G-Cloud Service Definition. Atos Infrastructure as a Service (IL3) for Cloud IaaS

Transcription

1 G-Cloud Service Definition Atos Infrastructure as a Service (IL3) for Cloud IaaS

2 Atos Accredited Secure Cloud Infrastructure as a Service (IL3) Robust, secure, scalable Cloud computing and consumption-based services that brings innovation and agility to public service delivery; part of the Atos Accredited Secure Cloud suite. Infrastructure as a Service provides flexible options for customers to deploy their services to a pre-define platform in a secure environment. The Atos Accredited Secure Cloud Infrastructure as a Service (IL3) is undergoing Pan Government Accreditation (PGA) and is expected to achieve accredited status by Q2/2014. Atos Accredited Secure Cloud IaaS (IL3) Leveraging the knowledge, expertise and experience that Atos has built with Cloud hosting, specifically with the Atos Accredited Secure Cloud offerings, Atos can provide a host of benefits to the customer. Lower cost solution Utilising multi-tenanted, pooled resources that currently support many IL3 customers hosted within an IL3 Pan Government Accredited and approved cloud environment. Simple Pricing Atos Accredited Secure Cloud offers a simple menu pricing for the service set-up and a straightforward monthly costs based on server/data volumes and network bandwidth usage. Automation Automated provisioning of Virtual Machines into the customer environments to enable IaaS services to be available in an agile and timely manner. Simple to use Basic empty hypervisor or bare metal server is made available for the customer to load their choice of OS and application packages. Use the service for Production, Testing or utilise development tools and services. Proven technology Highly commoditised, scalable and multi-tenanted service that supports many thousands of users to deliver critical business services. Broad Network Access The customer may utilise Public Sector Network (IL3), Private WAN (IL3) or Internet network connections to and from the Atos Accredited Secure Cloud service. Measured Service Reporting of billed time offered as standard within the IaaS service. Elasticity The service is able to scale to meet the customers needs, either to scale outward to meet seasonal peaks, or scaled back as required. ii

3 Experience Atos are a leader in the Cloud Hosting services, especially within UK Government, with many established customers actively using the service. Pan-government The instance of the IaaS service described here is dedicated to UK Government and is subjected to Pan Government Accreditation to host operating systems and applications to IL3. Flexibility Customers can use the secure IaaS environment for various purposes, such as Development & Testing, Analytical systems or Web delivery. The Atos Infrastructure as a Service (IL3) when viewed at its most basic level will provide the customer with the following standard features. Product Standard Features A cloud hosting environment which is multi-tenanted and pending full PGA Accreditation for IL3 services Consume an empty Hypervisor and/or a bare metal server to which the customer may use with their choice of Operating System 1 and Application software Primary cloud services environment, with a single production VLAN Enterprise class storage Standard server specification sizing Receive basic hardware monitoring and alerting Broad network connectivity options such as PSN (IL3), Private WAN (IL3) and Internet Standard Service Availability of 99.9% - Please note that all availability figures are subject to planned maintenance windows. Optional Features Additional sizes of building blocks for Compute, RAM and Storage available Backup options 2 ranging from a single site weekly backup to offsite daily backups with additional data retention periods Secondary cloud hosting environment for non-production and Disaster Recovery environments Additional VLAN s and/or Domain Services Additional network Bandwidth Consume optional integrated tooling 3 for GPG13 compliant Protective Monitoring and server management facilities iii

4 Can be provided with a full service wrap, including service management, backup/recovery, disaster recovery, implementation planning and management and data migration if the customer so wishes Secure Support Access option, where the customer can utilise a secure laptop and security token to access services within Atos Accredited Secure Cloud via an encrypted Internet connection 1 Subject to the chosen Operating System Hypervisor compatibility. 2 Subject to compatibility with customer supplied Operating system and Application Software. 3 Subject to compatibility with the customer Operating system and/or Application Software. What makes us unique? Although the Atos Accredited Secure Cloud IaaS (IL3) service is undergoing Pan Government Accreditation, once achieved, this will uniquely place Atos to provide a secure, reliable, scalable and flexible Infrastructure as a Service platform. Atos through other Cloud catalogue services, such as PaaS (Platform as a Service) have provided secure IL3 hosting for a number of customers within the UK Government sector. Atos is one of the first suppliers to have gained PGA approval for a shared PSN access zone, utilising PSN IPED technology to multiple data centres True multi-tenanted cloud hosting accredited to UK Impact Level 3 High availability and resilience can be provided at the network, server and storage tiers Automated provisioning that speeds the provisioning of new services into the Atos Accredited Secure Cloud service. The Pan Government pricing agreement available from Atos ensures value for money and confidence that the service meets the needs of the government sector. Atos Accredited Secure Cloud offers a selection of on-boarding options to match the needs of small, medium and large customers to ensure low cost of entry regardless of how many servers or services are required. Infrastructure as a Service (IL3) includes a number of basic elements, which customers may use to deliver cost effective, robust and secure applications and services. The following list describes the basic components included within the service. One multi-tenanted and secure IL3 Cloud Hosting Environment Basic Virtual Machine or bare metal server to allow the customer to deploy their own operating system and application software Automated provisioning A single production VLAN (Virtual LAN) Broad network support allowing applications and services to be consumed via Public Services Network (IL3), Private WAN (IL3) and Internet channels Flexible IaaS building blocks and scalability Basic hardware / hypervisor monitoring iv

