MANAGED CLOUD INFRASTRUCTURE www.easynet.com. Bronze Disaster Recovery Services

MANAGED CLOUD INFRASTRUCTURE www.easynet.com Bronze Disaster Recovery Services G-Cloud Service Definition September 2013

Company Information Easynet Global Services Limited registered office Chancellor House, 5 Thomas More Square, London E1W 1YW Registered in England and Wales No: 08458875 VAT No: GB 997 3084 67 Terms and Conditions This Service Definition is subject to the provisions (including without limitation the SLA restrictions) of the Supplier Terms at Schedule 1 to the G-Cloud Services 4 Framework Agreement. Unless otherwise specified, capitalised terms used in this Service Definition shall have the meanings defined in the Supplier Terms. Easynet Global Services Limited 2013 UNRESTRICTED Page 2 of 18

Table of Contents 1 2 3 4 5 6 7 8 Service Definition... 5 1.1 Introduction... 5 1.2 Secure Data Centres... 7 1.3 Bronze Disaster Recovery... 7 1.4 Invocation of Bronze Disaster Recovery... 8 1.5 Data Encryption... 8 1.6 Supported Operating Systems... 8 1.7 Backups Options... 8 1.8 Guaranteed Resource... 9 1.9 Elastic and Burstable Resources... 9 1.10 Persistence and non-persistence of storage... 9 Impact Levels... 10 On-boarding... 10 Off-boarding... 11 Pricing... 11 Service Management... 11 6.1 Support Boundaries/Interfaces... 11 Service Desk Overview... 12 7.1 Incident Management... 12 7.2 Problem Management... 13 7.3 Change Management... 14 Service Constraints... 14 8.1 Platform Maintenance... 14 UNRESTRICTED Page 3 of 18

9 10 11 12 13 14 15 Service Level Agreements... 15 9.1 Service Availability... 15 9.2 Service Credits... 15 9.3 Incident Handling and Reaction Times... 15 Ordering and Invoicing Process... 16 Termination Terms... 16 Consumer Responsibilities... 17 Technical Requirements... 17 13.1 Solutions Architecture Workshop... 17 13.2 Solution Design... 17 13.3 Technical Build Document... 18 Training... 18 Trial... 18 UNRESTRICTED Page 4 of 18

1 1.1 Service Definition Introduction In today s highly competitive landscape, the impact of a major unforeseen incident such as theft, acts of terrorism, vandalism and natural disasters can be often be terminal. According to studies conducted by leading industry analysts, for those businesses that suffer a total loss of a facility that supports mission critical data, 51% close within two years, 43% will never re-open and only 6% survive in the long term. Therefore, implementing a Business Continuity Plan to mitigate against this risk is often a compliance requirement and at the very least a necessity for the majority of mid-large enterprises. However, implementing disaster recovery capabilities to support a Business Continuity Plan is often a complex, time-consuming and expensive process that can struggle to meet its objectives and is often not tested or adequately proven. EGS can assist organisations with an implementing effective Business Continuity Plan for critical IT systems by providing a range of Disaster Recovery solutions including replication of virtual machines and application data over the EGS Global IP backbone to another storage array in a secondary data centre. This capability provides business continuity across your IT infrastructure and application estate as it enables services to be available at a secondary EGS data centre in the event of unforeseen disaster at the primary site. Our approach is to support an organisation through the steps of defining their a Business Continuity Plan by defining a Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for the Disaster Recovery solution; describing how quickly service can be recovered and how much acceptable data loss can occur. In addition, an EGS consultant will, in conjunction with the customer, define an incident response plan which will define the exact process that is followed in the event of a disaster, including a list of applications and priorities to determine the order in define the customer recovery run book they are recovered. To ensure that the provisioned Disaster Recovery solution is sufficient and continues to protect an organisation, EGS will request regular Disaster Recovery tests throughout the duration of the service lifecycle, including the creation of the Disaster Recovery customer recovery run book. Our approach is to assess that in the event of a disaster, servers, storage and all processes will failover successfully as expected in accordance with the customer specified RTO and RPO. EGS s Bronze Disaster Recovery offering addresses these business issues by delivering a centralised disk-based enterprise class backup and Physical and Virtual server recovery service to protect an organisation s mission critical assets, including files, servers and complex databases. We will take care of the responsibility of 24/7 management for the backup system including backup schedules and deliver a pro-active response to any service failures. As part of the Bronze Disaster Recovery service, EGS will de-duplicate, compress and encrypt data before it is sent to a secure EGS UK primary data centre. All customer backup data is stored on a resilient and secure disk based storage appliance for data protection. The customer has the option to replicate data to a secondary data centre for enhanced protection to meet data compliance or UNRESTRICTED Page 5 of 18

