Primary Storage in the Cloud Version: 5.0, Issue Date: 07/12/2014 Classification: Open
Classification: Open ii MDS Technologies Ltd 2014. Other than for the sole purpose of evaluating this Response, no part of this material may be reproduced or transmitted in any form, or by any means, electronic, mechanical, photocopied, recorded or otherwise or stored in any retrieval system of any nature without the written permission of MDS Technologies Ltd. MDS Technologies Ltd, Spring Park, Westwells Road, Corsham, Wiltshire SN13 9GB Telephone: 01225 816220, Fax: 01225 816281 Contents Why MDS?... 1 Summary of service benefits... 1 Product Overview... 1 Example Use Cases... 2 Information Assurance... 2 Product Features... 3 Technical Features... 3 Service Options... 4 Backup/Recovery and Disaster Recovery... 4 Service Levels... 4 Pricing Model... 5 Worked Example... 6 Trial Service... 7 Related Services... 7 Appendix... 8
Classification: Open 1 Why MDS? A tailored cloud solution that fits your business needs Full range of cloud hosting options from pure public cloud to hybrid cloud and physical enablement solutions A support team which is based on the same highly secure campus as our cloud platform An assured cloud platform that is independently validated for OFFICIAL and OFFICIAL SENSITIVE data A fully managed platform, supported up to Operating System Over 12 years experience of providing infrastructure services SC cleared operational support staff 24/7 support through our ITIL-aligned Service Desk Additional professional services such as project delivery and technical consultancy ISO 27001, ISO 9001, ISO14001 accredited Over 12 years experience in supporting Public Sector customers A privately owned, UK sovereign company We are an SME - agile with minimal bureaucracy PROFESSIONAL, PERSONALISED SOLUTIONS Summary of service benefits Flexible storage solution delivered as a cloud service and designed to meet unique requirements for scale, budget and security Dedicated single-tenant cloud storage solution provides stronger assurance of isolation in line with CESG Cloud Security Principles Optimised to be accessed by application servers within the Skyscape cloud platform UK sovereign an assured cloud platform delivered from two secure UK data centres by a UK company with SC cleared UK staff Disaster tolerant two Tier 3 UK data centres separated by more than 100KM and securely connected by high bandwidth, low latency dedicated circuits enabling automated replication and failover Optimised for OFFICIAL hosted in the UK & operated by SC cleared staff, the service benefits from extensive independent validation (including CESG PGA) that it is properly aligned with CESG Cloud Security Principles making it the ideal service for all data classified at OFFICIAL (including OFFICIAL-SENSITIVE) and legacy IL0- IL4 solutions Flexible Connectivity options - connect via the internet, a government community network (e.g. PSN Assured / Protected service, N3, etc.) or via HybridConnect (your own private circuits including CPA encrypted tunnels, MPLS, etc) Product Overview Primary Storage in the Cloud enables organisations to enjoy the benefits of the Skyscape Assured Cloud platform for a single-tenant (Private Cloud) storage infrastructure. This service is designed for organisations that have particular requirements which suit a dedicated storage infrastructure rather than a multi-tenant storage solution. Examples of such requirements are: Scale organisations that require Petabyte scale storage Security organisations that require additional isolation Budget organisations that prefer capital expenditure (capex) Primary Storage in the Cloud leverages the proven Skyscape Assured Cloud platform which provides the following benefits:
Classification: Open 2 UK Sovereign cloud platform delivered from two secure UK data centres by a UK company with SC cleared UK staff Extensive assurance through independent validation and alignment with the CESG Cloud Security Principles Accredited PSN Service enabling secure, compliant access via government community networks including N3, PSN Assured and PSN Protected networks Comprehensive automation and orchestration enabling true consumption as a cloud service Skyscape Primary Storage in the Cloud provides the most robust levels of assurance for data classified as OFFICIAL or OFFICIAL-SENSITIVE. Skyscape s service has been designed specifically of for the UK public sector and is available only to the UK public sector. The service supports and complies with all relevant areas of the Government ICT Strategy and Information Principles for the UK Public Sector. Skyscape s datacentres are some of the most energy efficient in the world and as such support the Green Government ICT Strategy in full. Example Use Cases Simpler Better Cheaper Organisations wanting to reduce the complexity of managing storage. Primary Storage in the Cloud provides consumers with new levels of simplicity. No more managing