5 Enterprise Storage Monthly billing and resource usage reporting Service Management Wrapper. Optionally, the customer may add to their IaaS services with additional features, such as additional VLAN s, Backup/Recovery, Disaster Recovery via secondary cloud hosting environment, Atos High Performance Security Protective Monitoring (Total Real-time Security Monitoring and Management) and extended support arrangements. Atos IL3 Accredited Secure Cloud IaaS (IL3) offers secure, flexible and scalable hosting for systems requiring UK impact level IL3 security. The Atos solution enables public services agencies to: Move existing (and new) information processing needs into highly secure and scalable cloud architectures Have flexibility to deploy a mixed-economy of operating systems and applications to the IaaS service platform Optionally utilise GPG13 compliant Protective Monitoring and Server Management tooling that can be provided to the customer, subject to compatibility with customer supplied OS and Application software Use rapid and agile deployment of new services into the cloud Benefit from virtualised environments to increase efficiency, availability and mobility and reduce carbon footprint Benefit from highly scalable services to ensure that the service is scaled to the customers demands Securely access and manage the services from PSN (IL3) or Private WAN (IL3) connections Expose Internet facing applications and services to your user communities and customers. Through small and medium enterprises or other partnerships, Atos can also host thirdparty applications within Atos secure accredited facilities. v

6 vi

7 Contents 1. Introduction Service Summary Important service characteristics How this product can be used Sustainability Service overview Service Features Logical Service Model Shared Access Zones Dedicated Access Zone Secure Zone PSN (IL3) Network Connectivity Technical Features Service Roadmap Information assurance Backup/restore and disaster recovery Data Protection Services Disaster Recovery Disaster Recovery Plans On-boarding and off-boarding On-boarding Off-boarding Pricing Standard Feature Pricing Atos Infrastructure as a Service (IL3) Products Atos Additional Virtual Compute Resource Units Atos Alternative Physical Compute Resource Units Storage Resources External Bandwidth Optional Feature Pricing Data Protection Schemes Disaster Recovery Options Optional Tools Additional VLANs vii

8 6.12 Microsoft Windows Domain Services Service Reports Service management Basic Service Monitoring Optional Reporting Service constraints Maintenance Windows Service levels Service and Support Availability Service Incident Definitions Financial recompense Training Ordering and invoicing process Termination terms By consumers (i.e. consumption) By the Supplier (removal of the G-Cloud Service) Data restoration / service migration Data Discovery Data Migration Readiness Health Check Data Migration Implementation Data Quality Health Check Customer responsibilities Technical requirements Trial service Glossary viii

9 1. Introduction This document describes Atos Infrastructure as a Service (IL3) products that are available via the G-Cloud Framework. The Atos Accredited Secure Cloud Infrastructure as a Service (IL3) is undergoing Pan Government Accreditation (PGA) and is expected to achieve accredited status by Q2/2014. Atos has a long history and experience in the successful delivery of services to UK Government covering a wide range of demanding requirements. The services described within this document are actively deployed to support a number of existing UK Government departments that have IL3 requirements and are available to support further customer deployments. For requirements that do not require IL3, Atos has complementary service offerings that reflect different security accreditation requirements for IL Service Summary Atos Infrastructure as a Service (IL3) provides secure computer processing and storage in a flexible and secure manner. When viewed at its core level it will provide the customer with the following standard features. Product Standard Features A cloud hosting environment which is multi-tenanted and pending full PGA Accreditation for IL3 services Consume an empty Hypervisor and/or a bare metal server to which the customer may use with their choice of Operating System 1 and Application software Primary cloud services environment, with a single production VLAN Utilise enterprise class storage Basic server specification sizing Receive basic hardware monitoring and alerting Broad network connectivity options such as PSN (IL3), Private WAN (IL3) and Internet Standard Service Availability of 99.9% - Please note that all availability figures are subject to planned maintenance windows. Standard Service Availability plan included (see section 9.1). Optional Features Additional sizes of building blocks for Compute, RAM and Storage available Backup options 2 ranging from a single site weekly backup to offsite daily backups with additional data retention periods Secondary cloud hosting environment for non-production and Disaster Recovery environments Additional VLAN s and/or Domain Services Network connectivity and bandwidth 1