specific disaster recovery requirements. For data retrieval, the customer can perform self-service restores using EGS s backup portal and select the appropriate files or contact our service desk if any additional assistance is required. Further, in the case of a catastrophic event at your primary infrastructure site, your mission critical applications can be restored onto our Enterprise Cloud platform through raising an invocation request with our service desk Our Disaster recovery services provides our customers with the piece of mind that their critical data and applications are in safe hands and can be recovered as and when needed. This service also allows internal IT resources to be freed up within an organisation to focus on more pressing business challenges or strategic initiatives. Features: De-duplication of data at source and target ISO27001 and ISO9001 accredited Secure Tier III level data centres based in the UK Online backup options leveraging ESY secure MPLS link for data replication Customer self-service portal option available to run restores and view reporting 24x7x365 UK-based service desk Proactive monitoring system Predictable per GB cost; you only pay for the volume of data you protect and the number of VM s to be recovered Physical and Virtual Server backup and restores Physical and Virtual Server Disaster Recovery Bare Metal Restore function available Application aware backups that can backup data at the database level or more granular brick level (Exchange, MS SQL, Sharepoint etc) Data encryption to keep confidential data secure at all times Benefits: Keeps your data safe from data loss and accidental deletion. Lowers total cost of ownership Reduced bandwidth costs for performing backups Replaces legacy backup tapes with agile and scalable disk-based technology Customers can easily scale up to meet unanticipated date growth Can accommodate data recovery for common enterprise workloads Frees up time spent on managing infrastructure for more business focused tasks. Meets legislative and compliance requirements Support the achievement of business defined RTO/RPO objectives Optional replication of data to a secondary resilient environment UNRESTRICTED Page 6 of 18

Easynet Customer Site Customer Machines are backed using the Easynet Backup Service Internet Server backups are recovered to Easynet Enterprise Cloud 1.2 Secure Data Centres The customer s data is securely stored in our Tier III level data centres (self-assessed). These are all based in the UK. All our facilities are built to the highest standards and engineered to include multiple levels of redundancy with a minimum resiliency of N+1 on all sites. The equipment used in the Disaster Recovery service is built using industry leading infrastructure and software with a minimum redundancy of N+1 on all service components. Our internal processes and procedures within data centre operations are ITIL aligned, tried-and-tested and regularly audited. 1.3 Bronze Disaster Recovery The Bronze option for Disaster Recovery provides Customers with a backup of their infrastructure to a Secure Data Centre, with access to our Enterprise Cloud platform for the restoration of business critical application infrastructure. This requires the Customer to subscribe to our Managed Backup and Recovery service for all of the servers, Applications or Data that need recovering during a catastrophic event. On invocation of the Disaster Recovery service, dependant on the option selected for backup, we will then recover the backup data, application or VMDK to our Enterprise Cloud Infrastructure providing access to the service either over the Internet or via your private network service. UNRESTRICTED Page 7 of 18

