BACKUP AS A SERVICE - SERVICE DEFINITION

BACKUP AS A SERVICE - SERVICE DEFINITION Provided in response to the Government Procurement Service G- Cloud Services III Procurement Vehicle Invitation to Tender Reference RM1557/iii 2013 Novosco Ltd. All Rights Reserved

Table of Contents 1 Executive Summary... 3 1.1 Benefits of CloudStream Backup as a Service... 3 2 Service Definition... 4 2.1 Architecture Overview of the CloudStream Backup as a Service... 4 2.2 Product Features... 5 2.3 Functional Description... 6 2.3.1 Flexibility... 6 2.3.2 System Availability... 7 2.3.3 Connectivity... 7 2.3.4 RPO and RTO... 7 2.3.5 Location... 8 2.4 Lot 1 Backup as a Service - Example Use Cases... 8 2.5 Novosco Accreditations... 8 2.6 Information Assurance... 9 2.7 Details of the Level of Backup/Restore and Disaster Recovery That Will Be Provided... 9 2.8 On-Boarding and Off-Boarding Process/Scope... 10 2.9 Service Management Details... 10 2.10 Service Constraints... 11 2.11 Service Levels... 11 2.12 Financial recompense model for not meeting service levels... 11 2.13 Training... 12 2.14 Ordering and invoicing process... 12 2.15 Termination terms... 12 2.16 Data Restoration / Service Migration... 12 2.17 Consumer Responsibilities... 13 2.18 Technical Requirements... 13 2.19 Details of any trial service available.... 13 2.20 Data Extraction/Removal... 13 2.20.1 Data Standards... 13 2.20.2 Commitment to returning all consumer generated data... 14 2.20.3 Formats / standards into which data will be extracted... 14 2.20.4 Price for extraction of consumer generated data... 14 2.20.5 Confirmation that the Supplier will destroy Consumer generated data.... 14 Commercial in Confidence 1

2.21 Data Storage and Processing Locations... 14 2.22 Deployment Models... 14 2.23 Service Models... 14 2.24 Burst v. Elastic Resources... 14 2.25 Guaranteed and Non-Guaranteed Resources... 15 2.26 Persistence of Storage... 15 2.27 Service Provisioning... 15 2.28 Utilisation Monitoring/Reporting... 15 2.29 Data Centre(s)... 15 2.30 Network... 16 2.31 Use By Other Suppliers... 16 2.32 Standard Configurations... 16 2.33 Service Roadmaps... 16 2.34 PaaS Types... 17 3 Pricing... 18 4 About Novosco... 19 Commercial in Confidence 2

1 Executive Summary Many organisations find that internal backup solutions are creating an additional financial and personnel resource burden on the constrained ICT budgets. This is particularly acute when internal backup solutions are due for refresh. Even with regular disaster recovery testing, many organisations doubt their ability to be able to fully recover data and applications following a serious ICT outage. The Novosco CloudStream Backup as a Service (BaaS) solution addresses these common issues by providing a resilient, cost effective, managed service that removes the complexity and overheads of running an internal backup service. The Novosco CloudStream BaaS solution provides an off-site storage based backup service, providing support for the leading industry operating systems and broad enterprise application support. With smart data de-duplication and efficient WAN usage, the Novosco CloudStream BaaS solution provides fast and un-intrusive agent based backups of your ICT infrastructure. Delivered via an ITIL aligned Service Desk, the solution is a proven, simple, and affordable pay as you go service. 1.1 Benefits of CloudStream Backup as a Service Benefit Justification Cost Reduction Broad Enterprise Support Managed Service Support Proven Technology This solution is based on a consumption based model that does not require investment in hardware, software, licensing or extensive training. Simply pay for what you use. Novosco BaaS is not limited to just Windows or VMware environments as is common with many other solutions. We monitor, manage, and support the entire BaaS infrastructure on your behalf to some of the highest service levels in the industry. The Novosco CloudStream BaaS solution already processes over 5.4PB of source data per year for a range of diverse organisations. Commercial in Confidence 3