10 Consume optional integrated tooling 3 for GPG13 compliant Protective Monitoring and server management facilities Can be provided with a full service wrap, including service management, backup/recovery, disaster recovery, implementation planning and management, data migration and security accreditation if the customer so wishes Secure Support Access option, where the customer can utilise a secure laptop and security token to access services within Atos Accredited Secure Cloud via an encrypted Internet connection 1 Subject to the chosen Operating System Hypervisor compatibility. 2 Subject to compatibility with customer supplied Operating system and Application Software. 3 Subject to compatibility with the customer Operating system and/or Application Software. Appropriate network connections are established that enables citizen / customer access, and civil servant / staff relevant and controlled access, to these services, via customer provisioned operating systems and application(s). 1.2 Important service characteristics UK based: All data is held and processed within the UK data centres No data is sent or held off-shore No processing of information assets is carried out off-shore and is wholly managed in the UK territory Secure: Environments and operations management processes are accredited to the appropriate UK impact level (IL3) Cleared: All operations staff are UK Security Check (SC) cleared Automated: Atos manages the infrastructure with tooling that includes basic remote hardware monitoring, auditing and alerting, providing a view of the status of the services to the Atos Operations Centre Flexible service options: as described in Section 6, Atos provides a flexible set of service options to support the customers needs in the most effective way Processing capacity: commoditised infrastructure that is able to scale to meet customer capacity demands Accredited Infrastructure: hosted alongside the Atos IL3 (PGA) Accredited Secure Cloud Platform as a Service (PaaS). 1.3 How this product can be used Atos Infrastructure as a Service (IL3) provides secure, flexible and scalable hosting for systems requiring UK impact level IL3 security. There are differing levels of services available which are based upon decades of experience in supporting critical systems. These services provide Public bodies with the opportunity to: Move existing (and new) information processing needs into highly secure and scalable cloud architectures Can be used to build an n-tier architecture Can be used for Development, Testing, Proving and Production systems Have flexibility to deploy a mixed-economy of operating systems and applications to the IaaS service platform 2

11 Optionally utilise GPG13 compliant Protective Monitoring and Server Management tooling that can be provided to the customer Use rapid and agile deployment of new services into the cloud, underpinned by automated provisioning tools within ASC Benefit from virtualised environments to increase efficiency, availability and mobility and reduce carbon footprint Benefit from highly scalable services to ensure that the service is scaled to the customers demands Securely access and manage the services from PSN (IL3) or Private WAN connections Expose Internet facing applications and services to your user communities and customers Obtain secure hosting for a wide variety of purposes, from testing and development environments through to large scale production systems. 1.4 Sustainability In line with Atos' corporate Sustainability policies, Atos IL3 Accredited Secure Cloud is delivered in an environmentally responsible manner. A significant factor in providing infrastructure services is the use of electricity for both powering and cooling. Atos considers power needs carefully when designing and building its services, not just with respect to servers and networks, but also in the design of the environments and racks used in its data centres, including migrating to cold-aisle containment to optimise cooling. Atos Principles for its Atos IL3 Accredited Secure Cloud platform include: Virtualization wherever possible to reduce wasted consumption Hardware with low power consumption and cooling requirements to ensure high capacity/power consumption ratios Software with solid power efficiency control functionality Data centre equipment that tracks power consumption and thermal reporting, optimizes fan operation, and switches off elements that are not active. Atos is certified globally as following the management practices required by the ISO Environmental Management standard. 3

12 2. Service overview 2.1 Service Features The Atos Accredited Secure Cloud Platform as a Service (IL3) feature set is able to support the key cloud criteria as defined by NIST:- On-demand services allowing the customer to request additional resources and services as required, supported by the automated provisioning tooling; Broad network access providing options for Public Services Network (IL3), Internet and Private WAN (IL3) connectivity; Resource Pooling providing a multi-tenanted environment, where resources can be assigned or re-assigned to tenants within the environment; Elasticity enabling the customer to alter and scale their services as needed and requested; Measured monthly billing and reporting available to the customer. 2.2 Logical Service Model The Atos Infrastructure as a Service (IL3) solution comprises of the basic hosting building blocks, in both a virtual and physical form, to enable rapid deployment and hosting within the cloud. This equates to either a physical blade server or Virtual Machine, with no operating system or tooling. Atos will provide basic monitoring of the hardware and virtualisation hosts. The Atos Accredited Secure Cloud environment fully supports multi-tenancy, customer servers, data and network connections are protected by the method of segregation established within the PGA accreditation for PaaS. Customer assets are protected by the use of clear segregation of applications and services. This segregation takes the form of Access Zones to terminate network traffic from the customer/psn connections, logical separation of customer IaaS services, and secure boundary controls to the Secure Zone (shared). Customers always access their IaaS services via an Access Zone, and may optionally host PaaS services within both the Access and Secure Zones. These zones are described in further detail in the coming sections of this Service Description Shared Access Zones The Atos Infrastructure as a Service (IL3) solution requires that external network communications ingress the service via a nominated Access Zone(s). ASC has an established service capability in shared access zones, which allow many customers who reside at the same Impact Level (IL3) to co-exist within the service, whilst their application processing and data storage are logically separated. Access zones provide a secure, reliable and auditable route for traffic to enter, be processed and managed within the Atos Infrastructure as a Service (IL3) environment. Customer services built upon the IaaS service platform may optionally integrate with various tools and services to provide a broader platform management capability (such as GPG13 compliant Protective Monitoring or platform patching). The customer services can quickly be deployed to these shared zones, ensuring faster service commencement and clear segregation between customers systems. 4

