Security Consultants / Security Managed Services

Transcription

1 Security Consultants / Security Managed Services Service Definition Document for G-Cloudv7 Services October 2015

2 Table of Contents Service Overview...3 Our Approach... 3 Features... 3 Benefits... 4 ON-BOARDING AND OFF-BOARDING PROCESSES...4 On-Boarding... 4 Off-Boarding... 5 INFORMATION ASSURANCE...6 Backup/Restore and DR Provision... 6 Be-IT Security Policies... 6 SERVICE MANAGEMENT DETAILS...7 Technical Boundary... 7 Support Boundary... 7 User Authorization and Roles... 7 General Support details... 7 SERVICE CONSTRAINTS...8 Planned Maintenance... 8 Emergency Maintenance... 8 SERVICE LEVELS...8 Financial recompense...8 TRAINING...8 ORDERING & INVOICING PROCESS...8 TERMINATION TERMS...9 DATA EXTRACTION /REMOVAL CRITERIA...9 Data standards in use... 9 Consumer generated data... 9 Data extraction... 9 Price of extraction... 9 Purge & destroy... 9 DATA PROCESSING AND STORAGE LOCATION(S)...9 DATA RESTORATION / SERVICE MIGRATION...9 CUSTOMER RESPONSIBILITIES TECHNICAL REQUIREMENTS BROWSERS DETAILS OF ANY TRIAL SERVICE AVAILABLE Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 1

3 ICT Greening Policy Compliance ICT Strategy Policy Compliance W3C Compliance Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 2

4 Service Overview Our Security Managed Service delivers enhanced support to in-house technical and security teams when transitioning from legacy estates to cloud based services. Be-IT s approach to security managed services is to realise our client s objectives by determining the optimal supporting resource mix throughout the lifecycle of a programme. We provide a bespoke service for all our clients. Whether you require a large fully managed team of security analysts or a short term call off assignment for a highly skilled CISO, we have a value add, cost effective solution for you. All of our security managed service staff maintain accredited qualifications and bring predictability to business and technical transformation. Our staff are strong communicators who deliver outcomes focusing on technical delivery that complements and delivers holistic results maximising return on investment and value for money whilst delivering services under the principle policies and strategies of our client. Achieving this by blending appropriate programme methodologies to deliver in an agile and assured way. We can provide senior security staff who can lead / mentor technical teams delivering skills transfer, leaving capability embedded in our client s staff base. For large programmes we can provide teams of security resources to supplement client staff at peak periods of activity resulting in improved cost efficiencies throughout the life of a programme. Clients have the choice of managing the team directly or should they prefer, Be-IT can manage the team and all outputs against a set statement of works. Our Approach Our on or off site service is designed to support clients who are undertaking transformational change and require a professional resourcing service that improves the overall security capability within their organisation. Our bespoke security managed service solutions are especially valuable when there is more work that your internal team can cope with, there are peaks and troughs in work volumes that require short term input or when a programme is suffering resource attrition at critical times during its lifecycle. We bring sector specific experts with processes, methods and tools, always with the focus to work with our client to optimise efficiency and maximise delivery. Features Security Managed Teams to support migration to Cloud Services Sensible cost effective pricing fitted to client needs On site and off site solutions Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 3

5 Flexible service - Fully managed teams to one off consultant Fast deployment within 1 week Accredited Consultants Sector specific knowledge and experience Process review and redesign using proven tools, methods, processes, people Scalable model designed to fit programme needs and deliver best value Pricing options to fit Time & Materials, Fixed, Risk & Reward Benefits Seasoned technical professionals who implement best practice Dedicated team assured for duration of programme Large scale public and private sector programme experience Flexible offering reducing costs - scales in line with programme demand IP/Templates retained by client after project no cost Up skill and mentor client team ready for future change Fully vetted staff CRB / SC / DV Short term call off support available Discounts offered based on volume and duration Can be tailored to fit other Be-IT offerings e.g. Project & Programme Management ON-BOARDING AND OFF-BOARDING PROCESSES On-Boarding Our work is carried out under a quality assurance system that is equivalent to the ISO9000 framework with senior level continuous review of progress and outputs. The on-boarding or programme initiation phase of our service will include a Programme/programme initiation workshop where we will define The scope of the programme and constituent programmes Objectives Benefits and benefits realisation strategy Timelines and resources Risks and the risk management process Roles and responsibilities Project governance and reporting Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 4

