CGI Commercial Cloud. G-Cloud Service Definition. Commercial in Confidence

Transcription

2 Founded in 1976, CGI is a global IT and business process services provider delivering high-quality business consulting, systems integration and managed services. With 68,000 professionals in 40 countries, CGI has an industry-leading track record of delivering 95% of projects on-time and on-budget, aligning our teams with clients business strategies to achieve top-to-bottom line results. PROPRIETARY AND CONFIDENTIAL The information contained in this document is confidential to CGI and/or CGI group companies. This document shall not be reproduced in any form or by any mechanical or electronic means, including electronic archival systems, without the prior written approval of CGI. By publishing this document on the Digital Marketplace CGI has given its consent for it to be publicly available however CGI does not consent to the information contained within the document being copied, modified or reproduced in any way other than for the purpose of evaluating CGI s proposition as part of a Customer purchasing process. Please note that the reproduction or the distribution of this document for any other purpose is strictly forbidden. The receiving party may use this document and the information contained in it for the purpose of evaluating CGI s proposition only. This proposition is subject to contract and shall not be binding unless and until execution by CGI and the contracting body of a final agreement in relation to the proposition containing the terms and conditions that will govern the relationship between the parties. Any final agreement is conditional (inter alia) upon due diligence and customary business investigations where necessary by CGI. The results of such due diligence and/or investigations may impact upon content of this proposition, including the business structure, business terms and financial arrangements. If you have received this document by any means other than via the Digital Marketplace, as part of a Customer evaluation process or as a CGI communication mistake note that the reading, the reproduction or the distribution of this document is strictly forbidden. You are hereby requested to inform us by telephone at and to return this document by special delivery marked for the attention of Simon Telfer. Except where indicated otherwise or where they are associated to CGI partners, all names, trademarks, logos and brands (registered or not) referred to in this document, are the property of a company in the CGI group or its licensors. The information in this proposal is submitted in December 2014; on behalf of CGI by the following authorised representative: Simon Telfer Cloud Programme Director CGI IT UK Limited Seventh Floor, Kings Place, 90 York Way, London, N1 9AG Tel: CGI IT UK Ltd 2 of 29

3 Foreword Foreword G-Cloud adoption is continuing across public sector with new suppliers, technologies and service delivery models gaining an increasing impact with each release. At the same time, the take up by central government is building the confidence of local public sector organisations to buy and deploy IT services and solutions more flexibly and cost-effectively. Since our last G-Cloud submission we have achieved appropriate assurances to connect our cloud services to PSN; and have migrated several departmental services, which require this high level of security. We are continuing to listen, invest in and enhance our capabilities, to provide the levels of performance and hybrid integration which the rapidly expanding marketplace demands as the new model of service disaggregation is understood. Our services are still based on the principles of ready to go design, which we have found to be successful in helping clients understand their TCO and make the decision to move to Cloud with CGI. SME Accelerate Secure Government Cloud CGI Commercial Cloud Platform as a Service Software as a Service Open Source Delivery Cyber Security Operations Centre Mobility Service Desk Cloud Adoption Our SME programme now includes over 130 partner organisations that we are actively and successfully working with across CGI and offering services through G-Cloud. Architected to best practice standards, the SGC has received sufficient assurances for connection to PSN Protect (encrypt domain). Using the SGC reference architecture but available with connection to the internet for public facing services. Our PaaS portfolio is growing with middleware services to enable the growing requirements of emerging data, hybrid and disaggregated solution and cloud architectures. Our SaaS portfolio includes technologies which traditionally have a high cost of entry but are made significantly more accessible using G- Cloud. This includes Multi Agency Safeguarding Hubs (MASH), Information Exchanges, Document Management, Case Handling and Productivity. We have propositions from our Open Source capability which includes a service for continuous delivery through DevOps methods. Services from our UK-based Cyber Security Operations Centre (SOC) include Protective Monitoring and Proactive Threat Detection. Secure and tablet and connectivity solutions, which use virtualised walled garden architecture access for ios, Windows and Android devices. We have maintained our 5-star accreditation from the Service Desk Institute with improved scores, and remain the only externally facing service desk across the globe with this level of industry recognition. Any decision to move to cloud includes consideration of service models, networks and adherence to Government Security Classification guidelines. Our adoption services provide support for the end-to-end transition from legacy to flexible and responsive cloud architectures CGI s services combine the innovation of a leading provider of Cloud services to governments across the globe, with the surety of an IT provider who has been at the heart of UK government for 40 years. Our propositions are described through the Cloud Service Catalogue as illustrated below, which outlines the 2014 CGI IT UK Ltd 3 of 29