compliance, file systems, RAID groups just consume assured cloud storage Organisations seeking a better way to solve the growing problem of storing increasing amounts of data. Primary Storage in the Cloud provides secure, UK sovereign hosting, management by UK SC cleared experts and connectivity to government community networks The Skyscape Assured Cloud platform already benefits from extensive independent assurance that it delivers the highest levels of security. Organisations avoid the costs of having to create the assurance, management and hosting platform for the storage solution Information Assurance The Skyscape assured cloud platform is designed and optimised to meet the unique information assurance needs of UK public sector organisations. UK Sovereign cloud platform delivered from two secure UK data centres by a UK company with SC cleared UK staff Suitable for all data classified at OFFICIAL, including OFFICIAL-SENSITIVE data under the Government Security Classification Policy (GSCP) Suitable for legacy IL2, IL3 and IL4 (by aggregation) systems under the Government Protective Marking Scheme (GPMS) Extensive independent validation of alignment with the CESG Cloud Security Principles CESG Pan Government Accredited at both IL2 and IL3 Accredited PSN Service enabling secure, compliant access via both PSN Assured & PSN Protected networks Independently certified against ISO27001, Cyber Essentials Plus and members of the Cloud Security Alliance (CSA)
Classification: Open 3 Secure (List X) and resilient (Tier 3) UK data centres facilities capable of hosting data classified at SECRET Protective Monitoring (aligned with GPG13) across all Skyscape platforms Product Features The Skyscape Primary Storage in the Cloud service provides a high assurance, PSN/N3 connected and cost-effective alternative to hosting and managing your storage infrastructure. The service provides the following features: Assured hosted in the UK & operated by SC cleared staff, the service benefits from extensive independent validation (including CESG PGA IL3) which is fully aligned with CESG Cloud Security Principles making it the ideal service for all data classified at OFFICIAL (including OFFICIAL- SENSITIVE) and legacy IL0-IL4 solutions Dedicated the storage platform is designed for the exclusive use of each consumer providing the highest levels of separation and isolation from other consumers (e.g. a Private Cloud) Automated the storage solution is delivered as a cloud service through high levels of automation enabling self-service via the Skyscape Portal Cost-effective Primary Storage in the Cloud can be purchased to suit all budgets including up-front capital expenditure (capex) and on-going operational expenditure (opex) Green the Skyscape service is based in UK data centres which offer market leading efficiency around power and cooling. A Skyscape solution will generate less Carbon than many other solutions Geodiversity the platform can be designed to span two UK data centres separated by over 100km Technical Features Primary Storage in the Cloud provides the following features: Integrates with existing, native and virtualized enterprise applications with no change to the application or stack Native support of a wide variety of network protocols including SMB/CIFS, NFS, HTTP and optionally HDFS Connectivity via a variety of networks; PSN Assured, PSN Protected, Internet, legacy GCF networks (e.g. GSI, GSE, PNN, etc), N3 and HybridConnect options Custom hardware sizing from 100TB to 20PB+ with support for a single large file-system if required Automated systems management via the Skyscape Portal and API (e.g. showback of utilisation, health, availability) Option to implement a multi-site replicated Primary Storage in the Cloud solution Available within both the Skyscape Assured OFFICIAL platform and the Skyscape Elevated OFFICIAL platform Compatible with WAN Acceleration solutions (e.g. Riverbed) and Cloud Storage gateways (e.g. EMC TwinStrata) Advanced software features such as; auto-tiering, de-duplication, retention, replication, quotas, snapshots, etc are available
Classification: Open 4 Service Options Skyscape provide two Service Levels to choose from: STANDARD Service Level Agreement 99.99% 99.99% Protection Level Backup/Recovery and Disaster Recovery Organisations can choose from two protection levels. ENHANCED Local Protection (Single Site) Remote Protection (Dual Site) STANDARD data is stored in a single UK Data Centre with data protection using Erasure Coding which provides a degree of fault tolerance and so improves data durability (survives node failures and disk failures). ENHANCED data is stored in two UK sovereign Data Centres, with a copy maintained in a primary named UK data centre and copied to a geographically remote UK data centre. This provides the highest degree of fault tolerance (including site failure) and corresponding data durability. Service Levels Skyscape provide both an Availability SLA and Response