1.4 Invocation of Bronze Disaster Recovery The customer-approved contact will raise a ticket by Telephone to the EGS service desk. This will start the process of Disaster Recovery of the customer s targeted services in to the EGS Enterprise Cloud service as defined in the customer-provided recovery run book. Customer will invoke the service via an Incident ticket: 1. A request for the servers to be built is sent to the hosting team 2. The hosting team build the customer servers using standard EGS VM images. 3. The hosting team restore the customer backups to the Virtual Server 4. The hosting team and the customer test the recovery of the service items and connectivity to the service. Please note the following for this version of the EGS DR Service options: a. Data restored is as old as the last incremental backup (as Scheduled) b. The service will allow initiation of a restore of Servers within approximately 4hrs or more (dependant on the number of servers) 1.5 Data Encryption All customer replicated data can be encrypted at source using the backup service for transmission to the backup storage service. Once at its target location the data is then stored in a proprietary encryption format for the duration of the service. 1.6 Supported Operating Systems Operating Systems: MS OS, RedHat, CentOS - all versions as per supported version from vendor. Hyper Visor: ESXi 5.x - all versions as per supported version from vendor 1.7 Backups Options EGS can perform File / Object based backups. If you are backing up an application or database using this methodology then you are required to produce a flat file or dump to be backed up. This can be completed using standard tools available natively with most applications and databases. EGS can perform open file backups for a wide range of enterprise applications without disrupting business operations. Our flexible backup service can restore at a database system level right down to a granular brick level. For example, a backup can be taken of Microsoft Exchange from the database level right down to the individual mailboxes. Similarly, a backup can be taken of Microsoft SharePoint at the entire database level or right down to the list of documents. Supported applications include: IBM DB2 IBM Lotus Domino UNRESTRICTED Page 8 of 18

Microsoft Exchange Microsoft SharePoint Microsoft SQL Server Oracle Oracle RAC EGS can perform VMDK backups of the customers VMware Virtual Server Instances using the EGS Backup Service. This enables the quickest recovery time of their services. The customer must be running a minimum of VMware ESXi 5.0. 1.8 Guaranteed Resource The EGS Backup service uses a non-guaranteed resource model, in that EGS only guarantees the resources that have been purchased by the customer. Any capacity in excess of the paid for quotas is not guaranteed. The Storage resources on the EGS Enterprise Cloud platform are reserved for use on the invocation of Disaster Recovery. This specifically covers Storage of data on a per Giga Byte (GB) basis. The compute resources on the EGS Enterprise Cloud Platform are reserved for use on the invocation of Disaster Recovery. This specifically covers Memory (RAM) per Giga Byte (GB) and CPU (vcpu). 1.9 Elastic and Burstable Resources The Disaster Recovery service uses an elastic resource model which allows customers to request: a. Additional backup capacity (GB), The Enterprise Cloud service uses an elastic resource model which allows customers to request: a. Storage capacity (GB) up to 1.9 TB per virtual disk, b. Additional RAM up to a maximum of 48 (GB) per server, c. Additional CPU up to a maximum of 4 (vcpu) For larger enterprise deployments, EGS will conduct capacity planning to ensure service implementation is seamless, capacity is available for the customer as and when it is needed. Furthermore, for customers that take Private Cloud Services to support Disaster Recovery then capacity planning will occur during service specification to ensure the environment is specified to support anticipated growth. 1.10 Persistence and non-persistence of storage All backup storage associated with a virtual machine is persisted and will remain available after a virtual machine compute instance is removed, subject to continued payment of fees associated with the storage. Backups will continue to run on invocation of Disaster Recovery. UNRESTRICTED Page 9 of 18

All Enterprise Cloud storage utilised in the provision of the DR Service is non-persistent and will be permanently removed from the primary storage, once the customer closes the Disaster Recovery incident and fails back to their primary operating site. 2 Impact Levels EGS currently holds ISO 27001 accreditation for Information Security Management System (ISMS) and holds ISO9001 accreditation for our UK based Data Centre s. EGS is currently working towards full accreditation up to Impact Level (IL) 2. Should the appropriate opportunity present itself, EGS can be accredited to the IL2 in a very short space of time. 3 On-boarding EGS will work closely with the Customer to define the Disaster Recovery service requirements which includes factors such as: Virtual Server Sizing Primary Storage data volume Backup Storage data volume Capacity planning Directories to be backed up Retention Policy File / Backups Application backups VMDK backups Security and encryption levels Target Recovery Point Objective (RPO) Target Recovery Time Objective (RTO) Recovery run book Network connectivity (private network, Internet) This information will be captured by EGS within a Technical Build Document which will be accessible to both EGS and the Customer throughout the duration of the contract. EGS will install and configure the backup and Disaster Recovery service as defined in the Technical Build Document. To ensure best practise and Customer data security, EGS will perform a test backup prior to the service going live, and will then recover this backup in to the Enterprise Cloud Platform, the customer will be required to test consistency of the restored service item. UNRESTRICTED Page 10 of 18