4 Foreword completeness of our commitment and service accountability across market-leading solutions from CGI, our SME community and partners. High Level Overview of CGI's G-Cloud 6 Catalogue CGI delivery teams have embraced the principles of Cloud and continue to develop our propositions across all capabilities and technologies. Our ambition is epitomised in the e-carelogic SaaS solution, where we have re-architected an integrated health solution to the secure Cloud; bringing the benefits of agility and utility pricing to a historically traditional integrated health record management market. We look forward to continued working with the community of public sector customers, partners and suppliers in G-Cloud which have established G-Cloud as the most exciting, dynamic and accessible IT framework across the globe CGI IT UK Ltd 4 of 29

5 Foreword Table of contents 1 Overview 6 2 Information assurance 14 3 Backup/restore and Disaster Recovery 15 4 On-boarding and Off-boarding 16 5 Pricing 18 6 Ordering and invoicing process 20 7 Service Management 21 8 Service constraints 22 9 Service Levels Training Termination terms Data restoration / service migration Consumer responsibilities Technical requirements Trial service CGI IT UK Ltd 5 of 29

6 Overview 1 Overview CGI continues to invest in its Cloud infrastructures, and have launched an IaaS solution (CCC, CGI Commercial Cloud Platform), based on the successful Secure Government Cloud (SGC) reference architecture. CGI UK based cloud infrastructure solutions are now built to support the following categories: SGC (Secure Government Cloud) assured and connected to PSN CCC (CGI Commercial Cloud) self-asserted, independently assessed and connected to the Internet Both clouds are deployed physically separate, and run independently, but utilise the same underpinning technologies to deliver cloud functionality. The CCC IaaS platform provides an secure agile infrastructure utilizing underlying hardware and software layers which are built for high availability (no single point of failure), located within our secure UK Datacentres. CGI s clouds offer on demand network, storage and compute resources bringing the benefits of maximum scalability. The CCC is a multi-tenancy, multi-hypervisor shared platform delivering end-to-end segmentation of user traffic and data. There is a further option of selecting a dedicated Hypervisor platform, named Community Cloud, which has the same common backbone for SAN and network infrastructure as the multi-tenancy offering. All services are backed up by CGI s UK based award winning 5* service desk, and utilise support services based on and off shore. With 68,000 staff worldwide, CGI are geared to provide specialist consultancy and delivery services across all the major technical platforms. This extensive expertise coupled with our detailed public sector and commercial knowledge enables CGI to offer best of breed solutions for public sector organisations.. Our areas of specialism around security and data privacy will provide you with added assurance of meeting Government compliance standards. We can confirm that this proposition either delivers to or supports the principles of Cloud services, including National Institute of Standards and Technology (NIST) definitions and characteristics. 1.1 Benefits Minimised carbon footprint by only utilising infrastructure that is required, by utilising a Pay as you Grow service/financial usage model Operational expenditure managed service model to reduce the need for high cost IT start-up project costs and ongoing hardware refresh, freeing up capital Access to CGI Managed Services alongside an IaaS utility-based consumption model Typical environment usage types for end-to-end full service lifecycle management: Production/Pre-Production Test/Training Development Utilisation of Cloud methodologies to deliver IT resources to accelerate delivery times Support for applications that depend on Cloud infrastructure, or have a desire to migrate end-to-end services to agile delivery mechanisms CGI IT UK Ltd 6 of 29

7 Overview 1.2 Service Definition The CGI CCC Cloud service is a hosting capability exclusively for x86 and x86 virtualised guest architectures and has been designed and configured in conjunction with both Dell and Microsoft. The cloud service provides the following features, which is not exhaustive. Scalable VM services from 1vCPU 1 GB to 8vCPU 64GB VMs provisioned with 60GB of storage as standard Uncontended VM resources All VMs can be hosted across up to two CGI data centres A number of VM backup options dependent on customer requirements Full OS monitoring for VMs Automated SAN disk tiering to provide improved disk I/O for VMs Active monitoring of the CCC Hypervisor platform and SAN infrastructure VMs regularly patched with Anti-virus and OS updates Option to host VMs on either a VMware ESX 5.5 or Microsoft Hyper-V 2012 R2 Hypervisor platform Dual data centres are highly resilient, Tier 3 and located in UK Entry point pricing less than 5 a day Monthly Invoicing 1.3 Service Description The CCC provides a robust, agile utility based IaaS Cloud Service for UK public sector and commercial clients. IaaS Cloud Service features are included as standard: Agility on-demand, Rapid deployment, Flexibility, Adaptability; Economy of scale Standardisation Defined SLAs These features are supported and extended by CGI s key strengths in the security, service integration, project delivery and governance arenas as shown below in Figure 1-1. Figure 1-1: CGI's Cloud Strengths 2014 CGI IT UK Ltd 7 of 29