Time SLA for Storage as a Service as per the following table. STANDARD Availability (monthly*) 99.99% 99.99% Incident response P1 within 15 minutes P2 within 4 hours P3 within 24 hours P4 within 72 hours ENHANCED Service credits 10% of monthly spend 10% of monthly spend * Availability indication based on an average 730 hours per month which excludes planned & emergency maintenance. Unavailability applies to existing data where the data becomes inaccessible due to a fault recognised at the IaaS layer or lower, for example: Fault is not within the consumers control (applications, user networks, etc) Fault is within Skyscape controlled components such as the storage infrastructure, power and physical firewalls & routers etc. External connectivity providers (e.g. internet, PSN, N3) and components co-located at Skyscape are also not included in the availability calculation. In addition, Skyscape also provide an Availability Service Level Target on the Skyscape Portal i.e. the ability to log into the portal to create support tickets and use other functions. Client Portal Availability (monthly) 99.90% Target Availability (monthly*)
Classification: Open 5 Pricing Model Skyscape Primary Storage in the Cloud is available in two packages: Procurement of Storage Hardware & related Infrastructure (e.g. Network) Skyscape All Inclusive Platform Only Consumer or MDS Hardware Design & Deployment Skyscape Skyscape Capacity Management Skyscape Consumer or MDS Availability Management Skyscape Skyscape Health Management Skyscape Skyscape Performance Management Consumer or MDS Consumer or MDS Support & Maintenance Skyscape Skyscape Assurance & Compliance Skyscape Skyscape All Inclusive The All Inclusive package provides consumers with a turn-key solution including the Dedicated Storage hardware and underlying Skyscape Assured Cloud platform. Asset options: 0-99TB Usable Storage from 10p per GB per month* 100-249TB Usable Storage from 7p per GB per month* 250-499TB Usable Storage from 5p per GB per month* 1PB Usable Storage from 3p per GB per month* * Based on a 24 month contract. Price will vary depending on specific hardware, functionality and performance requirements. Upgrade options: Automated site replication & failover: from 10p per GB per month* * Assuming a 24 month contract - however upgrades will be co-terminus with the original contract and so the price will increase on a pro-rata basis. Price will vary depending on specific hardware and performance requirements. This package is available as follows: Capex Optimised Upfront Payment Design & Deploy From 10% of Asset cost From 10,000 Annual Payment Asset Pre-Payment Asset cost / 2 Zero Opex Optimised Monthly Charge Asset Finance Zero Asset cost + 20% / 24 months Monthly Charge Platform Fee From 1,000 per KW From 1,000 per KW Minimum Term 24 months 24 months Early Exit Charge Remainder of Asset cost Remainder of Asset Finance Premium for Elevated OFFICIAL From 20% From 20% Unit of Billing Usable Storage up-front Platform fee per month Usable Storage per month (includes Platform fee per month)
Classification: Open 6 Worked Example A Skyscape Primary Storage in the Cloud platform sized at 100TB and consuming 3.5KW Storage and Network Hardware costs 100,000GB x 7p x 24 months = 168,000 Capex Optimised Upfront Payment Design & Deploy 16,800 10,000 Annual Payment Asset Pre-Payment 84,000 per year Zero Opex Optimised Monthly Charge Asset Finance Zero 8,400 per month Monthly Charge Platform Fee 3,500 per month 3,500 per month Minimum Term 24 months 24 months Early Exit Charge 84,000 in year 1 0 in year 2 8,400 x no. months remaining Platform Fee Premium for Elevated OFFICIAL 700 per month 700 per month Unit of Billing Platform Only Usable Storage up-front Platform fee per month Usable Storage per month (includes Platform fee per month) The Platform Only package provides consumers with the underlying Assured Cloud platform to host and manage the Dedicated Storage hardware. This package is available as follows: Worked Example: Upfront Payment Design & Deploy From 10,000 Monthly Charge Platform Fee Minimum Term Early Exit Charge Platform Only From 1,000 per KW 24 months Premium for Elevated OFFICIAL From 20% Unit of Billing A Skyscape Primary Storage in the Cloud platform consuming 5KW Upfront Payment Design & Deploy 10,000 Monthly Charge Platform Fee Minimum Term Early Exit Charge Premium for Elevated OFFICIAL Unit of Billing Remainder of Platform Fee Platform fee per month Platform Only 5,000 per month 24 months 5,000 x no. months remaining 1,000 per month Platform fee per month Ancillary Options The Skyscape Pricing Guide provides a comprehensive catalogue of pricing; including all ancillary service options available to consumers when used in conjunction with Skyscape Compute as a Service. Ancillary options include: Offline facilities to support data ingestion and extraction. Connectivity options including HybridConnect, PSN, N3, Internet, data centre interconnect, etc.
