JBA Consulting


AssetCoast coastal asset management is a mobile and web-based asset management service for coastal, estuarine and river defence assets. It provides a consequence-based asset risk assessment of the physical condition of coastal assets in combination with the following risks: coastal erosion, wave overtopping, and still water level flooding.


  • Asset Management
  • Real-time synchronisation
  • Remote data collection
  • Cloud based data assessment of data
  • Data management
  • Coastal Estuarine and River Defences (CERDS)
  • Coastal erosion
  • Wave overtopping
  • Still water level flooding
  • Condition assessement


  • Paperless
  • Consistent data collection
  • Scalable for almost any data collection requirement
  • Low cost


£1000 per licence per year

  • Free trial available

Service documents

G-Cloud 9


JBA Consulting

Roger Winterbottom



Service scope

Service scope
Software add-on or extension No
Cloud deployment model Private cloud
Service constraints No
System requirements IOS 10+ for the app

User support

User support
Email or online ticketing support Email or online ticketing
Support response times 1 to 4 hours depending on service level. Weekend responses differ depending on service level.
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support No
Onsite support No
Support levels Bronze support: 9 to 5 weekdays. Typically £3k/year.
Silver support: 7 to 7 weekdays. Typically £8k/year.
Gold: 7 to 7, 365 days/year. Typically £25k/year.
Support available to third parties No

Onboarding and offboarding

Onboarding and offboarding
Getting started Onsite training is available.
Service documentation No
End-of-contract data extraction Users may extract their data from the system at any time. We can also supply a complete set of records on request.
End-of-contract process No additional actions take place at the end of the contract and there are no additional costs.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10+
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install Yes
Compatible operating systems IOS
Designed for use on mobile devices Yes
Differences between the mobile and desktop service Mobile service is for data collection. Desktop service is for data review and editing.
Accessibility standards WCAG 2.0 AA or EN 301 549
Accessibility testing None.
Customisation available No


Independence of resources Auto-scaling web servers.


Service usage metrics No


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Staff screening not performed
Government security clearance Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations European Economic Area (EEA)
User control over data storage and processing locations No
Datacentre security standards Managed by a third party
Penetration testing frequency Less than once a year
Penetration testing approach In-house
Protecting data at rest Physical access control, complying with SSAE-16 / ISAE 3402
Data sanitisation process Yes
Data sanitisation type Deleted data can’t be directly accessed
Equipment disposal approach In-house destruction process

Data importing and exporting

Data importing and exporting
Data export approach Data can be exported at any time through the web browser by choosing 'export' , 'download' or 'report' options.
Data export formats
  • CSV
  • Other
Other data export formats XML
Data import formats Other
Other data import formats XML

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network TLS (version 1.2 or above)

Availability and resilience

Availability and resilience
Guaranteed availability AssetCoast offers 99.95% uptime. There is no explicit SLA.
Approach to resilience Information available on request.
Outage reporting Outages are not reported.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication Username or password
Access restrictions in management interfaces and support channels Users are assigned to roles, organisations and teams, with associated restrictions placed on management interfaces.
Access restriction testing frequency At least every 6 months
Management access authentication Username or password

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for At least 12 months
Access to supplier activity audit information No audit information available
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 Lloyd's Register LRQA
ISO/IEC 27001 accreditation date 28/03/2017
What the ISO/IEC 27001 doesn’t cover The certification covers "Provision of the following services in the fields of water and the environment: consultancy; project and contract management; administration; training; flood risk management; reservoir, civil, railway and structural engineering and engineering design, inspection and supervision; geotechnical; topographic survey; GIS analysis; ecological and environmental including landscape and visual impact assessment, stakeholder engagement, energy and water optimisation; hydromorphology, hydrogeology, hydroecology and river restoration; software development and software licensing. Statement of applicability V 2.7"
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security accreditations No

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance accreditation Yes
Security governance standards ISO/IEC 27001
Information security policies and processes We follow an internal Information Security Policy, certified to ISO:27001, with an Information Security Management System. We also have Standard Operating Procedures for Control of Records, Control of Documents, and Nonconformities, Corrective and Preventive Action. Reporting is via line managers up to the IT Director.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach The service components are version-stamped and -controlled, with new releases made available to customers at scheduled times. Updates, new functionality and change requests are recorded in source control, with impact assessment undertaken prior to development. All changes are quality controlled and tested in a discrete testing-and-validation environment.
Vulnerability management type Supplier-defined controls
Vulnerability management approach Our IT staff undertake regular vulnerability assessments using automated software tests. Patches to the service are carried out on a regular basis, with critical vulnerabilities patched immediately when feasible. Information about threats is provided by Microsoft Security Bulletins, Apple Security Updates, and so on.
Protective monitoring type Supplier-defined controls
Protective monitoring approach We use Amazon Web Services (AWS) for our service hosting, which is extensively instrumented to monitor key operational and security metrics, with alarms configured to notify staff when thresholds are crossed. AWS staff respond 24 hours a day when, for example, denial of service attacks are detected. We also have our own alarm thresholds configured for our own staff to be notified when problems occur, with responses taking place as soon as reasonably practical.
Incident management type Supplier-defined controls
Incident management approach We provide email and telephone contacts for users to report incidents. Our subsequent response depends upon the type of incident reported, with some incidents, for example, defined within our Business Continuity Plan etc. We do not generally provide public incident reports, though we will contacts users by email when necessary.

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Public sector networks

Public sector networks
Connection to public sector networks No


Price £1000 per licence per year
Discount for educational organisations No
Free trial available Yes
Description of free trial Full version of the service for one month,


Pricing document View uploaded document
Skills Framework for the Information Age rate card View uploaded document
Service definition document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