Historic Buildings, Sites and Monuments Record system (HBSMR)
The Historic Buildings, Sites and Monuments Record system (HBSMR) is a comprehensive database and GIS solution for the management of Historic Environment Records, developed in partnership with English Heritage and the Association of Local Government Archaeological Officers. HBSMR is used by the majority of HERs and SMRs in the UK.
Features
- Record monuments, events, sources, finds, Historic Landscape Character and designations
- Document and manage casework on historic features
- Features to increase your productivity, including tasks, history and bookmarks
- MIDAS Heritage data standards compliant and incorporates INSCRIPTION terminology
- Data indexed using English Heritage and FISH/INSCRIPTION thesauri
- Integrated digital mapping (GIS) using ArcGIS, MapInfo or QGIS
- Powerful filtering interfaces, including spatial searching with the GIS module
- Comprehensive report generation and data export tools
- Integral web browser access to help, forums, documentation and archives
- Modules to publish data, maps and images on the web
Benefits
- The most comprehensive and popular HER/SMR software on the market
- Record and manage heritage asset data to national standards
- Extensible system allows for managing enquiries, casework, research and outreach
- Intuitive Main Menu tree and easily understood links between forms
- Fully mature product with a large active user group
- Benefit from a user driven development trajectory
- Highly customisable, allowing bespoke solutions for initiatives of all kinds
- Experienced support staff with technical, heritage, archaeology and HER knowledge
- Expert consultancy support available for complex data processing and migration
- Flexible scalable hosting arrangements, including Azure; secure backup and recovery
Pricing
£41.23 to £66.75 a user a month
Service documents
Request an accessible format
Framework
G-Cloud 11
Service ID
9 5 5 9 3 1 7 3 3 4 7 4 8 2 5
Contact
IDOX SOFTWARE
Jon Young
Telephone: 01874 711145
Email: frameworks@esdm.co.uk
Service scope
- Software add-on or extension
- No
- Cloud deployment model
-
- Private cloud
- Hybrid cloud
- Service constraints
- None
- System requirements
-
- Remote Desktop Client
- Internet connectivity
- 1024x768 or greater screen
- Keyboard recommended
- Mouse recommended
User support
- Email or online ticketing support
- No
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), Monday to Friday
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
- MATS (Maintenance and Technical Support) is provided for all clients at a single level, and includes direct access to our technical consultants and engineers. Technical Support constitutes assistance in solving any problems encountered by users in operating or configuring the supplied software. Costs depend on number of licences and which modules are licensed.
- Support available to third parties
- No
Onboarding and offboarding
- Getting started
- User documentation, plus training in our suite or client office
- Service documentation
- Yes
- Documentation formats
- HTML
- End-of-contract data extraction
- Data is supplied as SQL Server database backup plus zipped folders/files.
- End-of-contract process
- Decommissioning infrastructure and systems is undertaken for no charge within the contract. Preparation and supply of data may be subject to additional charges for time and materials.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Internet Explorer 9
- Internet Explorer 10
- Internet Explorer 11
- Microsoft Edge
- Firefox
- Chrome
- Safari 9+
- Opera
- Application to install
- Yes
- Compatible operating systems
- Windows
- Designed for use on mobile devices
- No
- Service interface
- Yes
- Description of service interface
- MS Access forms linking to GIS platforms and SQL database.
- Accessibility standards
- None or don’t know
- Description of accessibility
- Works with screen readers.
- Accessibility testing
- None.
- API
- Yes
- What users can and can't do using the API
- The API is primarily used for fetching filtered data from HBSMR into other applications such as the Heritage Gateway portal or other websites. The API has a method for submission of new data, which is retained in a holding area until retrieved into the HBSMR application by a System Administrator for review and possible acceptance.
- API documentation
- Yes
- API documentation formats
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
- The HBSMR application can be customised in so many ways that it is not possible to cover them here, ranging from minor configuration options, to the roles and permissions of all users, through to extending the application with custom forms and querying/reporting. Customisation can be undertaken only by System Administrators (controlled by login).
Scaling
- Independence of resources
- Generally, we only run one user on a Virtual Machine which allows us to ring fence appropriate resources for the Virtual Machine. We also have a number of monitoring systems in place to monitor both the response times of the systems (e.g a web request) and also the performance of the hardware - both virual and phsyical. These systems send out alerts if they detect a problem.
Analytics
- Service usage metrics
- Yes
- Metrics types
- User actions within HBSMR are comprehensively logged and the logs are visible to System Administrators (and to a lesser extent to all users), and from these logs it is possible to see levels of usage of the overall system and its modules, plus activity of each user. Uses of the API are also logged and visible.
