Desktop Services (Production) Lot 2 - Platform as a Service Version: 2.0, Issue Date: 05/02/2014 Classification: Open
Classification: Open ii MDS Technologies Ltd 2014. Other than for the sole purpose of evaluating this Response, no part of this material may be reproduced or transmitted in any form, or by any means, electronic, mechanical, photocopied, recorded or otherwise or stored in any retrieval system of any nature without the written permission of MDS Technologies Ltd. MDS Technologies Ltd, Spring Park, Westwells Road, Corsham, Wiltshire SN13 9GB Telephone: 01225 816220, Fax: 01225 816281 Contents Why MDS?... 1 Summary of service benefits... 1 Product Overview... 1 Example Use Cases... 2 Trial Service... 2 Information Assurance... 2 Product Features... 2 Technical Features... 3 Service Options... 3 Backup/Recovery and Disaster Recovery... 4 Service Levels... 4 Pricing Model... 5 Appendix... 7 Related Services... 9
Classification: Open 1 Why MDS? A tailored cloud solution that fits your business needs Full range of cloud hosting options from pure public cloud to hybrid cloud and physical enablement solutions A support team which is based on the same highly secure campus as our cloud platform An assured cloud platform that is independently validated for OFFICIAL and OFFICIAL SENSITIVE data A fully managed platform, supported up to the Operating System Over 12 years experience of providing infrastructure services SC cleared operational support staff 24/7 support through our ITIL-aligned Service Desk Additional professional services such as project delivery and technical consultancy ISO 27001, ISO 9001, ISO14001 accredited Over 12 years experience in supporting Public Sector customers A privately owned, UK sovereign company We are an SME - agile with minimal bureaucracy PROFESSIONAL, PERSONALISED SOLUTIONS Summary of service benefits Service provided for OFFICIAL and OFFICIAL SENSITIVE data Exceptional value lowest cost compute resources Flexible and Adaptable add, remove or change your solution All data centres are highly resilient, Tier3 and UK sovereign with >50 miles separation. Connectivity via the Internet or a government secure networks (e.g. PSN, GSI, etc.) or your own dedicated circuits such as X-Kryptors, CPA, Leased Lines, MPLS, etc. Product Overview Desktop Services from MDS is a Platform as a Service (PaaS) offering which enables organisations to provision and scale secure session-based desktops in a flexible and autonomous manner. For Windows customers, a Remote Desktop Session server hosts full Windows desktop sessions for Remote Desktop Services clients. Users can connect to a Remote Desktop Session server either through a Remote Desktop Web Access Server or a Remote Desktop Gateway Server. These virtual desktops provide the end user with a fully managed virtual desktop operating system and applications delivered securely to any network connected pc or thin client. Users will logon using the existing authentication within Active Directory via an encrypted connection to the Skyscape cloud. For Linux customers, MDS can provide a Linux Desktop Service based on Red Hat Enterprise Linux. The Red Hat Desktop is fast, secure and has an intuitive interface. It gives IT Administrators the ability to deploy tens, hundreds or thousands of end-user desktops across the enterprise. MDS provides this environment at a range of Security and Service Levels up to 99.99% availability allowing Consumers to match their application / user needs to an appropriate impact level, service level and cost instead of designing everything to the highest level when not needed. MDS service has been designed specifically for the UK public sector and is available only to the UK public sector. This service is provided through the use of Skyscape s cloud platform, bringing together Skyscape s Pan-Government accredited IaaS platform and MDS service management.