2 Service Definition 2.1 Architecture Overview of the CloudStream Backup as a Service The Novosco CloudStream BaaS can be deployed in two architecture configurations, which include a pure off-site backup solution or a hybrid onsite backup solution with data replicated to offsite storage. Both architectures are pictured in the illustrations below: Figure 1: Over the WAN backup (For offsite backup) Figure 2: Onsite backup with replication of backup data offsite. In either deployment scenario, the architecture is an agent-based backup to a registered system (whether that system is local or remote). Commercial in Confidence 4

It is possible to mix the architectures. An example of this would be to have a branch office backup directly to our hosted service, but perform local backup in a main office (with replication to the hosted service). 2.2 Product Features The key features of CloudStream BaaS include: Simple charging mechanism based on the client s source TB capacity with no agent or plugin licensing; A choice of backup schedules within the defined backup window; Basic backup retention of the last 60 calendar days. Higher retention options are available; Multi-tenant architecture suitable for public/private and hybrid cloud deployments; WAN efficient backup agents; Optional dedicated infrastructure rather than shared; and Highly scalable architecture a single logical system can scale up to 120 TB. Further core CloudStream BaaS features: Feature Broad Client OS support Self-Service Application Plugins Backup Domain Description Our backup service features comprehensive OS support including Microsoft Windows/Mac OS X/Red Hat Linux (RHEL)/Linux/Sun Solaris. 24/7 access to initiate your own backup/restore/manage running activities. Our backup service features native support for the backup of common Enterprise applications including (but not limited to) Microsoft Exchange/Microsoft SQL Server/Microsoft SharePoint/Oracle. A backup domain is a software structure used to logically separate tenants on the same logical backup system. Tenants can log into their domain only, backup to and restore from their Commercial in Confidence 5

domain only. Service Capacity Service Reporting Novosco manages the capacity of all provided systems to meet and exceed the sum of all sold quotas and predicted growth rates. Daily reports will be provided as follows: Backup jobs reports; Backup faults report; Monthly reports will be provided as follows: o Billing report o Incident reports Further on-demand reports are available by request. Security Numerous defined measures in place for logical separation and security of system access and data safety. Dedicated backup systems can be deployed where physical separation is a requirement. Logging of customer activities for audit purposes. Service Term Minimum usage will be 12 months with one month notice to terminate the service. 2.3 Functional Description CloudStream BaaS has been developed in response to customer demand for a utility based cloud backup model. Novosco has leveraged its extensive enterprise experience to provide a service with the following functional components: 2.3.1 Flexibility CloudStream Backup allows customers to scale their backup requirements on demand. We will ensure the target systems have ample capacity for demand. You need only inform us if your requirements change dramatically. Commercial in Confidence 6

2.3.2 System Availability The backup service components we host will operate with the following high availability features: Backup systems connected to resilient Ethernet switching; Backup systems connected to the Internet utilise a fully resilient routing platform; Backup systems are protected via a clustered perimeter firewall; Backup system nodes have local RAID and 24/7/365 hardware support with dial home to manufacturer configured; [optional]backup system nodes can be configured as a Redundant Array of Independent Nodes (RAIN). In this configuration the backup system can survive a node failure; and [optional]the backup system can be fully replicated to another independent backup system. The backup system also features the following protection measures: Checkpoints to revert the system from specific short-term operational issues. 2.3.3 Connectivity Consumers of the public cloud model can consume the backup service via their Internet connection. Client communications will automatically be encrypted. Where the service is consumed via the Internet it will be restricted to a list of known public IP addresses. As such you must be accessing the service from a static IP address. The perimeter security will also filter ports and protocols to those required for service operation. Consumers of the private cloud model can access the offsite element of the solution via Internet connection or high speed data centre interconnection. Where the solution has an on-site element a private DC interconnect or site-to-site VPN will be required. 2.3.4 RPO and RTO The target RPO (Recovery Point Objective) for standard backup configurations will be 24 hours. The RTO (Recovery Time Objective) is a variable based on a number of factors (such as Commercial in Confidence 7