6 Information Assurance approach and information handling processes Knowledge management strategy The programme initiation workshop is the forum to encourage a team based approach where client staff can work with Be-IT to understand each other s approach, culture and capabilities. Having agreed information assurance and data handling processes at the initiation workshop, customers can then begin sharing data with Be-IT. Initiation & Onboarding Embedding Operational Proposal / Contract Agreement Define SOW Establish required IP Agree final team Onboard / Client Induction Conduct As / Is Review Report Recomemdations Implement agreed Approach Engage stakeholders via workshops Embed new approach / processes Deliver Operational Service Monitor and report service weekly view on site Lead Continual optimisation Up Skill Client staff Monthly account review with BE-IT Account Director Overview of Be-IT On boarding process In terms of personnel, Be-IT s pool of permanent staff and associates gives us a highly responsive and flexible capability to bring scalable and fitting resources to bear to a programme and potential constituent programmes Off-Boarding All client documents / data will be returned to the client on conclusion of the programme. Where we have retained Be-IT documents we will securely archive them in UK based storage infrastructure. Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 5

7 INFORMATION ASSURANCE Be-IT intend to apply for ISO27001:2005 accreditation in Q and is registered under the Data Protection Act. As such, we have a full set of information assurance processes and standards to protect all customer and internal data in transit and at rest. Also IS policies for all staff and locations are included within the scope of our standards. As this service does not include the provision of an application or infrastructure service, our information assurance policies and procedures relate to the exchange and handling of data such as business cases, requirements, designs and implementation plans. All of Be-IT s staff and associates are required to go through a pre-employment screening process which we consider to be, at a minimum, equivalent to the Government s Baseline Personnel Security Standard All our employees are rigorously vetted and checked for professional accreditations/certificates and all our employment contracts ensure confidentiality when providing professional services to assure clients of the highest levels of integrity and service provision. Connectivity to customer s environments for working instruments are subject to client s governance. However Be-IT undertakes to manage company equipment and provide sufficient governance to assure the integrity of those devices used. We confirm that our IT systems and security policies meet HMG Security Policy Framework v11, Business Impact Level 3 and that we can provide, if requested, a security policy plan demonstrating how our IT systems and security policy compare against the framework. We will use secure technology to ensure the secure transfer of electronic data between the Be-IT and its customers. Backup/Restore and DR Provision Any material which is collected in the process of undertaking engagements and stored on laptops etc. are subject to automatic backups as part of Be-IT s normal operating methods. Be-IT Security Policies Our standards, processes and practices are regularly audited to ensure that we have a comprehensive and robust information and security management regime in place. There are no specific criteria associated with the deployment of this service. Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 6

8 SERVICE MANAGEMENT DETAILS Technical Boundary All hosting of data generally takes place within Be-IT s secure network perimeter or within the customer s network. Information is only exchanged in encrypted form between the two. There are no explicit technical boundaries to this service however the service is being offered in the context of Professional Services associated with Programme Management skills. Our services are deployed in a wide variety of environments with various organisation profiles and technical environments e.g. SIAM Support Boundary There are no explicit support boundaries to this service. Be-IT provides a Helpdesk/Contact facility and it s engaged employees are available to provide advice/guidance and support in the context of the engagement and as a minimum through normal office hours. Be-IT regularly helps customers solve complex problems within their own environments. Any additional support requirements will be the subject of discussion with the customer and subject to SFIA rate card. User Authorization and Roles There are no specific requirements related to this service. Engagement of Be-IT staff who are required to access material or systems on a client s premises are expected to be provided at the customer s discretion and any enrolment or authorisation process will be followed by Be-IT employees. It is incumbent on the customer to ensure sufficient privileges and access to data is provided to support the timely execution of Be-IT s services to maximise the timeliness of agreed deliverables General Support details Be-IT operates an incident management service which provides a full technical issue resolution service on both Be-IT and customer infrastructure. Key features of Be-IT s support services are: - Telephone and support available - Clear escalation procedures with accountable, named contacts - Event/Incident logging & Management - Issue resolution - Escalation process - Reporting including event closure and customer satisfaction feedback Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 7

9 SERVICE CONSTRAINTS Planned Maintenance This does not relate to this service. Emergency Maintenance This does not relate to this service SERVICE LEVELS Be-IT agrees individual service level agreements tailored to each client s requirements. Financial recompense Be-IT offer financial recompense models which are tailored to client s requirements using service credits. TRAINING Be-IT has extensive competence and experience in delivering coaching, mentoring and training services to client staff. If other customer training is required as part of the service the scope and nature will be specified during the on-boarding process ORDERING & INVOICING PROCESS Be-IT accepts electronic orders and issues electronic invoices. Where we are delivering a fixed price programme, invoicing is managed according to the payment schedule agreed in the contract. Invoices are triggered when the appropriate quality criteria and sign-off of deliverables is achieved. For time and materials engagements, invoices are submitted monthly in arrears. In all cases, payment of invoices is strictly 30 days. Customers are assigned an individual contact within our administration and finance teams so that any issues, queries or concerns can be dealt with quickly and effectively. Our finance and administration team is based in the UK and we can be contacted directly by phone or . Payment can be via the following methods: Direct Debit, Debit / Credit card, BACs, CHAPS Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 8