13 All prices are based upon hosting within shared zones only. Other deployment approaches are supported and are priced on request Dedicated Access Zone Where your requirements may not fit the standard shared Access Zone model, Atos Infrastructure as a Service (IL3) can provide a dedicated access environment Secure Zone The secure zone is a multi-tenanted area which allows many customers, with similar impact level hosting requirements (IL3) to host their applications and data services. Since the secure zone is physically separated from the Access Zones, this provides an extra level of protection to your systems, services and data. Customer services built upon the IaaS service platform within the Secure Zone may optionally integrate with various tools and services to provide a broader platform management capability (such as GPG13 compliant Protective Monitoring or platform patching) PSN (IL3) Network Connectivity Atos provides IL3 connectivity to the PSN via the Inter Provider Encryption Domain (IPED). The SLA offered for this connection aligns to those outlined in the PSN Technical Domain Description (TDD). Our PSN connectivity is built for a high level of resilience at each data centre used for the GCloud service, employing full redundancy with diverse routing. Customers wishing to use Atos IL3 GCloud services over the Public Services Network (PSN) must have an accredited PSN Code of Connection Compliance at the relevant Impact Level and use a PSN Direct Network Service Provider (DNSP) who can offer IPED IL3 services to Atos DNSP. The provisioned bandwidth on the customer access to the PSN IPED must be equivalent to that required for the Atos service delivery and any other services from other providers or legacy networks. 2.3 Technical Features The Atos Infrastructure as a Service (IL3) solution is based upon highly robust, scalable and standardised technology patterns. It is designed to be flexible, offering both physical and virtualised IaaS platforms. The key features are presented in the following table. 5

14 Product Capabilities Description Operating System OS Licenses Availability IaaS Virtual Customer Supplied 1 1 Subject to compatibility with either the Hypervisor host and/or physical hardware. Customer supplied 99.9% - Availability figures are subject to planned maintenance windows. Single or Multiple Virtual machines hosted on highly scalable blade architecture. Standard (minimum) Configuration: CPU (x64) 1 vcpu running at 1.5Ghz RAM - 1GB Storage SAN based, 1GB 2 Other configurations are available (see section 6.3). 2 Additional user addressable storage may be specified in section 6.5. IaaS Physical Storage VLANs Access Zones Service Catalogue Data Centre HW Assets Single blade server, available in a number of sizes and configurations. Standard (minimum) Configuration: CPU (x64) One CPU x 6 Cores 2.3Ghz RAM 8GB Storage SAN based, 1GB 1 Other configurations are available (see section 6.4). 1 Additional user addressable storage may be specified in section 6.5. SAN storage. A single Production VLAN is provided for use by the customer s services. The service requires that the customer terminates traffic into one of the following Access Zones (please see above for details). Internet Access Zone Ideal for hosting internet facing applications and systems. PSN Access Zone (IL3) This shared access zone, with connectivity to the IL3 Accredited Public Services Network (PSN) allows government departments to host application services that can be consumed by their own, and potentially other departments. Private WAN (IL3) Where a customer s requirements do not fit the standard shared access zone model, a dedicated customer access zone may be provided for the exclusive use of that customer. Pricing information is based on the use of a shared access zone (Internet or PSN). Included UK Based Data Centres Owned and Financed by Atos 2.4 Service Roadmap This Service Description provides information relating to the Atos Infrastructure as a Service (IL3) but additionally describes the following additional services: Automated billing. Although these services are not currently included within the scope of the current IaaS Services, they will form part of the next service release. 6

15 3. Information assurance The Atos Infrastructure as a Service is currently available at Impact Level 3 (IL3), and is undergoing Pan Government Accreditation (PGA), expected to be achieved in Q1/2014. The Infrastructure as a Service (IaaS) is based on components from the Atos IL3 Accredited Secure Cloud Platform as a Service (PaaS). Atos has considerable experience of providing services at different levels of assurance. Atos Accredited Secure Cloud currently has a number of products on G-Cloud. Details can be found on the Cabinet Office website at: These services include: Atos Platform as a Service (PGA Reference G , RMADS v1.1, 21 March 2013) has been granted full accreditation for the period 10/04/2013 to 30/04/2014 for impact levels 3, 3, 4 (confidentiality, integrity and availability) Atos High Performance Security (Re-branded in G5 to Total Real-time Security Monitoring and Management) (Reference G , RMADS v1.1 8 March 2013) has been granted full accreditation for the period 10/04/2013 to 30/04/2014 for impact levels 3, 3, 4 (confidentiality, integrity and availability). Atos holds global multi-site ISO 27001:2005 certifications that cover all of our UK locations and we are therefore also able to provide a comprehensive range of other IT services complying with lower IL (0,1, & 2) requirements that are delivered in accordance with the recommended ISO27001 controls. Independent audits of our compliance with ISO9001:2008 and ISO27001:2005 second surveillance are performed by EY CertifyPoint. EY CertifyPoint is the certification body chosen by Atos to deliver global multi-site certifications for ISO :2011, ISO9001:2008, ISO27001:2005 and ISO14001:2004+Cor 1:2009. Since Atos group is a worldwide organization with multiple sites and locations, EY CertifyPoint follows the rules mentioned in International Accreditation Forum Mandatory Document for the Certification of Multiple Sites Based on Sampling (IAF MD-1). The Atos IL3 Infrastructure as a Service is currently seeking G-Cloud accreditation at the time of publication. 7