available bandwidth, infrastructure availability on the restore target and data volume). Our contribution to maintaining a RTO target which is as low as possible is to maintain an infrastructure free of service affecting bottlenecks up to our network perimeter. The lowest attainable RTO via our backup service is via the optional on-site component. 2.3.5 Location CloudStream BaaS will deliver its services from UK facilities rated as Tier 3 data centres. 2.4 Lot 1 Backup as a Service - Example Use Cases The following are some of the most common reasons why clients use CloudStream BaaS Replace an existing backup solution to take advantage of operational cost model/outsourced expertise; Strategic offsite backup backup key assets offsite without having to invest heavily in colocation; and Resolve departmental skillset pressures - freeing up the requirement to have in house subject matter experts for in-house backup infrastructure. 2.5 Novosco Accreditations Professional Accreditations Novosco is registered with ISO9001 Novosco is registered with ISO27001 Novosco is registered with the Information Commissions Office under the Data Protection Act 1998 DPA No. Z8322782 Novosco is registered with www.sid4health.nhs.uk Novosco is registered with Investors in People Technical Accreditations TOGAF Enterprise Architecture Framework PRINCE2 Project Management Commercial in Confidence 8

ITIL Service Management VMware Enterprise Solution Provider Partner Cisco Premier Certified Partner Citrix Platinum Solution Advisor Partner EMC Velocity Signature Partner Fortinet Gold Partner Microsoft Gold Certified Partner Riverbed Certified Partner 2.6 Information Assurance Novosco operates an Information Security Management System which complies with the requirements of ISO/IEC 27001:2005. The Novosco CloudStream BaaS is suitable for IL0 and IL1/2 data. 2.7 Details of the Level of Backup/Restore and Disaster Recovery That Will Be Provided The level of backup and restore will be dependent on the service architecture selected. All architectures will feature the following backup/restore capabilities (where we support it) with minimum 60 calendar day retention: File system; System state; Microsoft Exchange (at the mailbox database level); and Microsoft SQL databases. Architectures which feature a local backup component will feature the following backup/restore capabilities (where we support it): Microsoft Exchange message level; VMware vsphere virtual machine level; and Microsoft Hyper-V virtual machine level. Commercial in Confidence 9

We have a comprehensive BCP covering typical disaster scenarios that could potentially affect the service. 2.8 On-Boarding and Off-Boarding Process/Scope Novosco operate a standard on boarding procedure. The process begins upon the receipt of a valid customer order. Assuming the order is a standard configuration we will proceed as follows: Arrange assessment of proposed backup clients to determine data change rates (where applicable); Configure all hosted elements of the service; Customer bandwidth/latency assessment; Arrange for onsite elements deployment and configuration; Arrange for data seeding (to save bandwidth on first backup); Present a statement of configuration for initial deployment; and Configure daily reporting, enter on-going monitoring phase. Off-boarding: We remove customer access from ACLs; [Optional] Provide restore onto media of nominated backups (where possible); Clients (and all the associated backups) are deleted from the system along with all security constructs that would be used to log into the former security domain; Provide agent removal instructions; and Arrange for recovery of any onsite assets provided as part of the service. 2.9 Service Management Details Novosco use an ITIL aligned Service Management methodology to deliver the CloudStream BaaS to clients. The BaaS solution is monitored and managed proactively to identify and resolve incidents minimising any impact on client services. Clients can log service requests or incidents via the Novosco Service Desk 08:00-18:00 Mon-Fri excluding public holidays. Support outside these times is by exception only and subject to prior arrangement. The Service Desk can be contacted by phone, email, or web. Commercial in Confidence 10

Novosco will produce standardised monthly reports that detail client activity and consumption of the BaaS service. 2.10 Service Constraints During normal operation the backup system will be operating within one of three windows: 1. The backup window - The portion of each day reserved for performing normal scheduled backups. 2. The blackout window - The portion of each day reserved for performing server maintenance activities, such as checkpoints and garbage collection, which require unrestricted access to the system. 3. The maintenance window - The portion of each day reserved for performing routine system maintenance activities such as checkpoint validation. The level of customisation is typically restricted to when backup jobs can start (within the prescribed backup window). Novosco may take the service offline for planned or emergency maintenance. In either case notification will be sent to nominated individuals in accordance with the SLA. 2.11 Service Levels 08:00 18:00 Monday-Friday for normal client operational support (for example to deploy new protected clients, changes to schedules etc.). Exceptional support can be attained through a 24/7 support route limited to the support of our infrastructure services. We can assist beyond the scope of our infrastructure on a time and materials basis. 2.12 Financial recompense model for not meeting service levels Service credits are not applied to this service. Commercial in Confidence 11