Classification: Open 2 Example Use Cases The service can help Organisations in a number of scenarios, including: Migrate away from existing physical desktop environments Access the corporate desktop from virtually anywhere Provide a rich Windows or Linux experience on a variety of devices Delivery of new cloud designed applications and services. Test, evaluation and consolidation of existing services. Remove the large upfront hardware capital expenditure Trial Service MDS offer a 14 day free trial. This is defined as two Windows or Linux desktop sessions hosted on shared servers. These virtual desktops share the same operating system and configuration and changes to the virtual desktop are discarded when the user logs off or disconnects. During the trial the virtual desktop sessions will be provided from Skyscape s OFFICIAL ASSURED cloud (previously IL0) on the BASIC Service Level. Connectivity to the virtual desktop sessions will be over RDP or SSH via the Internet. Free trials are subject to additional terms and conditions which are available on the Cloud Store. Information Assurance This service is based upon Skyscape s IaaS platform which is designed and optimised to meet the unique information assurance needs of UK public sector organisations. UK Sovereign platform delivered from secure UK data centres by a UK company with SC cleared UK staff Suitable for all data classified at OFFICIAL, including OFFICIAL-SENSITIVE data under the Government Security Classification Policy (GSCP) Suitable for legacy IL2, IL3 and IL4 (by aggregation) systems under the Government Protective Marking Scheme (GPMS) Independently certified against ISO27001 and ISO9001 Secure and resilient (Tier 3) UK data centres facilities capable of hosting data classified at OFFICIAL and OFFICIAL-SENSITIVE Product Features Desktop Services provides an accredited, secure and highly scalable compute platform which offers operational efficiencies, enhanced productivity, improved mobility while reducing the overall total cost of ownership.billed by user per month enabling significant cost savings and predictable month on month charges. A range of services levels T&D, BASIC, STANDARD and ENHANCED chose the right service at the right price. Assured Security suitable for OFFICIAL and OFFICIAL-SENSITIVE data, hosted in highly resilient Tier3, UK sovereign data centres and benefits from QinetiQ s Protective Monitoring solution.
Classification: Open 3 Green this service is based in UK data centres which offer market leading efficiency around power and cooling. Technical Features Some of the technical features of Remote Desktop Sessions include: Standardisation of the corporate desktop, application and email client. Anywhere access to the corporate desktop. Rich Windows or Linux user experience available on a variety of devices and platforms, including Windows, Windows RT, ios, Mac OS X, Android, X11 client and thin client. Remotely delivered desktops where the data stays in the data centre so the risk of information loss from lost or stolen devices is reduced. Built-in business continuity and disaster recovery. Remote Desktop Sessions hosted on Windows Server 2008 R2 or Red Hat Enterprise Linux for scalability and stability. The Remote Desktop Session can use audio recording redirection, Windows Aero experience and remote computer audio and video playback redirection. Set and control access, user profiles and capabilities. Upload and install Remote Desktop Services aware applications and data. Service Options MDS provide four Service Levels to choose from: T&D compute is hosted in one UK DC with no backup included by default. Typical use cases can include short term testing and development projects or less critical workloads such as temporary applications. BASIC compute is hosted in one UK DC with no backup included by default. Typical use cases can include true cloud applications which are designed for failure, short term Pilots & PoC s or when disposable compute resources are required. STANDARD compute is hosted in one UK DC and includes a local backup for 14 days within the price of both the RDS virtual servers and additional storage. In addition, backups can be stored for 28 days at an additional charge. Typical uses cases include Enterprise / Production environments requiring the additional protection of automated backup included. This solution can be engineered to help a Consumer design a solution that is highly resilient. ENHANCED compute offers Consumer a turnkey solution that contains a highly resilient environment by continually replicating the live VMs over to the second DC in real time, offering near zero RPO and RTO s to help Consumers with their Disaster Avoidance plans. The service includes a local and remote backup for 14 days within the price of both the VM and additional storage. In addition, backups can be stored for 28 days at an additional charge.
