exeGesIS Spatial Data Management

Land and Conservation Management System (CMSi)

CMSi is the software supported approach to management of land, property and assets that have conservation and amenity value. CMSi is used by public and private sector organisations including several government agencies in the UK and overseas such as Natural England, Natural Resources Wales and local authorities.


  • Manage sites for terrestrial and marine ecology, habitats and species
  • Integrate information on tenure, assets, agreements, rights, contacts and buildings
  • Suitable for statutory designated sites: SAC, SPA, RAMSAR, NNR, SSSI
  • Suitable for local sites with no designation, including amenity sites
  • Configurable plan structure and reporting, including graphs, maps and photographs
  • Casework recording functionality, including monitoring and objective and target setting
  • Internal mapping tools or integrates with ArcGIS, MapInfo or QGIS
  • Built in species recording capabilities, with complete biodiversity recording extension
  • Data export routines to PDF, Word, Excel, Access and XML
  • Secure access for external usage and external publishing capabilities


  • Dynamic, continuously updated adaptive management plans with a logical structure
  • Evidence-based audit trail of decisions made and management undertaken
  • Ensures well-planned, evidence-based, objective and rational site management
  • Fully supports conservation objectives and standard status monitoring techniques
  • Integrates information from all aspects of site management
  • Integrates with your GI data: vector/raster, point/polyline/polygon
  • Share projects, plans and best practice with stakeholders and partners
  • Upgradeable: new functionality developed by consortium members available to all
  • Experienced support staff with technical and conservation knowledge
  • Flexible scalable hosting arrangements, including Azure; secure backup and recovery


£65.36 to £558 per licence per year

  • Education pricing available

Service documents


G-Cloud 11

Service ID

9 0 8 0 2 0 8 2 4 6 6 3 7 3 7


exeGesIS Spatial Data Management

Jon Young

01874 711145


Service scope

Software add-on or extension
Cloud deployment model
  • Private cloud
  • Hybrid cloud
Service constraints
System requirements
  • Remote Desktop Client
  • Internet connectivity
  • 1024 x 768 screen or greater
  • Keyboard recommended
  • Mouse recommended

User support

Email or online ticketing support
Email or online ticketing
Support response times
During business hours we respond within 24 hours.
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Onsite support
Support levels
MATS (Maintenance and Technical Support) is provided for all clients at a single level,and includes direct access to our technical consultants and engineers. Technical Support constitutes assistance in solving any problems encountered by users in operating or configuring the supplied software. Costs depend on number of licences and which modules are licensed.
Support available to third parties

Onboarding and offboarding

Getting started
We provide standard and customised training courses, either onsite or at our own training facility. We also provide online webinars and online documentation.
Service documentation
Documentation formats
End-of-contract data extraction
Data is supplied as SQL Server database backup plus zipped folders/files.
End-of-contract process
Decommissioning infrastructure and systems is undertaken for no charge within the contract. Preparation and supply of data may be subject to additional charges for time and materials.

Using the service

Web browser interface
Application to install
Designed for use on mobile devices
Service interface
What users can and can't do using the API
The CMSi API is a web services interface onto the main CMSi application and database. Typically, the API is used by development teams allowing web applications, mobile apps and other services to read and write information to the backend CMSi database. The API itself is a module sold as part of the CMSi system, but the main 'user' of the API is typically other developers/systems allowing them to access CMSi data.
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
CMSi can be customised to meet the organisation's own working practices. It has translation functions so can be used in any language requiring no specialist technical skills. All terminology and labels can be changed to match client preferences. CMSi allows an organisation to create different user roles (e.g. ranger, site manager, ecologist, etc) and configure the system so that users only see the parts of the system they need. It includes a ‘My CMSi’ section which can be customised to give different users easy access directly into the parts of the system, activities and reports that they use most.


Independence of resources
Generally we only run one user on a Virtual Machine which allows us to ring fence appropriate resources for the Virtual Machine. We also have a number of monitoring systems in place to monitor both the response times of the systems (e.g. a web request) and also the performance of the hardware - both virtual and physical. These systems send out alerts if they detect a problem.