4 Off-boarding EGS s off-boarding process can be executed in two ways: Closing the service and destroying the data Closing the service, migrating the data in accordance with the customer s requirements and then destroying the data. The migration is available via EGS Professional Services. Prior to the customer reaching the end of the subscription period, EGS will enable the customer to transfer data out of the solution. Following the successful migration of data directly back to the customer or another service provider, EGS will ensure that all data is deleted securely in accordance with our ISO27001 accreditation. 5 Pricing Unit Monthly Price Backup GB 1GB 0.45 Storage Tier 1 1GB 0.35 Storage Tier 2 1GB 0.20 Memory 1GB 17.93 Initiate Recovery per Server Server 100.00 A DR test can be performed for 100 per server. 6 Service Management An ITIL-qualified Service Manager will be designated as the single point of contact for all in-life service issues and will ensure optimal systems and service availability via regular and detailed discussion with the client on both current performance and anticipated future requirements/changes The EGS UK based Customer Service Centre provides a fully resilient 24x7x365 entry point into the organisation for all service issues including incident management. 6.1 Support Boundaries/Interfaces The Primary points of contact for the solution proposed are as follows: UNRESTRICTED Page 11 of 18

7 Service Desk Overview EGS s UK-based Customer Service Centre (Service Desk) is the primary point of contact for all service requests and incidents for customers. The Service Desk is available 24x7x365 and adheres to ITIL best practise processes including incident management, change management, problem management and continual service improvement. 7.1 Incident Management The purpose of EGS s incident management process is to restore a service to its normal state as quickly as possible. Our process consists of the following steps: Validation Prioritisation Ownership Diagnosis Resolution EGS ensures incident management 24x7x365 according to a clear process. The first level is taken care of by the Service Desk. Its role is to identify, classify and record the incidents. It also provides the initial support. Service Desk is comprised of 24x7x365 on-site technicians. UNRESTRICTED Page 12 of 18

Detection of the incident is the first step of its lifecycle. It can have two sources: 1. Internal - Monitoring: The monitoring system provides 24x7x365 monitoring of key indicators of the global and customer infrastructure. Alerts are uploaded to centralised management consoles accessible to the Service Assurance team taking care of the Supervision. 2. External - Customer: Service Desk provides 24x7x365 phone and email assistance to customers who can report an incident. Customers can also use a ticketing system through a Web interface to open an incident ticket. When an event is generated from an alarm on EGS s monitoring system, the event is validated by our Service Assurance team to ensure the issue is not a false alarm and a ticket is opened and prioritised if the event is confirmed as an incident. Once an incident is created the Service Assurance agent will work with the customer to understand the impact of the issue and allocate a priority to the incident. Please refer to Section 9 to view the EGS priority matrix for incident management. The Service Desk will carry out initial troubleshooting steps, combined with their own solution knowledge to identify the source of the failure and resolve the incident. This process includes the Service Assurance agent checking if a known problem record with a resolution exists within our knowledge database. If a Service Desk agent is unable to resolve the issue, the incident will be escalated through a defined escalation process to a specialist engineering department. In the event of a hosting issue requiring further investigation and specialist attention, the Service Desk will escalate the incident to the Hosting Operations team. Our approach of combining the use of known fixes and issues and assignment of incidents to a specialist team if it requires more in-depth investigation, enables EGS to identify resolutions quickly and minimise any delays if an escalation is required. 7.2 Problem Management The objective of EGS s Problem Management process is to identify root causes of incidents and develop long term fixes so that they do not re-occur. EGS has a dedicated Problem Management team that delivers pro-active diagnosis of problems and the causes behind the incidents in order to implement resolutions. Our Problem Management team also maintains information on known problems records and associated workarounds and fixes. This information is regularly accessed by our Service Assurance and Specialist Engineering teams (including Hosting Operations Team) in order to deliver a quick fault resolution to the customer. The assigned Customer Service Manager (CSM) will also produce monthly service review reports, which will include incident analysis and trends. This information can also be used by the CSM to identify re-occurring incidents for the customer, which in turn is assigned to our Problem Management team to investigate further. In addition, Major Service Outage reports will include root UNRESTRICTED Page 13 of 18