16 4. Backup/restore and disaster recovery 4.1 Data Protection Services The Atos Infrastructure as a Service (IL3) platform offers differing levels of optional data protection schemes, which have been designed to offer flexibility in meeting backup requirements. Each of the options in the table below can be used in-conjunction with the Atos Infrastructure as a Service (IL3) product *. ID DP-001 DP-002 DP-003 DP-004 DP-005 Description Basic data protection scheme: 1 Full Backup per Week Backups are retained for 28 days Backups retained within local site Weekly data protection scheme: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days Backups retained within local site Weekly, monthly and yearly data protection scheme: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days 1 full backup per month retained for 12 months 1 full backup per year retained for up to 7 years Backups retained within local site Weekly data protection scheme with dual copy: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days Backups retained within local site Backups retained off site Weekly, monthly and yearly data protection scheme with dual copy: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days 1 full backup per month retained for 12 months 1 full backup per year retained for up to 7 years Backups retained within local site Backups retained off site * Since the IaaS service provides either an empty Virtual Machine (VM) or bare physical blade server, the Data Protection service compatibility will need to be assessed against the customer provisioned operating system and application services. Standard agents are available for a number of operating systems and can be made available upon request. 4.2 Disaster Recovery Flexible options are available from the Atos Infrastructure as a Service (IL3) for continued service availability in the event of a major disaster. Each of the options presented within the table below can be optionally specified and utilised. Data stored and processed within the Atos Infrastructure as a Service (IL3) platform resides within UK data centres only. Please note that the following plans are subject to compatibility of customer deployed operating system and applications, and subject to the appropriate offsite Data Protection plan being selected. 8

17 4.2.1 Disaster Recovery Plans Plan Description What is Included Dependency Foundation Backup media based with a shared passive standby PaaS server. The customer backup will be restored to the Secondary Cloud service utilising shared, pooled compute resources (if available). Minimum Requirement of Data Protection Plan DP-004 Hot Standby Hot standby server in Secondary Cloud environment. The customer will purchase PaaS services within the Secondary Cloud service, and have their Data replicated from the Primary Cloud service. Minimum Requirement of Data Protection Plan DP-004 or DP-005 Virtual Machine Recovery SAN based replication of entire VM with allocated ready to boot standby server. The customer will purchase and preallocate compute resources within the Secondary Cloud service, and have their Virtual Machines replicated from Primary Cloud Service ready for instantiation. Minimum Requirement of Data Protection Plan DP-004 or DP-005 9

18 5. On-boarding and off-boarding 5.1 On-boarding Atos provides a common on-boarding approach for Atos Infrastructure as a Service (IL3), tailored to the specific requirements of each customer/application, including: New Customer on-boarding and account set up Service / Application on-boarding Ordering and invoice process Change process Termination process Customer responsibilities (including the responsibility to own accreditation for requirements over and above those supported by the PGA platform accreditation) Data backup, DR and migration Technical requirements, dependencies, interfaces, data standards Information Assurance activities to ensure that accreditation requirements are maintained end to end, and in particular that data transfers are handled with appropriate controls User access on-boarding, including general users, administrators and any application-specific user communities Network connectivity, including secure internet connectivity, secure government network connectivity, secure remote access, and options for dedicated lines where appropriate Notification of service transition From signature of contract to service live the typical duration is between 6 and 8 weeks. Atos provides a single page on-boarding form enabling contact details and the Customer s area of interest to be registered at the following address: After acceptance by Atos of an order for Atos Infrastructure as a Service (IL3), our on-boarding process will be initiated, which is based on the following steps, but will be scaled flexibly in accordance with customer requirements: Establish the Parent Project (which may be a larger project where only part of the requirement is provided by ASC) Assign an ASC Transition Project Manager and ASC Transition Technical Architect to the on-boarding process Engage with the Parent Project Team and Service Acceptance Manager Initiate Client Acceptance Process for ASC items including Information Assurance Validate ASC Transition Plan and Provisioning Scope documents against the contracted solution and revise as required Appoint ASC Build Managers 10