2.13 Training Documentation will be provided on how to manage backup and restore jobs. 2.14 Ordering and invoicing process The customer should liaise with their sales contact or Account Manager within Novosco to agree the amount of resource required to complete their project. Once this has been agreed the customer should send a signed order form (in the general form of Schedule 2 of the Framework Agreement) as the method of placing Orders under the G-Cloud Catalogue. Orders can be placed by sending the completed signed Order Form to Novosco at: G-Cloud@novosco.com 2.15 Termination terms The Client may cancel the service by giving not less than four (4) weeks written notice. 2.16 Data Restoration / Service Migration Data can be restored to any registered client within your security domain where the backup agent/plugin permits the restore request. For example: File data backed up on client-01.yourdomain.local could be restored via the file system plugin to client-02.yourdomain.local, provided you have permission to see both clients in the backup system. Exchange databases backed up on mail-01.yourdomain.local via the Exchange VSS plugin could not be restored via another incompatible plugin (e.g. File System plugin/sql plugin etc.). Commercial in Confidence 12

2.17 Consumer Responsibilities Any data supplied by customer is an accurate representation of the infrastructure the customer requires to be backed up. Any on premise equipment we supply will have sufficient cooling and protected via an uninterruptable power supply (UPS). No significant new applications with specific data requirements will be installed without notice. Examples of applications that potentially are data hungry could be: o CCTV recording; o Call centre phone logging; o Document Management; o Image scanning; and o Multimedia storage. 2.18 Technical Requirements Prospective backup clients must meet the minimum system requirements: Gigabit network available in Customer Site for seeding of backups; Internet connectivity via static WAN IP addresses; Firewall rules to allow remote management of backup agents/on site nodes; Sufficient space required for system state backups 2GB Minimum per machine; and Sufficient bandwidth to meet change rate requirement is available from the customer s premises. 2.19 Details of any trial service available. We can organise a 1 month limited trial please contact us for details. 2.20 Data Extraction/Removal 2.20.1 Data Standards Due to the nature of the system the data is stored in vendor proprietary format it can only be extracted via the provided restore facilities. Commercial in Confidence 13

2.20.2 Commitment to returning all consumer generated data We can restore any data onto registered clients with compatible plugins. If you require a bulk restore onto disk and shipped to you we can arrange this (subject to plugin capability). 2.20.3 Formats / standards into which data will be extracted Data is restored in the same format it was backed up unless we have the capability of restoring into another format (subject to plugin capability). 2.20.4 Price for extraction of consumer generated data Professional services will be required to extract and return consumer generated data. Such services will be quantified based on the volume and nature of the consumer generated data. Professional services will be based on SFIA rate card. 2.20.5 Confirmation that the Supplier will destroy Consumer generated data. Novosco will erase all consumer data at the end of the contract period. 2.21 Data Storage and Processing Locations A UK Tier 3 data centre. 2.22 Deployment Models CloudStream Backup is available in Public/Private & hybrid architectures. 2.23 Service Models CloudStream BaaS is delivered as an IaaS service model. 2.24 Burst v. Elastic Resources The backup service offers the ability to burst beyond the paid for quota at any time. The quota is measured as a monthly average of the sum of source space used on all backup client disk drives. A Commercial in Confidence 14

backup is defined to exceed the usage limit if it exceeds the agreed figure for two consecutive months in a quarter or any three months in a six month period. The quota should be sized to allow for some growth within the contract period; the quota can be changed between billing periods. 2.25 Guaranteed and Non-Guaranteed Resources We guarantee the paid for quota only. Any capacity used in excess of the paid for quota is not guaranteed. 2.26 Persistence of Storage In the context of client backups we retire clients which you no longer want backed up. The backups remain until they age beyond the retention policy after which they are automatically deleted. We can retain a retired clients backups if required please review the applicable service charges. 2.27 Service Provisioning Novosco has a standard process for the provisioning of the CloudStream BaaS. We will supply the required material to allow a customer to order/provision/adjust services as required. 2.28 Utilisation Monitoring/Reporting We monitor utilisation monthly and report this utilisation to the customer. 2.29 Data Centre(s) Tier 3 self assessed. Commercial in Confidence 15