- Reporting types
-
- API access
- Real-time dashboards
- Reports on request
Resellers
- Supplier type
- Reseller providing extra features and support
- Organisation whose services are being resold
- Hosting may be provided by us or Microsoft Azure
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- Up to Security Clearance (SC)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
-
- United Kingdom
- European Economic Area (EEA)
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Managed by a third party
- Penetration testing frequency
- Less than once a year
- Penetration testing approach
- Another external penetration testing organisation
- Protecting data at rest
- Physical access control, complying with another standard
- Data sanitisation process
- Yes
- Data sanitisation type
- Deleted data can’t be directly accessed
- Equipment disposal approach
- In-house destruction process
Data importing and exporting
- Data export approach
- There are several ways of exporting data. All modules permit advanced filtering of subsets of records, and filtered sets can be exported to CSV, XML or GIS formats where the schema and content of the exports can be extended/configured by the System Administrator. Reports can be exported to HTML, Word, PDF. Spatial data can be exported from the GIS interfaces as (for example) shapefiles, MapInfo TAB files, or ESRI geodatabases. System Administrators can also export data directly from database tables to a wide range of formats include XML, CSV, and MS Access/Excel.
- Data export formats
-
- CSV
- Other
- Other data export formats
-
- XML
- ESRI Shapefile
- Data import formats
-
- CSV
- Other
- Other data import formats
-
- XML
- ESRI Shapefile
- MapInfo TAB
- ESRI geodatabases
- Excel
- DBF
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Legacy SSL and TLS (under version 1.2)
- Other
- Other protection between networks
- We generally don't allow clients networks to connect to ours. Access is either via web browsers or SSL gateway. New client server setups would all support TLS 1.2 providing the client was capable. We also lock to client IPs wherever possible.
- Data protection within supplier network
-
- Legacy SSL and TLS (under version 1.2)
- Other
- Other protection within supplier network
- Access is also restriced to known company IP addresses.
Availability and resilience
- Guaranteed availability
- Availability (other than for scheduled maintenance) is guaranteed to be better than 99.9%. In the event of a failure to meet availability standards then we re-pay 1 days hosting fee for every 1 hour the system is unavailable beyond standard – without limit.
- Approach to resilience
- Power and internet feeds are duplicated provided to us by the datacentre. We run dual firewalls in an Active / Passive setup. We have duplicate HyperV servers so a Virtual Machine could quickly be started on another server in the event of hardware failure of the Hyper V server. Virtual Machine storage is backed up to separated storage.
- Outage reporting
- We report on an (independently hosted!) status page also available as RSS feed. We can also arrange for emails from our various monioring systems to be sent direct to clients if they wish.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- Public key authentication (including by TLS client certificate)
- Limited access network (for example PSN)
- Dedicated link (for example VPN)
- Username or password
- Access restrictions in management interfaces and support channels
- Management interfaces and support channels are restricted to authenticated users (username and password over https).
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Username or password
- Other
- Description of management access authentication
- Restricted IP addresses.
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- Users receive audit information on a regular basis
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- At least 12 months
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- SGS United Kingdom Ltd
- ISO/IEC 27001 accreditation date
- 28/02/2017
- What the ISO/IEC 27001 doesn’t cover
- The certificate covers our hosting infrastructure, not HBSMR itself or any operations undertaken by us outside of the hosting infrastructure, such as data preparation, etc.
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Other security certifications
- No
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- No
- Security governance approach
- All new staff are made aware of company polices relating to security governance. Checks are made on systems and processes to ensure these are being adhered to.
- Information security policies and processes
- We have an individual hosting manager who is responsible for security of our hosting infrastructure, who reports to the board. Internal policy documents ensure staff can reference required procedures. Policies are set by discussion with board and hosting manager.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
- Changes to production systems are made by Product Consultants with the necessary expertise. All changes on production systems are documented in advance with details of what is to be changed, assessment of impact/downtime, assessments of risk and mitigation measures, communications plan, and roll-back plan, reviewed and signed off by the relevant Server/Service Manager before proceeding. Following implementation, all changes are stored in the change log. Changes with significant impact and/or risk are generally made in a test environment first, subject to contract and agreement with the client.
- Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
- Firewall monitors intrusion attempts / suspicious activity. Our systems are patched with all MS security patches normally within a few days of their release. Potential threat information is from the web and email subscription to various relevant industry websites.
- Protective monitoring type
- Supplier-defined controls
- Protective monitoring approach
- Firewall monitors and logs intrusion attempts / suspicious activity. Alerts set if detected. Depending on service provided, customer logons can be reported on. We would aim to act on any suspicious activity within 24 hrs
- Incident management type
- Supplier-defined controls
- Incident management approach
- Internally defined process allows for preventative measures (such as blocking IP ranges if suspicious activity detected), our provider can provide additional DDOS filtering. If users have an issue they can alert their company contact who will escalate it to our infrastructure manager if they can't deal with it themselves. Any incidents would be reported on our server hosting status page. If the incident was significant for a particular user we would contact them directly.
Secure development
- Approach to secure software development best practice
- Supplier-defined process
Public sector networks
- Connection to public sector networks
- No
Pricing
- Price
- £41.23 to £66.75 a user a month
- Discount for educational organisations
- No
- Free trial available
- No