19 Produce ASC Build plans to deliver the services Align Parent Project plans with the ASC Transition Plan Agree Operational Acceptance Criteria for ASC Build Plans with the individual delivery towers Agree Operational Acceptance Criteria for the total Parent Project Obtain signed-off ASC Operational Acceptance for Build Plans and Parent Project (including any dependencies on successful User Acceptance Testing by the Customer). 5.2 Off-boarding Off-boarding is based on a common approach tailored to the Customer s specific requirements: Options for data migration to other services or platforms Options for archiving customer data Server decommissioning will be undertaken in a manner compliant with the PGA accreditation, and where appropriate subject to additional charges Storage decommissioning will be undertaken in a manner compliant with the PGA Accreditation, and where appropriate subject to additional charges Final invoicing and account closure All customer supplied physical media will be returned or securely disposed of before or at the end of the service as required. All customer business data will be made available for migration, or deleted, at the end of the service or (for backups / archives) at the end of the backup / archive retention cycle. All commercial customer information will be held until the end of the reporting cycle (monthly), until all payments have been received, and then held as required for reporting / regulatory purposes Certifying that the Off-boarding process has successfully completed the actions required, in accordance with the agreed Information Assurance controls. 11

20 6. Pricing 6.1 Standard Feature Pricing The following section defines the pricing for the standard service elements that comprise the Atos Accredited Secure Cloud Infrastructure as a Service (IL3) basic product set. All pricing excludes VAT. 6.2 Atos Infrastructure as a Service (IL3) Products The following tables detail the standard Infrastructure as a Service (IL3) product offerings and their respective pricing. All prices have been based upon hosting IaaS services within a multi-tenanted, shared resource pooled environment. 1 Infrastructure as a Service / Virtual Machine Product 1 1.5Ghz 1GB RAM 1GB Storage Monthly Recurrent Price ( ) Standard Service Level Enhanced Service Level Infrastructure as a Service / Physical Machine Product Monthly Recurrent Price ( ) Product Includes Virtualisation Host Single Production VLAN Basic Hardware Monitoring Basic Support Product Includes 1 CPU / 6 2.3Ghz 8GB RAM 1GB Storage Standard Service Level Enhanced Service Level 1, , Virtualisation Host Single Production VLAN Basic Hardware Monitoring Basic Support 6.3 Atos Additional Virtual Compute Resource Units Additional resource units can be purchased to the standard virtual IaaS offerings. Please note that there are upper limits to the maximum COMPUTE (17.5Ghz) and RAM (240GB) that may be allocated to a single virtual compute unit. Resource Increment Description Units Monthly Recurring Price ( ) Standard Enhanced COMPUTE 500Mhz Additional unit of compute per Virtual machine RAM 1GB Additional unit of RAM per Virtual machine Atos Alternative Physical Compute Resource Units If the standard physical IaaS server does not meet your needs, please refer to the table below where additional sizes of physical blade server are available for deployment into the Atos Infrastructure as a Service (IL3). Class of Blade Description Units Monthly Recurring Price ( ) Standard Enhanced Medium 2 CPU (x64), 6-Cores, 64GB RAM 1 1, , High 2 CPU (x64), 6-Cores, 128GB RAM 1 1, ,

21 6.5 Storage Resources Additional user addressable storage required may be selected from the list below, and added to any Atos Accredited Secure Cloud Infrastructure as a Service (IL3) product, as per the customer needs. Storage Resources Monthly Recurring Price ( /Gb) 1 Standard Storage Use Standard for Archives, Static content with a very low IOPS need. (25 IOPS) Enhanced Storage Storage class Enhanced is used for Applications/Databases requiring SAN access with higher IOPS and limited response requirements. (250 IOPS) 3 Performance Storage Storage Class mostly used for business critical production applications/databases requiring SAN access. (500 IOPS) Extreme Storage Highest performing SAN storage class supporting intensive workloads. (1500 IOPS) 1.07 Note IOPS total per Tb is shared between tenants within the Atos Infrastructure as a Service (IL3). 6.6 External Bandwidth In order to access ASC services, connectivity to the internet or PSN will be required. The pricing is dependent on the bandwidth required, as shown in the table below. Connectivity Description Monthly Recurring Pricing (base) Monthly Recurring Price (per Mbit/sec) Internet PSN (IL3) Cloud Site Replication Connectivity from the ASC service to the internet, reserved for customer use, per data centre. Connectivity from the ASC service to the PSN, reserved for customer use, per data centre. Inter-site replication bandwidth for use with optional disaster recovery and data protection plans N/A N/A Optional Feature Pricing The following tables provide a schedule of features that may be optionally specified for use with the Atos Accredited Secure Cloud Infrastructure as a Service (IL3) product set. 13

22 6.8 Data Protection Schemes Atos Accredited Secure Cloud offers the following data protection schemes for each IaaS service commissioned. Alternative service levels are available upon request. These schemes are subject to the customer provisioned Operating System and Applications being compatible with the Data Protection service. ID Description Monthly Recurring Price ( /per GB) DP-001 DP-002 DP-003 DP-004 DP-005 Basic data protection scheme: 1 Full Backup per Week Backups are retained for 28 days Backups retained within local site Weekly data protection scheme: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days Backups retained within local site Weekly, monthly and yearly data protection scheme: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days 1 full backup per month retained for 12 months 1 full backup per year retained for up to 7 years Backups retained within local site Weekly data protection scheme with dual copy: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days Backups retained within local site Backups retained off site Weekly, monthly and yearly data protection scheme with dual copy: 1 Full Backup per Week 6 incremental Backups per Week Backups retained for 28 days 1 full backup per month retained for 12 months 1 full backup per year retained for up to 7 years Backups retained within local site Backups retained off site