Classification: Open 4 T&D BASIC STANDARD ENHANCED Service Level Agreement 99.90% 99.95% 99.99% 99.99% Compute Environment Location Disaster Recovery between DCs Single UK DC Single UK DC Single UK DC Dual UK DC No No No Yes Performance of VM Contended Uncontended Uncontended Uncontended Automated VM Backup Optional Optional Included Local or Remote QinetiQ Protective Monitoring Backup/Recovery and Disaster Recovery Backup/Recovery Included Local and Remote Included within the Elevated Official platform at the hypervisor layer and below. Various backup options are offered depending on the service option selected. Disaster Recovery For Consumers choosing the ENHANCED Service Level: The Remote Desktop Servers and their asscociated data will automatically replicate to a second UK locale which provides a robust solution for more substantial failure of the primary environment (e.g. site failure). At the T&D, BASIC and STANDARD service levels: Organisations can choose to deploy independent Remote Desktop Servers in each site and implement application level replication utilising the underlying secure and scalable inter-data centre circuits (at additional cost). In the event of a site failure, the Consumer is able to failover their environment to the second data centre. Organisations can choose to have backups stored at aremote site. In the event of a major failure affecting the primary data centre, MDS will endeavour to help Consumers to re-provision their environment within the second data centre. Consumers should note that this is subject to available capacity within the second data centre. If consumers require certainty that capacity will be available in the event of DR, it is recommended that resources are procured at the second data centre. Service Levels We will meet the follow service levels, associated with the management of Incidents occurring within the scope of services provided by MDS. Incident resolution SLAs apply within our Core Service Hours, which are 8am to 6pm, Monday to Friday (excluding Public Holidays). Where a customer has additionally procured 24/7 Support for P1 Incidents, the P1 service level applies 24/7/365. Priority Level Response Target for MDS to Acknowledge Problem Notification Response Target for MDS to Update Customer Resolution Time 1 Critical systems failure or severely impaired 15 Minutes 30 Minutes 4 Working Hours (6 Hours outside Core Service Hours)*
Classification: Open 5 Priority Level Response Target for MDS to Acknowledge Problem Notification Response Target for MDS to Update Customer Resolution Time 2 User group or key user unable to operate, experiencing significant reduction in system performance 3 Single user unable to operate with no available workaround 4 User or user group experiencing problems but with a work around that does not affect service delivery 15 Minutes 30 Minutes 6 Working Hours 30 Minutes 60 Minutes 3 Working Days 60 Minutes 4 Working Hours 7 Working Days In addition, MDS provides an Availability SLA for the Desktop Service as per the following table. T&D BASIC STANDARD ENHANCED Availability (monthly*) 99.90% 99.95% 99.99% 99.99% Service credits 3% of monthly 5% of monthly 10% of monthly 15% of monthly Availability indication based on an average 730 hours per month. Excludes planned & emergency maintenance. Unavailability applies to existing RDS VMs where the VM becomes unresponsive due to a fault recognised at the hypervisor layer or lower: i.e. fault is not within the Consumers control (OS, Applications, user networks) Fault is within MDS controlled components such as the virtual infrastructure, storage, power and physical firewalls & routers etc External connectivity providers (e.g. internet, PSN, GSi) and components collocated at Skyscape are also not included in the availability calculation Pricing Model Windows Pricing for this Windows service will be based on a customers specific requirements. Set out below is example pricing for a 25 user Virtual Desktop Infrastructure solution using the STANDARD service level: The base specification for each virtual desktop is 1 x vcpu with 1GB RAM, 1GB of additional data storage, Windows license and antivirus license. Optional extras can be added including: Microsoft Office (including Outlook), Microsoft Project, Microsoft Visio, additional vcpu s, RAM and storage per virtual desktop.
Classification: Open 6 25 User Desktops This example pricing is subject to customer application requirements. The solution utilises three virtual servers: An Active Directory Server 2 x 2GHz CPU and 4GB RAM A Remote Desktop Web Access Portal & RD Gateway Server 4 x 2GHz CPU and 8GB RAM A Remote Desktop Session Host & Licensing Server 8 x 2GHz CPU and 32GB RAM Pricing for a fully managed solution with up to 25 concurrent Windows7 sessions: Linux Assured Official Platform - 89.16 per virtual desktop per month Elevated Official Platform - 111.13 per virtual desktop per month Pricing for this Red Hat Enterprise Linux service will be based on a customers specific requirements. Set out below is example pricing for a 25 user Virtual Desktop Infrastructure solution running an X11 client using the STANDARD service level: The solution utilises an instance of Red Hat Enterprise Linux server from Skyscape. The server has 8 vcpus, 32GB RAM and 300GB of storage. The server runs for 730 hours per month on average and has a snapshot backup taken automatically every night with a 14 night rotation. The base specification for each virtual desktop is 1 vcpu with 1GB RAM and 10GB of storage. Optional extras can be added including thin client devices, additional vcpus and storage. 25 User Desktops This example pricing is subject to customer application requirements. The solution utilises one virtual server: Red Hat Enterprise Linux Server 4 x 2GHz CPU, 32GB RAM and 300GB of storage. Pricing for a fully managed solution with up to 25 concurrent Red Hat sessions: Assured Official Platform - 58.11 per virtual desktop per month Elevated Official Platform - 72.71 per virtual desktop per month Related Services This service may be bought in conjunction with the following other G-Cloud services: Managed Server Cloud Enablement Secure Client Secure Remote Access Connecting to the Cloud