10 TERMINATION TERMS As there is no provision of application or infrastructure services as part of this service, the notice of termination applies to the programme or design service. Customers may terminate any service with 30 days notice Other rights of termination are included in our T s & C s. DATA EXTRACTION /REMOVAL CRITERIA Data standards in use We will not process or store customer data sets as part of this service Consumer generated data We will not process or store consumer generated data sets as part of this service Data extraction We will not process or store customer data sets as part of this service Price of extraction There is no charge for returning customer data Purge & destroy We securely archive any relevant input documents that were used as part of a system or programme recommendation. Data is purged after the regulatory period we are required to hold it for. DATA PROCESSING AND STORAGE LOCATION(S) All data is privately hosted in the UK DATA RESTORATION / SERVICE MIGRATION As there is no direct access by customers to the data used in Be-IT s programmes, this section does not apply Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 9

11 CUSTOMER RESPONSIBILITIES Customer responsibilities will be agreed at the initiation phase of the programme and included in a Project Initiation Document. Typically these will include providing a main point of contact, provision of working facilities, making staff available for interviews and workshops and programme meetings, and timely approval and acceptance of all key deliverables. TECHNICAL REQUIREMENTS Any technical requirements, service dependencies and technical interfaces will be defined and agreed with the client at the programme initiation stage. BROWSERS There are no specific requirements associated with provisioning this service. DETAILS OF ANY TRIAL SERVICE AVAILABLE There are no trial offers associated with this service. ICT Greening Policy Compliance Be-IT completely endorses the UK Government s policy to provide a cost effective and energy efficient ICT estate, which is fully exploited, with reduced environmental impacts to enable new and sustainable ways of working with our customers. We seek relationships in the delivery of services with those entities that have both ethical commitments to schemes endorsing Carbon reduction policies. Our clients can be assured that this solution is delivered in accordance with best practice and our environmental management policy which may be provided upon request. Be-IT Environmental Management Policy has been formulated to prioritise actions relevant to dealing with products and services linked to our core business areas. It is directly linked to the environmental management policy set by senior management. The executive sponsor is directly responsible for ensuring that the plan includes regular documented updates so that crucial operational practices and responsibilities are formally reviewed, revised, and appropriately redeployed in the most effective and appropriate manner. Our aim is to maintain a best practice Energy Management System to monitor, measure, report and reduce energy use. Our datacentres use e-sight energy management system to track electricity consumption every half hour, providing trends Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 10

12 and enabling more accurate forecasts in energy usage. The system is used to establish the energy saving benefits of Environment Management Programmes/Initiatives. The following is extracted from our Environmental Policy, a copy of which may be provided upon request) Be-IT s goals are to: set and strive to minimize its environmental footprint work with suppliers to reduce the impact of its products and services and providing information to its stakeholders incorporate environmental consideration into its core business plans and management practices reduce its paper use by increasingly offering software and online products to its customers purchase and make use of responsibly sourced paper, according to generally acknowledged certification schemes of FSC, SFI and PEFC work closely with its employees, customers, suppliers and other parties to continuously refine its work practices and operations promote green procurement consider the environment as one of the criteria when involved in purchasing decisions promote alternatives for business travel such as teleconferencing, videoconferencing and presentations via internet ( webinars ) monitor its environmental performance comply with applicable legal requirements ICT Strategy Policy Compliance Be-IT is committed to supporting the UK Government s aspirations and objectives to improve both the image and performance of services provisioned through ICT resources. We anticipate that the types of services we offer will particularly support the development of and achievement of the Intelligent Customer Function through the provision of services that support informed decision making to maximise outcomes in the provision of services that support the Digital by Default strategy and associated policies. Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 11

13 W3C Compliance Be-IT is committed to continue to develop it s services to support social inclusion and commits to continue to develop the provision of services that allow access to them. We have made significant investment to align our digital service offerings to best practice in delivering W3C based services. Whilst our services for GCloud are not provided through a web portal we are cognizant of the requirements for inclusiveness and our services consider these requirements as part of their delivery and where it is applicable. Be-IT Resourcing Copyright /9 North Saint David Street, Edinburgh, EH2 1AW tel: info@be-itresourcing.com web: Security Consutlants & Security Managed Services - Service Definition G-Cloudv7 Page 12