8 Overview Compute resources are controlled and managed by UK and CGI security vetted staff. Additional capacity can be added or removed as required through natural infrastructure growth, or via change if an urgent need arises for extra capacity on demand. Capacity management is controlled centrally, and services are charged on a monthly basis. All capacity utilised is measured, reported and charged on a monthly basis. CGI s approach for a managed IaaS services, is to utilise the delivery and control mechanisms associated with typical Cloud solutions, but also integrate this with CGI s technical managed services and security practices. This ensures that data is secured and not compromised change control is adapted through secure access methods and integrated into the ticketing system for automation and audit purposes Resources are managed and controlled through CGI s Service Desk, CGI Technical Authority, CGI BAU engineers, CGI Security Practice and CGI s Control Bridge. CGI effectively becomes an extension of your organisations IT department to manage the Cloud resources, and therefore frees up valuable IT resources within your own organisation to concentrate on project deliveries and proactive effort, rather than troubleshooting IT support issues. CGI will work with your IT department to establish an effective and efficient working relationship to best define and deliver your IT services Service Features Data Centres, Data Storage and Data Processing CGI s cloud platforms are deployed within two secure CGI Data centres (DC) within the UK. All data processing is carried out within these physical locations. Access to the server and storage environment is secure and controlled through our Permit to Work process. Only CGI staff with the appropriate level of security clearance is allowed unaccompanied access. Other access is normally within published office hours and by appointment. Each Data Centre has a physically separate set of infrastructure, and provides resilience in that should one location fail, it will not impact the other data centre High Availability and Disaster Recovery CGI s UK based cloud infrastructures are designed in a resilient manner with flexibility to offer individual clients customised high availability and disaster recovery capability to suit their needs. High availability is achieved for IaaS within a single site HA Hypervisor Clusters within the local DC. HA Clusters host all three service levels, Gold / Silver & Bronze. Should a node fail within a cluster, resources are automatically migrated to available nodes within the cluster group. Clusters are deployed with no single point of failure. Additionally for Disaster Recovery (DR) the infrastructure provides dual-site disaster recovery capability to customers, Gold Service has an online DR capability offering active service failovers and silver has an off line DR capability, both have manual intervention to ensure service reliability, and false positive failovers. Silver and Gold class services have DR replication already provided for, ensuring that data is kept off-site and available should a site wide DR event occur. Bronze services, primarily designed for test / demo & development type environments, benefit from the primary site no single point of failure, and therefore have a base level of resilience provided as standard CGI IT UK Ltd 8 of 29

9 Overview Patching Process The patching process and schedule is specified, managed and owned by CGI. All servers will be patched with applicable patches. CGI reserves the right to apply patches for fix-on-fail and security reasons at any time. The patching schedule is available to service customers on request Scheduled Downtime Whilst every effort has been made to avoid any scheduled downtime by providing resilient infrastructure, there are always going to be cases where scheduled downtime is unavoidable. Twenty working days notice will be given for standard planned downtime. Where possible, for emergency scheduled downtime, 24 hours notice will be provided but CGI reserves the right to reduce this if a security, or unavoidable event occurs that requires urgent fixes Anti-Virus Updates All servers will run the latest Anti-Virus agent and all definitions will be no more than 48 hours old. CGI will own and reserves the right to select the Anti-Virus product in line with the CCC Security policy. More information on the Anti-Virus solution and the CCC Security Policy is available on request Monitoring Software Monitoring of the OS will be included as part of the virtual machine image and integrated as part of the image provision. A local user will be created to load and configure the monitoring software. For Windows servers, if the server is subsequently joined to a domain then a local administration account will be created Software Licensing and Ownership All Microsoft licenses (other than the Operating System) will be licensed under the Service Provider Licensing Agreement (SPLA) pricing available on request. Should clients wish to re-use existing Microsoft licenses, CGI will support Microsoft License Mobility but an active Enterprise Agreement must be demonstrated. CGI also has the ability to support Microsoft select agreement licensing at additional cost. A separate quote will be supplied in this instance. The following Linux Operating System licenses are included within their respective monthly subscription charges: RHEL, Oracle Linux, SLES. The following Linux Operating System licenses are supplied as open source for development purposes, with no associated monthly subscriptions required: Ubuntu, CentOS Peripherals No peripherals can be connected to the CCC environment. In certain circumstances, CGI may allow connections on a case by case basis in collaboration with the client. These connections may result in additional cost. 1.4 IaaS IaaS provided by the CCC is built on a modular set of service components that can be put together according to the needs of individual services, applications or security requirements to offer a flexible, 2014 CGI IT UK Ltd 9 of 29