Classification: Open 7 Appendix On-boarding and off-boarding MDS provides an on-boarding and off-boarding process for this service. On-boarding During on-boarding MDS will work with the customer to gather the information required to create the necessary remote desktop sessions. MDS will then configure the virtual desktop environment to this agreed specification. This will involve installing Remote Desktop aware applications and, where necessary, personal virtual desktops or user desktop pools. Off-boarding Prior to terminating the contract, the Consumer will be able to transfer all their data out of the solution. When the organisation terminates their agreement with MDS, MDS will ensure that all of the organisation s desktop configuration, data and applications are deleted. Service management The service will be provided through our service desk, offering: Provision of a 24/7 Single Point of Contact Service Desk. Incident and Problem Management Service Availability Monitoring Monthly Standard Service Reporting, covering: Service constraints Availability reporting Service Desk performance Change Management Some applications may not install in a shared session configuration therefore that application will not be included in the service. Training Where appropriate, we will provide guidance in the use of the Remote Desktop Service. Otherwise, no training is required to use this service. Ordering and invoicing Billing for the service is monthly in arrears. Payment can be via Purchase Order and Direct Debit. Service lead time Setting up a new organisation will typically be completed within a week from acceptance of order. Shorter deployment times are typically achieved and can be prioritised upon request. Once set up Organisations have instant access to remote desktop sessions. Termination Terms At the point of termination, all consumer data, accounts and access will be permanently deleted, and will not be able to be subsequently recovered or restored. Costs There are no termination costs for this Service. Consumers are responsible for extracting their own data from the platform if required. MDS may make an additional charge for transferring data out of the service.
Classification: Open 8 Customer responsibilities The control and management of access and responsibilities for end users including appropriate connectivity, security and accreditation if required. Where access is required over a secured network, the consumer is responsible for adhering to the Code of Connection and assigning appropriate IP addresses from their own allocation to their services hosted on the Skyscape platform. The consumer is also responsible for ensuring only appropriate data (e.g. OFFICIAL or OFFICIAL SENSITIVE) is stored and processed by applications on this environment and that they comply with the Skyscape Security Operating Procedures (SyOps) and other information assurance requirements as specified in Skyscape System Interconnect and Security Policy (SISP) and associated accreditation documentation sets. Financial recompense model If the service level falls below the stated availability percentage (excluding Planned and Emergency maintenance periods), consumers will be eligible for service credits on affected VM s only. Service credits will be calculated as a percentage of the fees for the affected services for the monthly billing period during which the failure occurred (to be applied at the end of the billing cycle). Service Credit Cap Compute Environment: T&D Service Level Compute Environment: BASIC Service Level Compute Environment: STANDARD Service Level Compute Environment: ENHANCED Service Level Client Portal and API 3% of monthly 5% of monthly 10% of monthly 15% of monthly 1% of monthly per 5% below service level target or part thereof 3% of monthly 5% of monthly 10% of monthly 15% of monthly Up to 5% of monthly Technical requirements Consumers will require appropriate network connectivity such as internet access or accredited connectivity such as the Public Sector Network (PSN) in order to access the Skyscape Cloud Platforms. Connectivity via the Internet, a government secure network (PSN, N3) or private leased line is available but may incur additional charges if the hosting of CPE routers is required. Where required, Consumers are responsible for procuring and managing appropriate devices or software to meet the requirement for data security over the various forms of connectivity. Consumers have a number of options to choose from with Skyscape to access their environment dependant on their requirement. The below are guides to demonstrate what is possible but may require further engagement to explain further: Assured OFFICIAL Standard Internet connectivity over common protocols (HTTP, HTTPS, SSH, etc) Non-standard ports considered via Service Request Secure commercial grade VPN Self-managed Site-to-Site IPSEC VPN to the Skyscape compute environment Self-managed SSL VPN to the Skyscape compute environment PSN - You might need to assign part of your PSN IP allocation to your services hosted by Skyscape N3
Classification: Open 9 Leased Line (CAS(T) compliant) or non-cas(t) using CPA/PEPAS overlay encryption Elevated OFFICIAL Preferred connectivity is over a Government Secure Network such as PSN(You might need to assign part of your PSN IP allocation to your services hosted by Skyscape) N3 Connection PSN or CAS(T) Leased Line CPA/PEPAS approved solution providing overlay encryption (e.g. Cisco ISR/ASR) Internet or non CAS(T) circuit based VPN Site-to-Site VPN using CAPS approved solutions (e.g. Ultra AEP X-Kryptor) CPA assured solution where Foundation Grade assurance is appropriate (e.g. Cisco ISR/ASR) Secured Leased Line Consumers are responsible for the related assurance plan for accreditation if required.