G-Cloud III Services Service Definition Accenture Cloud Security Services

Transcription

1 G-Cloud III Services Service Definition Accenture Cloud Security Services 1

2 Table of contents 1. Scope of our services Approach Assets and tools Outcomes Pricing Contacts About Accenture Additional Information

3 1. Scope of our services This document describes Accenture s Cloud Security Services, and should be read in conjunction with the associated Government Cloud III Services documentation. These services include repeatable processes for identifying security requirements, assessing the security posture and authorising the movement of an application to the cloud. These services are based on enterprise architecture principles and standards (including The Open Government Architecture Framework or TOGAF) but have security as their central focus, reusing principles from Sherwood Applied Business Security Architecture (SABSA). Accenture provides the following Cloud Security services: Support in the selection of a Cloud Services model (either SaaS, IaaS or PaaS). Support to understand the risk associated with specific Cloud Service Models and to identify potential impacts and mitigations. Support to understand risk acceptance criteria and prioritisation of risks based on business impact. Identification of contributors to risk and the weak links in systems. Identification of areas to strengthen protection and recommendations for improvements. Identification of security controls necessary for an application. Assessment of the security posture of Cloud Service Providers. Formal assessment techniques (for example): o Vulnerability scanning. o Penetration testing. o Architecture review/assessments. o Mapping of technical vulnerability against business impacts and business processes. Development of approaches for securing data and applications with Cloud Service Providers. Accenture has 20 years of experience in public sector security including work subject to the Security Policy Framework (SPF) and Good Practice Guidelines from CESG (Communications-Electronics Security Group). These experiences, combined with the most recent thinking and policy from G-Cloud and Government Protective Marking Review is considered through the security assessment. The experience and methods will enable G-Cloud clients to strike the right balance between the assurance and the security of the organisation s data assets whilst delivering high performing and cost effective operational services. 2. Approach Our Cloud Security Services are based on standard, risk driven methodologies in order to assess and evaluate cloud environments. The services are based on Accenture s IT Security Risk Methodology for the cloud. This approach includes a series of toolkits and templates for all phases of a cloud implementation and has been developed with clients in numerous industries across the world. These assets and this experience will be reused where appropriate for the Authority and for G-Cloud delivering unparalleled value in the cloud marketplace. The following outlines the process for a Cloud Security Assessment. Timelines will vary and will depend on the scope of the services as well as the scale and number of the environments in question. 3

4 Accenture s Cloud Security Assessment Process 3. Assets and tools Accenture s Cloud Security Services will assess the risk of adopting cloud services for the Authority or a G-Cloud customer. Depending on the scope agreed with the Authority they can deliver a security Capability Maturity Report and will define a roadmap for migration or transition to cloud computing. Historically this is an approach favoured by many of our clients. Our services are supported by a number of assets and tools. These assets include formal requirements gathering methods and the Cloud Security Assessment Toolkit. They also include formal methods and tools for assessing security risks, identifying security vulnerabilities and approaches for developing a road map with the G-Cloud customer for improving cloud security or implementing cloud computing. The following diagram shows some of the tools which support our services: Accenture tools supporting the development of a Cloud Security Assessment 4

5 4. Outcomes Accenture s Cloud Security Services provide the Authority and G-Cloud customers with formal deliverables which provide an overview of the customer s environments and systems in the cloud and how the cloud impacts the client s: Risk posture and residual risks Existing accreditation status The documentation also allows the customer to prioritise remediation activities using the Accenture road map while recognising the constraints of the architecture in question. Whilst the focus of an assessment is on confidentiality, integrity and continued availability of the organisation s assets, our approach and methodology also enables the Authority or the G-Cloud customer to use the outcomes as part of any existing risk management processes as required by HMG standards and processes. 5. Pricing Our unit price of 713 per day represents a blended day rate for systems integration and implementation of Cloud Services. This blend is based on our experience in implementing these kinds of services for customers across industry in the UK. Our commitment is to work with you to define the appropriate scope and deliverables to achieve the desired outcome at the best value for money for you. If the work to deliver the Cloud service is more advisory in nature then our blended rate may increase to 1299 per day or higher. This increase reflects the need for more senior, more experienced staff to be involved in the delivery of these types of service. 6. Contacts Matthew Coates (Global Lead, Accenture Cloud Services Strategy) matthew.coates@accenture.com Telephone: About Accenture Accenture is a global management consulting, technology services and outsourcing company, with more than 249,000 people serving clients in more than 120 countries. Combining unparalleled experience, comprehensive capabilities across all industries and business functions, and extensive research on the world s most successful companies, Accenture collaborates with clients to help them become high-performance businesses and governments. The company generated net revenues of US$27.9 billion for the fiscal year ended Aug. 31, Specifically within the area of cloud security we: Rank as a leader in The Forrester Wave : Information Security and IT Risk Consulting, Q Are a Cloud Security Alliance Corporate Member Are standards contributor to the Trusted Cloud Initiative 5

6 Offer global scope and coverage more than 1,600 security professionals worldwide with 389 Certified Information System Security Professionals (CISSP),19 Certificate of Cloud Security Knowledge (CCSK) practitioners and 11 Sherwood Applied Business Security Architecture (SABSA) certified architects 8. Additional Information For further information please visit our website: 6

7 Copyright 2013 Accenture All rights reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. Copyright 2012 Accenture All rights reserved. Accenture, its logo, and High Performance Delivered are trademarks of Accenture. 7