10 Overview scalable, best value service. This is overlaid on a set of flexible service levels to ensure that levels are aligned to the usage of the infrastructure. IaaS provides the ability to deploy compute power up to and including 64GB vram and up to 8 vcpu per virtual machine which includes sufficient storage to manage the operating system. Additional storage is available to hold persistent data on a Tier 1 or automatically tiered basis. Additional storage is charged based on actual usage per Gigabyte (GB) per month. Operating systems available are Windows Server and Linux (CentOS, Ubuntu, Oracle Linux, SLES and RHEL). Virtual resources can be requested and changed as required. The solution allows for Cloud methodologies to be utilised for rapid provisioning and flexibility, while at the same time ensuring services are maintained for the end user experience. CGI use appropriately cleared engineers to provision and manage your environment, through our 5* service desk and ticketing system. This ensures your data remains safe, and adheres to service level agreements IaaS Configuration Options The below service elements are included within the current three product service offerings within the CCC platform: Service Element Bronze SLA Silver SLA Gold SLA Physical Location CGI UK Data centre CGI UK Data centre Building Classification List X List X List X Typical Environment Use vram / vcpu / vhd Development / Test Included as per Utility Table Train / Test / Pre-Prod Included as per Utility Table OS included in Subscription Yes Yes Yes Guest OS Supported Microsoft Guest OS Available Linux 64Bit / 32Bit Windows 2008 SP1 and R2 Windows 2012 SP1, Windows 2012 R2 CentOS, RHEL, SLES, Oracle Linux Windows 2008 SP1and R2, Windows 2012 SP1, Windows 2012 CentOS, R2 RHEL, SLES, Oracle Linux CGI UK Data centre Production Class Included as per Utility Table Windows 2008 SP1and R2, Windows 2012 SP1, Windows CentOS, 2012 RHEL, R2 SLES, Oracle Linux Ubuntu Ubuntu Ubuntu Versions supported as per CESG Matrix Versions supported as per CESG Matrix AntiVirus Yes Yes Yes Storage Tiers Available DC Target Deployment 1 + Auto Tier Capable Single Primary Site 1 + Auto Tier Capable Single Primary Site / Data Replicated to 2nd Site Versions supported as per CESG Matrix 1 + Auto Tier Capable Dual Capable Sites / Data Replicated to 2nd Site 2014 CGI IT UK Ltd 10 of 29

11 Overview Backup Options Bronze / Silver / Gold Bronze / Silver / Gold Bronze / Silver / Gold vperformance Contention Uncontended Uncontended Uncontended Burstable capability / % / Time Period No No. No Environment Number VM Limits Theoretically Unlimited Theoretically Unlimited Theoretically Unlimited IaaS Service Levels Bronze Support Features RTO RPO Typical Environment Use: Development / Test Operating System automated deployment, OS Storage included CGI Service Management Services - ITIL Monitoring of the Virtual Machine (VM) Capacity Management Controlled Storage capacity added as per CGI s Cloud Storage (Add-on Service) Backup service added as per CGI s Cloud Backup (Add-on Service) Limited Patching services Antivirus services Anti-virus services System returned within 2 Service Days No more than 24hr data Silver Support Features RTO RPO Typical Environment Use: UAT Test / Train / Pre-Prod / Production Operating System automated deployment, OS Storage included CGI Service Management Services - ITIL Monitoring of the Virtual Machine (VM) Storage capacity added as per CGI s Cloud Storage (Add-on Service) Backup service added as per CGI s Cloud Backup (Add-on Service) Anti-virus services Automated patching services Management of Help Desk service calls Generation of incidents Offline DR System returned within 24 hours no more than 8 hour data Gold Support Features RTO RPO Typical Environment Use: Production Class / Online DR Operating System automated deployment, OS Storage included CGI Service Management Services - ITIL Monitoring of the Virtual System returned within 4 service hours no more than 30 minutes data loss 2014 CGI IT UK Ltd 11 of 29

12 Overview Machine (VM) Storage capacity added as per CGI s Cloud Storage (Add-on Service) Backup service added as per CGI s Cloud Backup (Add-on Service) Anti-virus services Automated patching services Management of Help Desk service calls Generation of incidents Online Disaster Recovery manual intervention step on full site recovery Inter-site services Performance Utility-based Compute options Virtual Machines are deployed under pre-defined vcpu, vram and starter storage configurations. Services and solutions are defined using the standard building blocks within which there are limited configurations of vcpu and vram available. vram (GB) vcpu Small 2 Medium 4-6 Large 2-4 X-Large 4-8 XX-Large Increases and extensions to these compute resources including migration to a higher tier of building block can be added to the monthly subscription charges should the need to increase compute arise. Monthly reports will be generated for invoicing to show what resources have been consumed and therefore their respective charges. The choice of specifications to support your requirements will typically be made in conjunction with the CGI Technical Design Authority based on your requirements to ensure the service is delivered to match them. A number of services are predefined as they are built from reference architectures already within the service catalogue, and therefore end user experience requirements are required to complete the service wrapper. This will be part of the initial service on boarding process (and reviewed on major change to the solution) Guest Operating Systems The table below illustrates the supported operating systems: Guest OS Type Guest OS Vendor Edition Guest OS Version Min vcpu Supported Max vcpu Supported Chip set Min vram Supported Max vram Supported Windows Microsoft Standard vcpu 8 vcpu 64 Bit 1 GB vram 64 GB vram Windows Microsoft Standard 2008 R2 1 vcpu 4 vcpu 64 Bit 1 GB vram 64 GB vram Windows Microsoft Standard 2008 R2 1 vcpu 8 vcpu 64 Bit 1 GB vram 64 GB vram Windows Microsoft Standard 2008 R2 1 vcpu 8 vcpu 64 Bit 1 GB vram 32 GB vram Linux CentOS Enterprise 6.x 1 vcpu 8 vcpu 64 Bit 1 GB vram 64 GB vram 2014 CGI IT UK Ltd 12 of 29