23 6.9 Disaster Recovery Options The table below provides a summary of the Disaster Recovery options that are available to customers when purchasing the Atos Accredited Secure Cloud Infrastructure as a Service with the Enhanced service level. For further information as to the service levels, please refer to section 9of this service definition. Please note that certain plans have a dependency upon the appropriate Data Protection Plan being purchased alongside each Disaster Recovery Plan. Plan Description What is Included Dependency Price ( ) per Server Foundation Backup media based with a shared passive standby PaaS server. The customer backup will be restored to the Secondary Cloud service utilising shared, pooled compute resources (if available). Minimum Requirement of Data Protection Plan DP-004 Multiplier of x1.5 to all prices in sections 6.2, 6.3, 6.4, 6.10, 6.11 and 6.12, for the scope covered by this DR level. Sufficient cloud site replication bandwidth (6.6) must also be purchased. Hot Standby Hot standby server in Secondary Cloud environment. The customer will purchase PaaS services within the Secondary Cloud service, and have their Data replicated from the Primary Cloud service. Minimum Requirement of Data Protection Plan DP-004 or DP-005 Multiplier of x2.05 to all prices in sections 6.2, 6.3, 6.4, 6.5, 6.10, 6.11 and 6.12 for the scope covered by this DR level. Sufficient cloud site replication bandwidth (6.6) must also be purchased. Virtual Machine Recovery SAN based replication of entire VM with allocated ready to boot standby server. The customer will purchase and preallocate compute resources within the Secondary Cloud service, and have their Virtual Machines replicated from Primary Cloud Service ready for instantiation. Minimum Requirement of Data Protection Plan DP-004 or DP-005 Multiplier of x1.9 to all prices in sections 6.2, 6.3, 6.4, 6.5, 6.10, 6.11 and 6.12 for the scope covered by this DR level. Sufficient cloud site replication bandwidth (6.6) must also be purchased Optional Tools The basic Infrastructure as a Service (IL3) provides basic hardware monitoring included as part of the service. The following tools, subject to confirmation of compatibility with the customer supplied Operating System and/or Application software, may be used to reduce the need for specific customer tooling. Tool Scope Monthly Recurring Price ( per tool/per server) Alerting AHPS Patching Detailed system monitoring of IaaS Servers, reporting use and performance, and generating alerts when thresholds are approached or exceeded. GPG13 Compliant Protective Monitoring solution to monitor IaaS servers. For customers who select Microsoft Windows to deploy to the IaaS servers, tooling can be integrated to provide security patching Anti-Virus Commercial grade Anti-virus scanning and signature updates can be provided

24 6.11 Additional VLANs. The basic Infrastructure as a Service (IL3) provides a single production VLAN to deploy the IaaS services into. There may be requirements for the customer to specify and consume additional VLANs within their solution, these may be chosen from the list below. Tool Scope Monthly Recurring Price ( per VLAN) VLAN 1 Additional VLAN Microsoft Windows Domain Services The basic Infrastructure as a Service (IL3) does not assume to that the customer application services require domain services in order to operate. If the customer requires domain services, they may be chosen from the list below. Service Scope Monthly Recurring Price ( ) Standard Enhanced Domain Services Microsoft Windows Domain Services deployed to customer purchased environment 3, , Service Reports When the customer chooses the Enhanced service as defined in section 9, the following optional reports are available. Report Scope Monthly Recurring Pricing ( /Per Report) Capacity One Capacity Summary Assessment Report per month 1, Secure Support Access The Secure Support Access option allows the customer to be supplied with a secure laptop and security token, which permits access to the customers services deployed to the Atos Secure Cloud service via an encrypted Internet connection. Tool Scope Monthly Recurring Price ( ) Per User Secure Support Access Atos supplied secure support laptop, security token and secure encrypted access to Atos Accredited Secure Cloud via an Internet connection. 1 1 Internet bandwidth for this service is required to be purchased as per section 6.6 above. 2 Price includes basic service desk support (available as defined within section 9.1, Standard Service Plan Support Availability SLA) to enable customers to contact Atos in the event that a support issues arises. 16

25 7. Service management 7.1 Basic Service Monitoring The Atos Accredited Secure Cloud Infrastructure as a Service incorporates basic hardware/hypervisor monitoring as standard. This monitoring is used to support the Service Availability and Service Hours (see Section 9) when providing the platform for use by the customer. 7.2 Optional Reporting As part of the enhanced service package, the following optional reports can be provided at additional cost. Report Capacity Report Description Report to provide a summary as to the capacity status of the services being consumed. 17