Service usage metrics
Metrics types
User actions within CMSi are comprehensively logged and the logs are visible to System Administrators (and to a lesser extent to all users), and from these logs it is possible to see levels of usage of the overall system and its modules, plus activity of each user. Uses of the API are also logged. User activity on the hosted server is logged and available on request.
Reporting types
  • API access
  • Regular reports
  • Reports on request


Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Hosting may be provided by us or Microsoft Azure

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Managed by a third party
Penetration testing frequency
Less than once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
Physical access control, complying with another standard
Data sanitisation process
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
In-house destruction process

Data importing and exporting

Data export approach
There are several ways of exporting data. All modules permit advanced filtering of subsets of records and filtered sets can be exported to Microsoft Access and Excel formats where the schema and content of the exports can be extended/configured by the System Administrator. Reports can be exported to HTML, RTF, PDF and Excel formats. System Administrators can also export data directly from database tables to a wide range of formats include XML, CSV, and Microsoft Access/Excel and GIS formats using spatial tools.
Data export formats
Other data export formats
  • XLS
  • RTF
  • PDF
  • HTML
  • Microsoft Word
  • Microsoft Access mdb
Data import formats
  • CSV
  • Other
Other data import formats
  • XML
  • ESRI Shapefile
  • MapInfo TAB
  • Microsoft Excel
  • WMS
  • Microsoft Word

Data-in-transit protection

Data protection between buyer and supplier networks
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection between networks
We generally don't allow clients networks to connect to ours. Access is either via web browsers or SSL gateway. New client server setups would all support TLS 1.2 providing the client was capable. We also lock to client IPs wherever possible
Data protection within supplier network
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection within supplier network
Access is also restricted to known company IP addresses.

Availability and resilience

Guaranteed availability
Availability (other than for scheduled maintenance) is guaranteed to be better than 99.9%. In the event of a failure to meet availability standards then we re-pay 1 days hosting fee for every 1 hour the system is unavailable beyond standard – without limit.
Approach to resilience
Power and internet feeds are duplicated provided to us by the data centre. We run dual firewalls in an Active / Passive setup. We have duplicate HyperV servers so a Virtual Machine could quickly be started on another server in the event of hardware failure of the Hyper V server. Virtual Machine storage is backed up to separated storage.
Outage reporting
We report on an (independently hosted!) status page also available as RSS feed. We can also arrange for emails from our various monitoring systems to be sent direct to clients if they wish.

Identity and authentication

User authentication needed
User authentication
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
Management interfaces and support channels are restricted to authenticated users (username and password over https).
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Username or password
  • Other
Description of management access authentication
We use restricted IP addresses for all management access.

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
SGS United Kingdom Ltd
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
The certificate covers our hosting infrastructure, not CMSi itself or any operations undertaken by us outside of the hosting infrastructure, such as data preparation, etc.
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance approach
All new staff are made aware of company polices relating to security governance. Checks are made on systems and processes to ensure these are being adhered to.
Information security policies and processes
We have an individual hosting manager who is responsible for security of our hosting infrastructure, who reports to the board. Internal policy documents ensure staff can reference required procedures. Policies are set by discussion with board and hosting manager.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Changes to production systems are made by Product Consultants with the necessary expertise. All changes on production systems are documented in advance with details of what is to be changed, assessment of impact/downtime, assessments of risk and mitigation measures, communications plan, and roll-back plan, reviewed and signed off by the relevant Server/Service Manager before proceeding. Following implementation, all changes are stored in the change log. Changes with significant impact and/or risk are generally made in a test environment first, subject to contract and agreement with the client.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Firewall monitors intrusion attempts / suspicious activity. Our systems are patched with all Microsoft security patches normally within a few days of their release. Potential threat information is from the web and email subscription to various relevant industry websites.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Firewall monitors and logs intrusion attempts / suspicious activity. Alerts set if detected. Depending on service provided, customer logons can be reported on. We would aim to act on any suspicious activity within 24 hours.
Incident management type
Supplier-defined controls
Incident management approach
Internally defined process allows for preventative measures (such as blocking IP ranges if suspicious activity detected), our provider can provide additional DDOS filtering. If users have an issue they can alert their company contact who will escalate it to our infrastructure manager if they can't deal with it themselves. Any incidents would be reported on our server hosting status page. If the incident was significant for a particular user we would contact them directly.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£65.36 to £558 per licence per year
Discount for educational organisations
Free trial available

Service documents

Return to top ↑