13 Overview Linux CentOS Enterprise 6.x 1 vcpu 4 vcpu 32 Bit 1 GB vram 16 GB vram Linux Redhat Enterprise 6.x 1 vcpu 8 vcpu 64 Bit 1 GB vram 64 GB vram Linux Redhat Enterprise 6.x 1 vcpu 4 vcpu 32 Bit 1 GB vram 16 GB vram Linux SUSE Enterprise 11 SP2/3 1 vcpu 8 vcpu 64 Bit 1 GB vram 64 GB vram Linux SUSE Enterprise 11 SP2/3 1 vcpu 8 vcpu 32 Bit 1 GB vram 64 GB vram Linux Ubuntu Server vcpu 8 vcpu 64 Bit 1 GB vram 64 GB vram Linux Ubuntu Server vcpu 4 vcpu 32 Bit 1 GB vram 4 GB vram CGI have a development programme in place and therefore as additional products and compute capabilities become available, they will be assessed and added into the Core Service Catalogue. As a Cloud-based service, the standard Operating System template builds are built on CGI reference secure builds, utilising the experience, and policies from the security practice. All images will be built in line with CESG recommendations to ensure a secure platform. Customers are supplied with a pre-built operating system image for each virtual machine, the build standards of which are controlled by CGI. Services are designed to fulfil the needs of the high percentage of our customers and are not customisable. Deviation from the standard Operating System template builds are not permitted within our Cloud platform standard templates as this ensures cost and quality can be maintained. Custom Operating System builds can be provided however, they are designed in conjunction with the CGI Security Practice and CGI Cloud Services as these fall outside our Cloud Operating System reference architecture and will require a separate quote. CGI s clouds support both virtual-to-virtual (V2V) and physical-to-virtual (P2V) migrations from Intel x86 Physical servers and from Hyper-V and VMware ESX virtual images to assist with the on boarding of clients. An additional support charge for P2V servers will be calculated on a case-by-case basis according to the configuration of each server. This arises due to higher support levels required with non-standard customised environments. CGI s preferred option is therefore to work with the client to migrate the service to a supported standardised platform to benefit the customer with lower TCO charges, and CGI to standardise the environment Storage All storage within the cloud platforms is persistent, remaining available following failures or scheduled outages. System memory on the virtual machines is non-persistent. Storage is available from two shared platform service tiers based on performance: Service Level Tier 1 Auto Description Ultra-Fast high I/O Storage Standard Service 2014 CGI IT UK Ltd 13 of 29

14 Information assurance 2 Information assurance CGI uses our Management Foundation including our Integrated Management System (IMS) for information assurance. These IMS processes are independently certified to BS/EN/ISO 9001:2008 and within the UK we additionally have TickITplus certification. CGI is committed to retaining our current range of UK-based certifications and will extend these to meet client expectations as required. The CGI Management Foundation design allows incorporation of best practice from across all of our Public Sector and Commercial engagements. Our accreditations include: ISO9001, ISO27001 and ISO20000 TickITplus, CMMI-Dev+IPPD v1.2 Maturity Level 3 rating ISO/IEC 27001:2005 Audit and Certification SSAE 16/ISAE 3402 Attestation E.U. Data Protection Directive - (95/46/EC). All information is held at the appropriate security level for the service. CGI hosted services can be provided at any level defined in the new Government Security Classification (GSC) policy with the appropriate assurance. Information Principles for the UK Public Sector supported and documented? CGI recognises the UK Public Sector information principles which are fundamental to the efficient and effective delivery of public services. Where we store and manage government information in our G-Cloud services we aim to ensure that it is appropriately protected and available to exploit. Through this, we would aim to maintain and, depending on the particular service purchased, enhance the quality of the information stored in a standard manner that enables its re-use. Where the selected services require it, we would engage positively, both to support the client in the publication of public information and to support them in the access of information by citizens and business. Government ICT Strategy and Greening Government ICT Strategy supported and documented? The design and delivery of our Cloud-based SaaS offerings is consistent with the principles of the Greening Government ICT Strategy. Scalable, Cloud-based services allow pooling of capacity across multiple customers, reducing overall hardware requirements. These are further reduced through virtualisation, which has delivered up to a 90% reduction in server numbers and power consumption for some of our services. We select modern, energy efficient servers, storage and network hardware and have also invested heavily in improving the energy efficiency of our data centres. This includes initiatives such as free air cooling, aisle containment, power supply upgrades, lighting controls and power management and monitoring software. In the UK, electricity for our data centres is sourced from renewables, which is also the case for many of our third party hosting providers. We closely manage the impact of IT hardware throughout its lifecycle, aiming to optimise refresh cycles to balance in-use carbon savings of newer, more efficient hardware against the carbon impact of its manufacture. At end of life, we also ensure responsible disposal through resale or recycling of old hardware wherever possible. Our sustainability performance has won widespread recognition, including our listing on the Carbon Disclosure Leadership Index for four consecutive years and our certification under the Carbon Trust Standard CGI IT UK Ltd 14 of 29