2.30 Network Novosco understands the high expectations of service provider network environments. We provide a 100% network availability guarantee. We define this 100% network availability as the ability for network packets to traverse from our Internet edge routers to the backup service infrastructure switch ports via all intermediate equipment (routers, firewalls, switches and cabling). Our network infrastructure is monitored 24/7. For the purpose of clarity downtime is defined to begin whenever an issue is detected by our monitoring systems or you log a call directly relevant to such an issue. Please refer to our extended SLA document on exact response times and call logging procedures. 2.31 Use By Other Suppliers The service is available for use by other suppliers. Suppliers should liaise with their sales contact or Account Manager within Novosco to agree the amount of resource required to complete their project. Orders can be placed by sending the completed signed Order Form to Novosco at: G-Cloud@novosco.com 2.32 Standard Configurations Type Value Units Notes Source data backup 1 TB The backup quota is the paid for multiple of 1TB units. 2.33 Service Roadmaps The underlying backup technology that the services utilise is EMC Avamar. We align our support position with that of EMC: Using Microsoft platform support as an example; EMC generally supports the Microsoft platforms that Microsoft themselves will support. Commercial in Confidence 16

o For example there is no support for Windows/SQL/Exchange 2000 or earlier. o Support may only be with a minimum service pack level. For example Exchange 2003 backup is supported on SP2 only. Likewise new features (of the backup software component of the service) are dependent on a number of factors: EMCs software development cycle. We typical see EMC make available updated software for new Microsoft platforms 6 months after RTM. New features are often dependant on specific environment requirements being met and what we consider to be supportable. If we intend to remove or deprecate functionality we will notify the customer in a timely manner. 2.34 PaaS Types N/A for Lot 1 Infrastructure as a Service. Commercial in Confidence 17

3 Pricing Configuration Type Price per TB per Month Standard Onsite Backup Node Up to 6TB of source data backup capacity 2,000 Includes replication to hosted node. Includes network traffic entering/leaving the CloudStream network. The minimum order value is 3TB and assumes a 2 year contract. Alternative capacities and configurations including RAIN grids are subject to bespoke pricing. In addition to the consumption based pricing above for the CloudStream BaaS, additional professional services may be purchased on an ad hoc basis. Such services may be required during the on-boarding and off-boarding process and will be quantified based on the client environment. High Level SFIA Job Family SFIA Job Family Relevant SFIA Levels Strategy and Architecture Solution Architecture 5-6 Solution Development and Implementation Systems Integration 2-6 Please contact us to discuss your requirements at G-Cloud@novosco.com For the associated day rates for these and other roles, please see the Novosco SFIA Rate Card. Please also see our Service Terms for the commercial information in support of this service. Commercial in Confidence 18

4 About Novosco Novosco is a leading provider of Cloud technologies, Managed Service and Consulting. We specialise in helping organisations utilise the unique aspects of emerging technologies to solve business challenges in new and dynamic ways. We operate under managed service or strategic partnership contracts with our major clients. Novosco has established partnerships with the very best hardware and software vendors in our areas of specialisation and we are committed to assisting our customers in the evaluation of all potential solutions, including the optimisation of current IT systems. Our main technical partners include: This approach combined with our proven engagement methodology enables us to develop and deliver cost-effective solutions that are an asset to your business. We offer a unique consulting talent and technical support expertise to companies wanting to realise the benefits of their IT investment. This is verified by our customers:- Novosco engineers are on site on a daily basis as a professional ICT resource. Belfast Trust IT professionals and Novosco staff work together as a team to deliver systems that enhance patient care - Paul Duffy, Co-Director for ICT & Telecommunications, BHSCT Novosco has a firm grasp of our business processes and drivers combined with in-depth knowledge of current and future technologies, with the ability to advise us on the best operational and strategic paths for our IT infrastructure. This, combined with an honest and open approach makes Novosco a core part of our team. Jim Cunningham, Assistant Director of Information System, Queens University Commercial in Confidence 19

History We have been successfully trading since 1994. We recently enjoyed our twelfth successive year in the Deloitte FAST50, an award which recognizes successful revenue growth for technology companies. We were also awarded Cisco Datacenter Partner of the Year and EMC Partner of the Year in 2012. Both awards were based on the volume and calibre of work delivered. For more information visit www.novosco.com Commercial in Confidence 20