26 8. Service constraints 8.1 Maintenance Windows The following table provides a summary of the expected or planned maintenance windows for the Atos Accredited Secure Cloud Service. Service Area Description Maintenance Windows Maintenance Windows : Every weekend between 01:00 Saturday and 23:59 Sunday Where a customer may be impacted by a planned outage then 10 working days advance notice will be given Where required, service impacting maintenance windows will be scheduled and customer advised as to the date and expected duration. Maintenance Window Exceptions: Maintenance of the ASC Backup service must be performed to fit the business hours of service. Most backups are scheduled for evenings and weekend so an alternative daytime regular maintenance slot is required and will be :- Every other Wednesday between 10:00 and 16:00 A minimum 2 week lead time to tenants where any service impacting outage is required In exceptional circumstances the use of a maintenance window without the ability to provide a 10 day advance notice may be required. Every effort will be made to avoid customer impact where possible. The following constraints should be noted in relation to the Atos IL3 Infrastructure as a Service Cloud services: Customers require a UK Government Accreditor to accredit the customer supplied Operating systems and associated applications Customers are required to sign the Accredited Secure Cloud Code of Connection Being a tenant in the Atos IL3 Infrastructure as a Service platform may require the implementation of new processes and controls within the client organisation, and changes to the topology of existing services to be hosted Alternates should be considered for clients that do not require the management of IL3 assets Customers who are unable to meet the requirements of the Atos IL3 Infrastructure as a Service Cloud Code of Connection must use an alternative service. 18

27 9. Service levels This chapter details the service availability, support, and service-specific levels that will be applied. 9.1 Service and Support Availability The service provided is summarised below, based on core service tiers, Standard and Enhanced. Please note: Individual Atos IL3 Accredited Secure Cloud Services may be ordered separately. As a result, support services can differ from IaaS service levels or service hours to provide customers with flexible choices in accordance with their requirements. The Standard Service Availability level is provided as standard with all Accredited Secure Cloud Infrastructure as a Service products, and is ideal for non-business critical systems, such as Development, Test and Proving. The Enhanced Service Availability level is ideal for business critical production systems. Service Level Enhanced Standard 1 Service Availability Window 99.9% % 2 Support availability window Service Monitoring 7 days 24 hours a day (all days) 7 days 24 hours a day (all days) 5 days 10 hours Mon-Fri days 10 hours Mon-Fri Service Request Handling Window 5 days 10 hours Mon-Fri Incident handling window Priority 1 Priority 2, 3 and 4 Incident Resolution Rate Incident Resolution P1 Incident Resolution P2 Incident Resolution P3 Incident Resolution P4 7 days 24 hours a day (all days) 5 days 10 hours Mon-Fri days 10 hours Mon-Fri % in 4 Incident Handling Hours 95% in 8 Incident Handling Hours 95% in 2 Incident Handling Days 95% in 5 Incident Handling Days Capacity Reporting Optional Not Included 1 included as standard with Atos Accredited Secure Cloud Infrastructure as a Service Products. 2 Availability figures exclude planned maintenance windows. See section 8.1 for further information 3 Excluding all English public holidays. 19

28 9.2 Service Incident Definitions Incident Priority 1 Incident (P1) Priority 2 Incident (P2) Priority 3 Incident (P3) Priority 4 Incident (P4) Definition Incident causing a critical or total interruption to service, including a complete network failure. There is no alternative/resilient service available Services are degraded or have reduced availability or limited network access. There is a severe impact on service availability. No acceptable alternative is possible. A non-critical impact to service which has operational service reduction, but no direct effect on service availability. An alternative/workaround is possible. An incident requiring resolution but which currently is not affecting service or availability. 20

29 10. Financial recompense To minimise the cost to users, Atos does not provide service credits for use of the service. All Atos services are provided on a reasonable endeavours basis. Please refer to G Cloud terms and conditions. In accordance with the guidance within the GPS G-Cloud Framework Terms and Conditions, the Customer may terminate the contract at any time, without cause, by giving at least thirty (30) Working Days prior notice in writing. The Call Off Contract terms and conditions and the Atos terms will define the circumstances where a refund of any pre-paid service charges may be available. 21

30 11. Training Training is not included in the standard packages, but can be provided at an additional cost. These can be provided at the rates defined in our Skills for the Information Age (SFIA) rate card that was submitted as part of our G-Cloud submission. Please get in touch for details 22

31 12. Ordering and invoicing process Ordering this product is a straightforward process. Please forward your requirements to the address GCloud@atos.net Atos will prepare a quotation and agree that quotation with you, including any volume discounts that may be applicable. Once the quotation is agreed, Atos will issue the customer with the necessary documentation (as required by the G-Cloud Framework) and ask for the customer to provide Atos with a purchase order. Once received, the customer services will be configured to the requirements as per the original quotation. For new customers, additional new supplier forms may need to be completed. Invoices will be issued to the customer and Shared Services (quoting the purchase order number) for the services procured. On a monthly basis, Atos will also complete the mandated management information reports to Government Procurement Services detailing the spend that the customer has placed with us. Cabinet Office publish a summary of this monthly management information at: 23