15 Backup/restore and Disaster Recovery 3 Backup/restore and Disaster Recovery Backup/restore and Disaster Recovery will be provided using dual-site disk backup solutions (DBS). Backups will be maintained on disk-based storage appliances at the opposite datacentre to that at which they were taken. To minimise the impact of backup on operational services, data will be backed up to disc on the site at which it is held then migrated off-site to the secondary datacentre using an encrypted link between the two datacentres. This approach will eliminate the risk inherent in handling removable media. The backup approach will be to use SAN snapshots supported by services that allow backups to be performed while applications on a system continue to operate, such as Microsoft VSS. Backup schedules and contents will be aligned to the RTO and RPO service levels of each service. Backup and Recovery service reports that confirm the successful backup and retention of data will be provided using an automated dashboard on a daily basis. It is assumed that all pre-backup activity (e.g. database dumps to flat files) are completed before the agreed window. Any applications that cannot be backed up in flight will be excluded from the backups. Options are to shut down for the whole period of the backup window or another method of backup provided by the project. The backup window is between 20:00 and 08:00 daily. Type Quantity held online Retention period Daily Incremental 7 days 1 week Weekly Full 5 weeks 1 month Monthly Full 12 Months As per SLA - Bronze 1 month, Silver 3 months, Gold 12 months Additional backup and archiving requirements can be provided as options on a case-by-case basis but will attract additional charges CGI IT UK Ltd 15 of 29

16 On-boarding and Off-boarding 4 On-boarding and Off-boarding In order to ensure the highest level of service for our clients, CGI believe that by working with our clients to fully understand the backend services and end user experience together the correct level of service can be achieved. The on-boarding experience is key to ensuring the correct level of IaaS infrastructure is provisioned to match against the service. 4.1 On-boarding CGI have proven and effective on and off boarding skills, tools and methodologies. We have successfully transitioned Public Sector clients onto Cloud infrastructures and services. For Infrastructure, Platform and Software requirements CGI have transition specialist who bring to bear considerable experience. The transition process is scalable and can be used for all sizes of on-boarding requirements. For Specialist Cloud Services, CGI will engage directly with the client to ensure the full scope of the requirements is understood and agreed in advance of any engagement. We will work with senior stakeholders to define the necessary business outcomes and ensure the services are aligned accordingly. For all services CGI understands the client's requirements and make on-boarding specific to these needs, using the experience, lessons learnt and methodology from many years of public sector transition experience. Service on-boarding is achieved through the following high level steps: CGI will work with the client to ensure that the most effective and appropriate service is delivered to the end user community. CGI will assist potential clients in calculating the required compute and storage requirements along with appropriate additional services as required. Initially this will involve contacting the CGI Account Manager, or via contact details described earlier in this document. Service templates are identified from the existing service catalogue and a solution design is created. Service levels are selected to suit the SLA s required. Disk performance tiered storage is selected to match the system requirements. The requested services (virtual machines, storage, and network) are deployed. CGI finalises the customer s configuration then provides connection details to enable application loading, administration and rollout. A RACI is created as part of on-boarding to determine ownership & accountability lines identified and communicated between the Cloud service and project team. Automation / capacity management / monitoring are all enabled to ensure that services are integrated into CGIs Service Desk & Control Bridge. 4.2 Off-boarding Service Off-boarding is instigated by a customer request or after expiration of the overarching CGI service agreement. Outside of these mechanisms, the minimum notice term would normally be 30 days notice in writing. If a request to export from the cloud service is requested, all client data held will be exported and made available using appropriate media (supplied at the clients cost), in line with the security classification of the data and information management policies in force. Charges for this service are dependent on the 2014 CGI IT UK Ltd 16 of 29