cause analysis and remedial actions to minimise the possibility of the incident re-occurring again in the future. 7.3 Change Management All hosting change requests can be submitted to EGS using an online form available on the customer portal, eliminating the need to fill out time-consuming forms which need to be emailed to our Service Desk. The customer will have the option to select a change from a variety of service options including physical server, virtual machines, load balancers and firewalls etc. Once the form has been submitted, the customer will receive an automatically generated change reference number and the change will be assigned directly to the hosting operations team for approval and implementation. If a change is related to an incident which is service affecting, it will be classified as an emergency change and assigned its own priority level. In this scenario, the customer will be instructed to call our Service Desk once the change has been submitted in order for our Service Assurance team progress the change as quickly as possible with the Hosting Operations team. If the change required is deemed to be high impact on a service or services to a customer or customers, EGS will hold an emergency Change Advisory Board and go through the planned process at an accelerated timescale. Once completed, the change is tested with the customer. If agreed as successful we document the change and close it. If there are any problems post the changes being made, the rollback process is carried out. Confirmation is requested from the customer that the platform / service has returned to stability and the failed change is then reviewed. If changes fail during implementation they are reviewed with the customer and EGS for resolution. Once a resolution has been identified during Problem Management, all process and system are managed via our Change Management process. The relevant resolution and change documentation is generated and distributed to the relevant teams for training on the fix that is put in place. 8 8.1 Service Constraints Platform Maintenance Enterprise Cloud platform maintenance is typically completed between the hours of 00:00 and 06:00, except in cases where emergency Maintenance is required. All Enterprise Cloud platform updates, if deemed necessary will be installed during the maintenance window. The customer will be notified by a change request at least 15 days prior to this taking place, except in cases where emergency maintenance is required. UNRESTRICTED Page 14 of 18

9 Service Level Agreements The Disaster Recovery Service SLA is based as standard on the availability of the service technical components. Further SLAs that are based on Return to Operation for specific servers can be defined on a customer-by-customer basis by negotiation with EGS. Please read below in conjunction with the EGS supplier terms. 9.1 Service Availability EGS guarantees the Availability of the service as set out below. Service Option Disaster Recovery Platform MSD Target Level 1 Hour (99.99% Availability) Service Option Time to initiate Recovery Service Level Agreement 4 Hours 9.2 Service Credits In each instance where the annual Availability exceeds the MSD target set out above the Customer will be eligible to a Service Credit equivalent to 20% of the MRC for the affected Service component ( an MSD Credit ). More than one MRC Credit may be issued in respect of the same outage and/or in the same Reporting Month subject to a cap of 100% of the MRC of affected Service Component per Reporting Month. For calculating the Customer s entitlement to an MSD Credit previously claimed MSD Credits during the applicable rolling 12 month period are ignored. Service Credits apply only to the MRC for the affected Service component. 9.3 Incident Handling and Reaction Times Incident handling times are prioritised with the following structure: Priority Classification Priority 1 (P1) & Priority 2 (P2) Description Business critical Customer impact Complete platform outage(s) Loss of mission critical elements of the Service Significant impact for a large number of end-customers or users Security attack or compromise of the Service UNRESTRICTED Page 15 of 18