Classification: Open 7 Trial Service Due to the dedicated, single tenant nature of this solution, a trial service is not available. Skyscape API accessible storage provides consumers with a trial service which enables consumers to test the viability of cloud storage. Related Services This service may be bought in conjunction with the following other G-Cloud services: Dedicated Compute Cloud Compute as a Service Managed Server Managed Backups Connecting to the Cloud
Classification: Open 8 Appendix On-boarding and off-boarding On-boarding Due to the nature of this service, on acceptance of an order, Skyscape will work with the consumer to create a detailed design for the Dedicated Cloud Service. This design will formalise the dedicated components required for the solution, e.g. storage hardware, storage software, network hardware, cables, etc. The dedicated components will either be procured by Skyscape or the consumer depending on the package requested. Skyscape will also create the consumer s Primary Administrator account and send the consumer a Welcome Pack which includes the URL for the Skyscape Portal for access to the knowledge centre and service management function. As Skyscape has two UK data centres, a consumer can request to be deployed into a specific one at the time of the order if they require. Whilst unlikely to ever be rejected, this remains at Skyscape discretion. Off-boarding All Inclusive package: Prior to terminating the contract, the consumer is able to transfer all their data out of the solution or opt to make the final payment and take ownership of the storage hardware. Platform only package: As the storage hardware is owned by the consumer, the consumer must make arrangements to collect the storage hardware within 14 days of contract termination. For clarity, when the consumer terminates their agreement with Skyscape, Skyscape ensures all of the organisation s data is deleted unless the consumer owns the storage hardware. Service management As a true Cloud service aligned to the NIST definition of IaaS, the service is designed to be self managed via the secure online Skyscape API and the Skyscape Portal which provides common Service Management functionality and addresses standard requirements. On rare occasions, Skyscape may decide to assign an experienced, qualified ITIL Service Delivery Manager to some Consumers. In these cases, the SDM will provide additional assistance with reporting, incident escalation and continual service improvement, at all times following Skyscape s ISO20000 certified ITIL-based process framework. For Organisations that require more of a managed service, Skyscape work with MDS to provide a Managed Service wrapper around the Skyscape IaaS. Skyscape use EMC as a subcontractor. Service constraints The Skyscape Assured Cloud platform is designed and optimised to operate in specific conditions. Skyscape therefore impose a number of service constraints such as: Support for specific hardware configuration (e.g. certain EMC Isilon configurations, certain Cisco + EMC + VMware configurations, certain Super Micro configurations) Skyscape must be named agents for all support and maintenance contracts Data centre access is only available to Skyscape staff consumers will not be allowed access to the data centres except in exceptional circumstances Primary Storage in the Cloud must include specified top-of-rack/end-of-rack network switches which will be designed, implemented and managed by Skyscape Primary Storage in the Cloud must include specific software features to enable Skyscape to provide automation, orchestration and instrumentation Skyscape provide no SLA or warranty related to performance
Classification: Open 9 Skyscape will adhere to the following in terms of maintenance windows: Planned Maintenance means any pre-planned maintenance of any infrastructure relating to the Services. Skyscape shall provide the client with at least twenty four (24) hours advance notice of any such planned maintenance Planned maintenance of Skyscape s infrastructure relating to the services shall happen between the hours of 00:00 and 06:00 (UK local time) Monday to Sunday and/or between the hours of 08:00 and 12:00 (UK local time) on a Saturday and/or Sunday. No planned maintenance will take place on a Saturday unless agreed in advance by both parties. Planned maintenance shall be excluded from any availability calculation in regard to service credits but shall be included in the monthly service reporting Emergency Maintenance means any emergency maintenance of any of the infrastructure relating to the services. Whenever possible, Skyscape shall provide the client with at least six (6) hours advance notice: Whenever possible Emergency Maintenance of Skyscape s infrastructure will happen between the hours of 00:00 and 06:00 (UK local time) Monday to Sunday and/or between the hours of 08:00 and 12:00 (UK local time)on Saturday and/or Sunday unless there is an identified and demonstrable immediate risk to a Clients environment Emergency Maintenance shall be excluded from any availability calculation in regard to service credits but shall be included in the monthly service reporting. Training Skyscape have created a number of videos, help guides, manuals and FAQs to help train and instruct users so that are up and running quickly and easily. MDS are able to deliver additional services such as training, support and managed services. Ordering and invoicing This service is offered subject to availability. Billing for the service is: At point of order for up-front fees Annual in advance for pre-payment fees Monthly in arrears for monthly fees Payment can be via purchase order and Direct Debit. Service lead time Setting up a new consumer within the Skyscape Portal will typically be completed within 48 hours from acceptance of order. Resources to begin the design and deployment activity will be assigned within 10 days from acceptance of order. Due to the variable nature of this service, dedicated hardware will need to be specified, ordered and delivered which will take an indeterminate amount of time. Shorter deployment times are typically achieved with multi-tenant cloud storage solutions such as Skyscape API accessible storage. Termination Terms An Early Exit charge will be payable if the contract is terminated before the end of its original term. At the point of termination, consumer will have the option to make a final payment in order to take ownership of the storage hardware.