17 On-boarding and Off-boarding volume and complexity of the data required and will be estimated on a case-by-case basis. After notification that data has been successfully recovered and is complete, CGI will purge customer data from any compute or storage device / media that remains part of CGI estate. If no data export from the Cloud Service is requested, deletion of any virtual machine image and data will occur in line with the service agreement. If no service agreement is in place, all associated data will be deleted within 5 working days of service termination CGI IT UK Ltd 17 of 29

18 Pricing 5 Pricing Please see our separate SFIA Rate card for further details of our day rates. Virtual Machines CGI s secure IaaS platforms offer three tiers of service, Gold, Silver and Bronze, alongside a variety of Compute resources. Classifications for Small/Medium/Large Virtual Machine compute resources are defined within the table below: vram (GB) vcpu Small 2 Medium 4-6 Large 2-4 X-Large 4-8 XX-Large 2014 CGI IT UK Ltd 18 of 29

19 Pricing Global Infrastructure Services UK Price List VM Gold+Gold Backup Prices From / Mth Price List VM Gold+Gold Backup Price List VM Gold+Gold Backup Price List VM Gold+Gold Backup Gold Price List VM Gold+Gold Backup Operating System Band HyperVisor Class 1vCPU, 1GB (Small) 2vCPU, 4GB (Medium) 4vCPU, 4GB (Large) 2vCPU, 16GB (X Large) 4vCPU, 32GB (XX Large) Windows Hyper-V VM Windows Vmware VM Linux (RHEL) Hyper-V VM Linux (RHEL) Vmware VM Other VM Specifications available When commissioning a new customer s cloud environment, there are always a number of standard preparation tasks that are required to be undertaken before the virtualised environments can be used by a customer. In order to provide competitive pricing for all our cloud customers, there is an additional charge levied where the number of VMs requested is less than specific thresholds, at initial cloud service adoption. This service adoption charge is a zero charge, if more than 10 VMs are initially requested. This charge is only applied at initial service adoption for less than 10 VMs and does not apply if less than 10 VMs are subsequently added to the environment. Number of VMs Requested Initial Commissioning Charge 1 to to More than 10 0 (zero) For any newly commissioned VMs, the minimum chargeable service term is 30 days. All prices are per virtual machine per month. Assurance of the application and customer deployed software is excluded. All prices quotes are excluding VAT. The price is valid for a period of 12 months from the Effective Date of the Framework Agreement. CGI reserves the right to amend the charge after this period. Prices and Service Descriptions are subject Terms and Conditions. There are no service credits or recompense specific to the CCC cloud service. Options CGI recognises that despite the drives for standardisation that customers do have differing requirements. Therefore we offer additional services for CCC at additional costs. Please contact CGI cloud team to discuss your specific service needs prior to ordering services. This could be a SaaS transformation service, or operating system not currently defined, which requires specific support. WAN Network The client will define their own connectivity into CCC, which may be Private MPLS networks or public internet VPN CGI IT UK Ltd 19 of 29

20 Ordering and invoicing process 6 Ordering and invoicing process Direct guidance from Government Digital Services (GDS) on the overall ordering and invoicing process for G-Cloud can be found here in the Digital Marketplace Buyers Guide: All CGI entries on the G-Cloud have a pre-agreed contract with Government to supply the service, thereby simplifying and streamlining the procurement process. A full copy of our standard terms and conditions can be found in the Digital Marketplace next to our Service Description Document and these are applicable in conjunction with the GDS Framework Agreement and Call-Off Contract. Once you have selected the service you require and notified CGI, a CGI Client Account Director will contact you to progress the requirements. The Client Account Director will jointly agree with you the scope and price of the solution. Within the on-boarding we will set up the service and guide you through the necessary contractual steps and procedures. CGI will also supply you with the pre-agreed Management Information reports on the performance of the service and resolve any issues. The invoicing procedures will be established at the initiation of the service and CGI will request necessary information including: address details for the receiver of our invoices A purchase order number Specific billing requirements. CGI will provide a monthly invoice for all services purchased through the Digital Marketplace which will detail the agreed price. Invoices are payable within 30 days. All ordering and invoicing for CGI services is via our proven and efficient procedures which have been used extensively for government frameworks. The process is standard across all of our Digital Marketplace service propositions for maximum efficiency. For ordering CGI services, please contact your CGI Client Account Director or contact us via gcloud@cgi.com CGI IT UK Ltd 20 of 29