Priority 3 (P3) Priority 4 (P4) Priority 5 (P5) Major degradation with noticeable Service impact P2 priority incidents with implemented workaround to restore Service Major degradation of any element or function of the production platform or Services with end-customer or end-user impact Failure of a redundant component of the platform resulting in the platform no longer having any redundancy in that component. This does not apply if 1 out of 3 components fail. Intermittent unavailability of platform or Services Complete unavailability of single systems with limited business impact for the Customer Medium degradation limited Service impact Limited degradation of the Service A fault not having any impact on the Service Very limited or negligible Service impact Incident having very limited impact on the Service Information requests Incident only impacting a very limited number of users The following table shows the target SLA for Reaction Time. Priority Classification Priority 1 & Priority 2 Target Reaction Time Reaction Time Expectation Update Frequency 30 Minutes 15 Minutes Every Hour Priority 3 60 Minutes 30 Minutes Every 2 Hours Priority 4 8 Hours 4 Hours As Agreed Priority 5 8 Hours 4 Hours As Agreed 10 Ordering and Invoicing Process Upon receipt of a completed Order form, EGS will deploy the required service. Invoicing will commence once the work for the Enterprise Cloud service has been completed in line with customer order requirements. Payment is required within 30 days of invoicing. Payment shall be made by BACS in accordance with the Supplier Terms. 11 Termination Terms The provisions relating to termination by the Customer or Supplier are set out in clause 14 of the Supplier Terms. UNRESTRICTED Page 16 of 18

12 Consumer Responsibilities The Customer responsibilities for the EGS Backup & Disaster Recovery service are as follows: The Customer will work with EGS to identify the files, directories, applications and VMDK s that are required to be backed up. If the Customer tampers with the backup service or configuration then EGS shall not be responsible of the backup fails. The Customer may be required to take action when backups fail due to Customer applications or due to Customer managed third-party applications. If the Customer does not assist to take such action then EGS may be unable to restore the customer data related to that failed backup. EGS understands there will always be unforeseen growth in the amount of data to be stored and the rate of change may vary over time. It is incumbent upon the Customer to inform EGS as soon as they become aware that an increase in the amount of storage resource will be required. The Customer is required to purchase additional storage when the existing storage volume becomes exhausted, this should be planned for in advance to ensure there is no impact on the on-going service. In the event that the service is impacted due to a lack of available storage the service level does not apply. 13 Technical Requirements 13.1 Solutions Architecture Workshop A Solution Architecture Workshop can be scheduled for enhanced Enterprise projects for EGS to understand the customer s business and technical requirements at an extremely detailed level. This will allow the Global Solutions Architect to complete the Solution Design component of the service. For these types of projects, EGS recommend at least one dedicated Global Solutions Architecture workshop in addition to the Project Initiation Workshop. This will be led by the Easynet Global Solutions Architect, supported by the Project Manager with the customer Technical Design Authority and Project Contact as required attendees. 13.2 Solution Design EGS are committed to providing solutions which meet customer s technical requirements and business expectations Following the Global Solutions Architecture Workshop, the Easynet Global Solutions Architect will produce a detailed, low level technical design for the Enhanced and Enterprise solution to be UNRESTRICTED Page 17 of 18

deployed. This will take into account requirements, constraints and business drivers expressed at the workshop. This will be documented in the Technical Build Document (TBD) document. 13.3 Technical Build Document Purpose: The purpose of the Technical Build Document (TBD) is to define and agree the Security, Network and System elements of the solution enabling EGS to ensure that the Solution delivered meets with the customer s technical requirements and expectations. This document forms part of the project documentation set required for the delivery of complex hosting solutions for customers and sign-off is required before build tasks can commence. 14 Training Training is provided for the product to ensure that the relevant customer staff is fully capable of using all portals and systems provided by EGS for interaction with the service. This is provided as and when required by the EGS Service Management function and is included as part of the price of the service. 15 Trial A trial of the DR Service may be available dependant on the customer s requirements and success criteria. A full assessment will need to be made to confirm the viability of providing the trail. UNRESTRICTED Page 18 of 18