Classification: Open 10 Where the consumer owns the storage hardware, it must be collected from Skyscape with 14 days. Where the consumer does not own the storage hardware, Skyscape will ensure all consumer data, accounts and access will be permanently deleted, and will not be able to be subsequently recovered or restored. Costs An Early Exit charge will be payable if the contract is terminated before the end of its original term. Consumers are responsible for extracting their own data from the platform if required. Skyscape may make an additional charge for transferring data out of the service. Data restoration / service migration For service migration, Skyscape allows existing data to be migrated to and from the Primary Storage in the Cloud service. In many circumstances, Skyscape can help facilitate a bulk migration to the platform using offline data ingest and extraction please ask Skyscape for details. Customer responsibilities Consumers of the Primary Storage in the Cloud service are responsible for the following: The control and management of access and responsibilities for end users including appropriate connectivity, security and accreditation if required. Where access is required over Government Secure Networks such as N3, legacy GCF networks or PSN, the consumer is responsible for adhering to the Code of Connection. Management and administration of layers above the IaaS (e.g. the systems that utilise the Primary Storage in the Cloud platform). As a core benefit of the Cloud Platform, consumers are expected to self-manage the environment including creating and deleting data. Consumers must be aware of the variable nature of the billing based on usage. The consumer is also responsible for ensuring only appropriate data (e.g. OFFICIAL or OFFICIAL SENSITIVE) is stored and processed by applications on this environment and that they comply with the Skyscape Security Operating Procedures (SyOps) and other information assurance requirements as specified in Skyscape System Interconnect and Security Policy (SISP) and associated accreditation documentation sets. Financial recompense model If the service level falls below the stated availability percentage (excluding Planned and Emergency maintenance periods), consumers will be eligible for service credits on affected storage only. Service credits will be calculated as a percentage of the fees for the affected services for the monthly billing period during which the failure occurred (to be applied at the end of the billing cycle). STANDARD Service Level ENHANCED Service Level Client Portal Service Credit 10% of monthly spend 15% of monthly spend 1% of monthly spend per 1% below service level target or part thereof
Classification: Open 11 Technical requirements The consumer is responsible for the procurement or development of the application and the correct implementation of support for the storage solution. Consumers have a number of options to choose from with Skyscape to access their environment dependant on their requirement. The list below provides a guide to demonstrate what is possible but may require further engagement with Skyscape to explain and validate further: Assured OFFICAL (Lower security domain) Standard Internet connectivity over common protocols (HTTP, HTTPS, SSH, etc) N3 for access to the Health and Social Care community. You will be required to complete the N3 Information Governance Statement of Compliance process PSN Assured service You will need to be a PSN Service Provider or a HMG customer that has PSN certification. HybridConnect private circuit solutions including: CAS(T) compliant connections (e.g. Leased Line, MPLS, etc) non-cas(t) compliant connections (e.g. Leased Line, MPLS, etc) using additional CPA/PEPAS overlay encryption Site-to-Site VPN using standards based IPSEC solutions Dedicated fibre connectivity within Ark Data Centre Elevated OFFICIAL (Higher security domain) Preferred connectivity is over a Government Secure Network such as N3, GSI or PSN N3 for access to the Health and Social Care community. You will be required to complete the N3 Information Governance Statement of Compliance process. (additional controls may need to be implemented to enable N3 access to the higher security domain) PSN Protected service - You will need to be a PSN Service Provider or a HMG customer that has PSN certification. Legacy GCF networks such as GSI, GSE, PNN, etc via the PSN Protected service Skyscape Secure Remote Access service HybridConnect private circuit solutions including: CAS(T) compliant connections (e.g. Leased Line, MPLS, etc) using additional CPA/PEPAS overlay encryption non-cas(t) compliant connections (e.g. Leased Line, MPLS, etc) using additional CPA/PEPAS overlay encryption Site-to-Site VPN using standards based CPA approved solutions Dedicated bonded fibre connectivity within Ark Data Centre Site-to-Site VPN using CAPS approved solutions (e.g. Ultra AEP X-Kryptor) CPA assured solution where Foundation Grade assurance is appropriate (e.g. Cisco ISR/ASR) Secured Leased Line (assured network connection)