA and JAWS, as well as browser-based screen reader tools, to verify correct reading order, semantic markup, heading structure, form labelling and error messaging. Keyboard-only navigation is tested across all core workflows to ensure full functionality without reliance on a mouse. We also test with high-contrast display modes, colour contrast checking tools, browser zoom and text resizing to confirm readability and layout stability.; ; Where appropriate, we engage with client accessibility specialists and incorporate feedback from users with specific access needs during acceptance testing. Identified issues are logged within our defect management process, prioritised according to impact and resolved within standard release cycles.
• API: Yes
• What users can and can't do using the API: The service provides secure, standards-based APIs to support integration with external systems and organisational workflows. APIs are commonly used to synchronise user accounts, enrolments and role assignments from HR, CRM or identity management systems, enabling automated user provisioning and de-provisioning.; ; Assessment results, scores, certification status and completion data can be exported via API to downstream systems including learning management systems, compliance platforms, data warehouses and reporting tools. Booking and scheduling data can be integrated with external booking, examination management or centre administration systems to support end-to-end assessment workflows.; ; Single sign-on is supported through integration with identity providers using industry-standard protocols, enabling authentication via organisational directories and federated identity services. This allows users to access the service using existing credentials and supports centralised access control.; ; Reporting and analytics data can be accessed through secure data exports or API endpoints to support operational reporting, regulatory returns and management dashboards.; ; All APIs are secured using authenticated access, role-based permissions and encrypted transport. Integration documentation and technical support are provided to customers as part of onboarding and ongoing service delivery.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Assessment structure and workflows can be configured to reflect operational and compliance models. Assessment designers can define assessment sequencing, prerequisites, branching logic and progression rules, supporting formative, summative and high-stakes assessment scenarios.; ; Question design and scoring are fully configurable, including question types, weighting, scoring models, pass thresholds and grading rules. Feedback can be tailored at question, section or assessment level, with support for adaptive feedback, remediation pathways and controlled retry behaviour.; ; Terminology and language can be customised throughout the assessment experience, including instructions, question wording, feedback messages and outcome statements. Tone, reading level and localisation can be adapted for different learner audiences, with multi-language delivery supported where required.; ; Presentation and branding can be applied across the assessment interface, including white labelling, visual styling and layout configuration, ensuring consistency with organisational identity while meeting accessibility standards.

Scaling

• Independence of resources: We complete a project plan with detailed dates of every phase of the project which shows milestones to delivery. This is a binding document that keeps the work to scope and on-time. This is provided prior to the project kick off.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Data is contained within the eLearning course and the completed SCORM file is sent to users at the end of the project after the client has signed off the work as complete.
• Data export formats: Other
• Other data export formats:
  • SCORM
  • HTML5
• Data import formats: Other
• Other data import formats:
  • SCORM
  • HTML5

Data-in-transit protection

• Data protection between buyer and supplier networks: Other
• Other protection between networks: We provide users with a SCORM file therefore there is no network integration.
• Data protection within supplier network: Other
• Other protection within supplier network: We provide users with a SCORM file therefore there is no network integration.

Availability and resilience

• Guaranteed availability: We guarantee a minimum service availability of 99.9% per calendar month for core learner and administrative services, aligned to our contractual Service Level Agreement and the underlying Microsoft Azure hosting platform service commitments.
• Approach to resilience: The service is hosted on Microsoft Azure UK data centres and benefits from Azure’s geographically distributed cloud architecture. Core components are deployed across multiple availability zones within a UK region, providing redundancy across physically separate datacentres with independent power, cooling and network connectivity. This design protects against single-site failure and supports automatic recovery in the event of infrastructure faults.; ; At application level, the service uses load balancing, redundant service instances and managed Azure platform services to provide fault tolerance and continuous availability. Data is stored on resilient Azure storage services with built-in replication, integrity checking and encryption at rest. Automated backups are performed regularly with defined retention policies and tested restoration procedures.; ; Infrastructure health, application performance and security events are continuously monitored using automated alerting tools, enabling rapid operational response. Capacity management and scaling controls are used to maintain performance during periods of peak demand.; ; Business continuity and disaster recovery arrangements are documented, reviewed and tested periodically. Further technical details of the resilience architecture, recovery objectives and continuity controls are available to customers on request as part of our security and assurance documentation.
• Outage reporting: Service health and availability are monitored continuously using automated monitoring and alerting systems. When an outage or material service degradation is detected, incidents are logged within our service management system and triaged by the operations team.; ; Customers are notified of outages and significant incidents through email alerts to nominated technical and service contacts. Incident updates, impact assessments and estimated restoration times are provided at regular intervals until resolution. Where appropriate, customers may also be notified through their designated account manager for high-impact or priority incidents.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: User roles to restrict management interface and support channels.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials Plus (UK NCSC certified)
• Information security policies and processes: We operate a formal information security management framework aligned to recognised best practice and the principles of ISO/IEC 27001 and the UK Government Cloud Security Principles.; ; Information security governance is led by senior management, with overall accountability held by the Chief Operating Officer and day-to-day responsibility delegated to a designated Information Security Lead. Security governance is reviewed regularly at senior management level and forms part of organisational risk management.; ; We maintain a suite of documented information security policies and procedures including information security policy, access control, data protection, incident management, change management, supplier security, backup and recovery, and acceptable use. Policies are reviewed at least annually and updated in response to regulatory change, risk assessments and security incidents.; ; Compliance is enforced through role-based access control, segregation of duties, secure development practices and mandatory staff training. All staff receive security awareness training on induction and periodic refresher training thereafter.; ; Operational compliance is monitored through technical controls, internal audits, vulnerability management, penetration testing and Cyber Essentials Plus certification. Security incidents are recorded, investigated and reported through a formal incident management process with defined escalation routes to senior management and customers where required.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: ECom's formal change management process; • Appointing a change manager responsible for the proposed changes. • Assuring all proposed changes are evaluated for their benefits and risks, and that all impacts are considered. • Prioritizing changes so that limited resources are allocated to those changes that produce the greatest benefit based on the business need. • Requiring all changes are thoroughly tested and that each deployment includes a back-out plan to restore the state of the environment in the event that the deployment fails. • Ensuring the configuration management system is updated to reflect the effect of any changes.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We operate a structured vulnerability management process aligned to Cyber Essentials Plus. Potential threats are identified through automated vulnerability scanning, dependency monitoring, penetration testing and threat intelligence from Microsoft advisories, NCSC guidance and CVE databases. Patches are prioritised by risk and deployed through controlled release processes, with critical vulnerabilities remediated promptly and all changes tested prior to deployment. Continuous endpoint protection and monitoring are in place.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We operate continuous protective monitoring across infrastructure and applications using centralised logging, security event monitoring and automated alerting. Potential compromises are identified through analysis of authentication events, access logs, application behaviour, network traffic and endpoint security alerts. When suspicious activity is detected, incidents are immediately triaged, affected systems isolated where required and investigations initiated under our incident response process. Alerts are monitored in near real time, with high-severity incidents responded to immediately and lower-risk events reviewed within defined response windows. All incidents are logged, investigated and subject to post-incident review and corrective action.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We operate predefined incident management procedures for common service and security events. Users report incidents via our service desk portal, email or designated support contacts. All incidents are logged, categorised and prioritised, with escalation to specialist teams where required. Customers receive status updates during incidents and formal incident reports following resolution, including root cause, impact and corrective actions.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 6346fb22-82dc-4e3c-913c-b76a005269fe
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 34c19971-20cd-47f7-b3b9-c036750688fc
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@ecomscotland.com. Tell them what format you need. It will help if you say what assistive technology you use.