21 Service Management 7 Service Management CGI operates an ITIL compliant, award winning service management solution, a mandatory element of our service to ensure seamless delivery of service and ongoing support. Services include: Continual Service Improvement Service Desk Major Incident Management Problem Management Change Management Availability and Capacity Service Level Management Configuration Management. These are standard services hence not outlined in any more detail here. Specific aspects of these services of particular relevance to CCC are drawn out in the following paragraphs. 7.1 Service Request Management Services can be requested from the Digital Marketplace. On selection of the services a quote will be generated and following submission the request will be subject to the standard ITIL change management processes. On approval of the request the services selected will then be automatically provisioned. Services from the Digital Marketplace can be selected based on SLA characteristics; this ensures that the most relevant service is provided. During service request a timeline can be selected for the requested services. 7.2 Performance and Availability Monitoring Included as standard is Performance and Availability Monitoring of discrete Hardware and Operating Systems. Optionally there is the ability to include performance and availability monitoring for the overall service. This will include the ability to alert based on service policy requirements, the ability to track and alert incidents on a related component affecting the overall service. 7.3 Chargeback CGI offers pay-per-use utility based IaaS Service such as, the ability to pay for what you use. The chargeback function is also responsible for the definition and management of the pricing model at a granular level, providing cost effectiveness and transparency. Chargeback reports (by customer or contract) are based on utilisation of the following: Power Datacentre Space Servers Network Storage and Backup Incidents and requests CGI IT UK Ltd 21 of 29

22 Service constraints 8 Service constraints The IaaS platform boundaries are the virtual network interfaces of the customer s VM s. CGI is not responsible for components outside this boundary, with the exception of the network involved in delivery of the solution. The customer is responsible for all licenses, configuration, and operations on the guest virtual machine. Application Programming Interface (API) access is not available on the CGI IaaS platform currently. Whilst every effort is made to avoid any scheduled downtime by providing resilient infrastructure, there are always going to be cases where scheduled downtime is unavoidable. Twenty working days notice will be given for standard scheduled downtime. Where possible, for emergency scheduled downtime, 24 hours notice will be provided but CGI reserves the right to reduce this if deemed necessary. All Windows servers will run the latest Anti-Virus agent and all definitions will be no more than 48 hours old. CGI will own and reserves the right to select the Anti-Virus product in line with CCC Security policy. Any applications that need to be excluded from Anti-virus scanning for performance protection should be identified during the transition period and agreed with CGI. The policy will be modified by CGI. All MS licenses must currently be licensed under the SPLA agreements pricing available on request. 8.1 Maintenance There are two categories of maintenance which will potentially impact Cloud Service customers and are as follows: Planned Maintenance Can be described as any activities which have been communicated to the customer with at least 20 business days notice and are likely to impact some or all of the customers utilising the Cloud environment. The maintenance window will be 6 hours Saturday - 23:00 to 05:00 (UK local time) Emergency Maintenance Where possible 24 hour notice will be provided to the customer but CGI reserve the right to reduce this if deemed necessary. Downtime generated by both Planned and Emergency maintenance will not be included in any statistical reporting of the availability metrics of the CCC cloud service CGI IT UK Ltd 22 of 29

23 Service Levels 9 Service Levels Please see the accompanying G-Cloud Supplier Terms and Conditions for this service. 10 Training Not applicable CGI IT UK Ltd 23 of 29

24 Termination terms 11 Termination terms Should a client wish to exit the service entirely a formal Service Request will be required. This will instigate the Off-Boarding processes outlined above. A client specific project will be initiated in order to ensure all data, communication lines, trusts and certificates are correctly managed. This will be scheduled in agreement between the client and CGI. Should CGI choose to terminate the service, affected clients will be given at least six months notice. Please refer to the G-Cloud supplier terms and conditions for any further details CGI IT UK Ltd 24 of 29

25 Data restoration / service migration 12 Data restoration / service migration CGI can make available data restore services, providing the customer has taken a valid backup service from us. CGI has a range of services to assist you with the migration of legacy systems to and from the CCC platforms. Please contact us should you require such type of services and we will gather your requirements and develop a serviced priced on a case-by-case basis CGI IT UK Ltd 25 of 29

26 Consumer responsibilities 13 Consumer responsibilities Customers of CGI s Cloud services will be responsible for a number of areas, dependent on the optional services requested. These responsibilities are: Any security assurance of the application, service access systems and ensuring staff accessing the service have appropriate security clearances Maintenance of consumer-based service and application level assurance to the appropriate standards All non-operating System licenses and compliance Complying with CCC code of connection to government networks where applicable Installation and patching of application software Application Backup and Restore (optional) Application Monitoring Security monitoring Application sizing and Performance requirements CGI IT UK Ltd 26 of 29

27 Technical requirements 14 Technical requirements Technical requirements are to be defined on a case-by-case basis depending on precise needs CGI IT UK Ltd 27 of 29

28 Trial service 15 Trial service While it is not a standard service offering, CGI may be able to offer limited services on a short trial basis, dependent on specific requirements. To discuss this, contact the CCC service team via your CGI Account Manager or else via gcloud@cgi.com CGI IT UK Ltd 28 of 29