1. technology and computing
2. networking
3. vpn and remote access

Guidance for Third Party Users of ECOES
1. Introduction
The Electricity Central Online Enquiry Service (ECOES) is governed under the Master Registration
Agreement (MRA) and funded by all licensed electricity Supplier and Distribution Business parties to
the Agreement. ECOES is primarily designed to assist Suppliers in the customer transfer process.
The service provides a consolidated view of MPAS data for all metering points in the GB market,
enabling suppliers to view data for all their customers from one location as well as information
regarding customers who are about to switch.
The service is administered by the Central Administration Service (CAS) on behalf of the MRA.
2. Access to ECOES Data
2.1
Overview
Access to ECOES is available to Suppliers, Distribution Businesses, and Supplier Agents (e.g. Meter
Operators and Data Collectors) in order to assist them in fulfilling their obligations in respect of
industry processes.
Non-domestic customers with multiple MPANs are also able to gain access in order to manage their
portfolios of sites. Access is processed through a separate set of rules, via the ECOES website.
MPANs are added to a portfolio upon Supplier authorisation.
As explained in MAP15, there are a number of other organisations who are able to obtain access to
ECOES for defined purposes; these include law enforcement agencies, and government departments
and agencies.
These organisations will still need to complete an access request, but are exempt from certain
conditions. The CAS helpdesk is able to provide further guidance to such organisations.
Other third-parties may be granted access to either the live service or reports from ECOES, if
approved by the MRA Executive Committee (MEC). The rules for the granting of this access are set
out in an MRA Agreed Procedure (MAP), MAP15 – ECOES, which can be located on the ECOES
page on the MRASCo website. In order to obtain access, these third-parties must:




Complete an application form;
Agree to pay all costs and charges associated with the access;
Sign a licence agreement; and
Comply with data protection and information security requirements, this will involve at being
audited at least annually.
2.2
The Application Process
There are seven steps to the application and access process:
1.
2.
3.
4.
5.
6.
7.
initial application
initial CAS assessment1
agreement of terms for access or data provision (including charges)
MEC approval
licence terms agreed and signed
initial audit completed
access or data provided
Applicants should note that this process will typically take between 4 and 8 weeks.
In order to assist third-parties in assessing if they have a valid reason for applying and to assist them
through the process further information on these steps is contained below.
2.2.1
Initial Application
The initial application should be made via the application form found on the MRASCo website. The
notes below provide guidance on completing the form.
Company Details
 All applicants must be either:
 a company registered in England & Wales or Scotland; or
 a registered charity; or
 a government department or agency.
 The registered (or equivalent) address must be provided, and although not mandatory,
provision of a website address will assist CAS in making the initial assessment.
Primary Contact Details
 This should be a person whom the CAS can easily contact to discuss any queries regarding
the application.
Role in Industry
 This section is designed to allow for the provision of information by the applicant in relation to
the part they play in industry processes.
 The information provided should be relevant to the grounds for access as contained in
MAP15.
1
Where there is any potential conflict of interest between the CAS and the party requesting access, MEC will carry out the initial
assessment.
Data Access Required
 In order to fully assess the application, CAS needs to have information regarding which data
items the applicant is seeking to obtain access to, and also whether the request is for live
access or reports.
 If the application is for a report, it should contain details of the fields and file format required.
Reason for Request
 The application must set out a clear and detailed explanation for the request; this should be
aligned to the principles for access as set out in MAP15.
2.2.2
CAS Assessment
On receipt of a correctly completed application, the CAS will assess it against MAP15 requirements.
In particular that access will accomplish one of the following:
1. Satisfies a legal entitlement to access the data on ECOES shall be granted access.
2. Fulfils a licence obligation on MRA parties.
3. Provision of a clear benefit to MRA parties.
In addition the request must:
4. Be for a specific use;
5. Relate to systems & processes governed by the MRA or its products, or improve data quality;
and
6. Relate to those data which cannot be obtained via an official route from an MRA party.
Having carried out this assessment, the CAS will inform the application of their decision. At this stage,
the application will either be progressed to the next stage or rejected.
2.2.3
Agreement of terms and charges
Assuming the CAS accepts the request, the applicant and the CAS will agree the proposed terms of
access and costs and charges.
This will include costs for admin, data access, audit and any bespoke reports or extracts which need
to be created. The agreed terms and costs will be subject to MEC agreement.
2.2.4
MEC approval
Once the terms and costs have been agreed in principle, the request is presented to the next meeting
of MEC. These meetings are generally held on a monthly basis.
MEC will review the application and terms of access and make a decision regarding the granting of
access. MEC may:



Agree the request as drafted;
Agree access subject to modified terms; or
Reject the application.
2.2.5
Licence agreement
Following MEC acceptance of the request for access a formal licence agreement will be drawn up to
reflect the agreed terms. This will need to be signed and returned by the applicant prior to the further
progression of the process.
2.2.6
Audit
Once the licence has been signed, the Gemserv assurance team will contact the applicant to arrange
an information security audit on behalf of the CAS. The purpose of this audit is three-fold; it will
ensure that the organisation is:



compliant with data protection legislation;
compliant with the terms of the access licence granted; and,
not carrying out activities which represent a material risk to the MRA or MRASCo.
In order to satisfy the conditions of the audit, organisations accessing ECOES will need to
demonstrate the following:





Registration as a Data Controller with the ICO;
Information Security Management Systems to the standards of ISO27001;
Appropriate controls over the use of ECOES data within the organisation;
Appropriate processes regarding system and data access; and
Appropriate training for users, including admin users being aware of criteria for access to, and
use of ECOES in relation to their organisation2.
Initially, organisations will be requested to provide evidence of the above to the CAS. The scope of
any resultant on-site audit will be risk-based taking the evidence provided into consideration.
Once the audit has been completed, all observations and findings will be reported to MEC along with
risk-based recommendations for any remedial actions required. MEC will then approve or suspend
access based on any findings.
2.2.7
Access provided
Once MEC has approved the audit results, access to the live system or data reports agreed will be
granted.
2
It is intended that all Master Administration Users will be able to receive training via one-day seminars to be held by Gemserv
from time-to-time.
3. On-going use of ECOES
3.1
Help and Support
The CAS provides a helpdesk service for all ECOES users, including third-parties who are receiving
regular reports. This helpdesk is available during normal office hours and can be contact via
telephone on 0207 090 1024 or email at CAS@Gemserv.com.
3.2
Monitoring
The CAS monitors use of ECOES and the data therein; in particular volumes of searches made by
users of the live service are checked along with checks to ensure that data are not being passed to
other organisations or being utilised for purposes outside the stated reason for access. If any misuse
if suspected, CAS will make a report to MEC who can withdraw access without notice in extreme
cases.
3.3
Licence and Audit
Licences for access to ECOES are generally renewable annually, and on renewal may be varied in
regard to the access terms and/or costs
In addition, an annual audit will be carried out at, with reasonable charges being made to the applicant
for this.