G-Cloud 6 Service Definition DCG Cloud Disaster Recovery Service

G-Cloud 6 Service Definition DCG Cloud Disaster Recovery Service 1 of 19

CONTACT INFORMATION Guy Silver T: 07733 008799 E: guy.silver@dcggroup.com W: www.dcggroup.com Data Continuity Group Limited, Bridge House, Brant s Bridge, Bracknell, Berkshire, RG12 9BG LEGAL Data Continuity Group Limited is registered in England and Wales. Company Registration No: 4295324. Registered office: Bridge House, Brant s Bridge, Bracknell, Berkshire, RG12 9BG. 2 of 19

TABLE OF CONTENTS 1.0 Service summary... 4 1.1 Features and benefits... 5 2.0 Details of the service... 6 3.0 Service management... 9 4.0 Service implementation and off-boarding... 12 5.0 Service constraints... 14 6.0 Service levels... 15 7.0 Training... 16 8.0 Ordering and invoice process... 16 9.0 Termination... 16 10.0 Customer responsibilities... 17 11.0 Costs... 19 3 of 19

1.0 SERVICE SUMMARY DCG s Cloud Disaster Recovery service provides peace of mind for all types and size of organisation that in the event of a disaster, planned or unplanned event, they can retrieve their data within 1 hour of them invoking the service via a secure, unlimited VPN accessed cloud. The service replicates customers data to the DCG, UK-based cloud, meaning key systems are always available. To ensure data security and integrity the data is encrypted at rest and in transit. Furthermore, there is no capital expense required with this service. Coupled with DCG s twelve years experience and focus on data management, its ISO accreditations, its UKbased cloud, depth of skill and 24/7/365 service desk gives our customers the peace of mind that their data is safe and secure and can be retrieved quickly when required. Our teams of consultants take care of DR planning, testing and documentation and, in the event of a disaster or planned outage, will manage the entire process to minimise or eliminate disruption to your business. The service is tested before activation to ensure accurate and effective post-disaster execution and includes an annual test. Protected platforms include; Windows Server 2003, 2008 and 2012, Microsoft Exchange, SQL Server, File Server and Sharepoint, Blackberry server, Oracle and many others. 4 of 19

1.1 FEATURES AND BENEFITS Managed, rapid recovery of critical data and systems in the cloud after a disaster guaranteed by Service Level Agreements. Experienced team of DR specialists to plan, test, and execute disaster recovery process. secure, remote access to recovered systems via SSL VPN. 4-hour SLA option includes proactive failover enabling zero downtime for planned maintenance, upgrades, and site outages. Disaster Recovery planning, testing and documentation. 24/7/365 UK based disaster declaration hotline. Our Disaster Recovery experts will manage the entire recovery process. Rapid recovery in the cloud - guaranteed by SLA s. 1 hour, 4 hour and 24 hour options for recovery time. Systems recovered into a purpose-built Cloud specifically designed for data protection and disaster recovery. Remote access to your recovered systems - all you need is an internet connection. Access to systems in a Cloud workspace via secure SSL VPN connection. Remote sites connect via IPSec Tunnel. Use DCG s CDR until physical site is back in business. 5 of 19

2.0 DETAILS OF THE SERVICE DCG will manage all aspects of the service from working with you during the implementation stage, configuring your solution, agreeing the backup schedules and retention policies, monitoring the service, restoring data, scheduling new backups, ongoing maintenance and reporting. DCG will also provide proactive support and monitoring 24/7/365 and will provide notification of any issues that we are unable to resolve. What is DCG s Cloud Disaster Recovery Service? DCG s CDR is a managed remote disaster recovery service that ensures you can quickly recover your critical data and systems after a disaster and remotely access it in a secure virtual environment regardless of your location. We guarantee your recovery times, and back them with 4 or 24 hour Service Level Agreement (SLA) options. How does it work? DCG s CDR Managed Service backs up or replicates your systems to the ironclad DCG cloud. Then when there is a disaster, your critical systems are quickly recovered as virtual machines (VMs). What is the procedure for planning and testing your DR plan? One of DCG s CDR specialist works with you to: Document a systems recovery plan Provide a detailed configuration assessment Use guided DR simulation to confirm your recovery will execute as intended Where is your data stored? In our UK based level III data centre facilities. Is my data encrypted? Yes, end-to-end encryption ensures that data remains private, satisfying your organisation s specific regulatory compliance requirements. 6 of 19

How accessible is my data after a disaster? DCG provides you with remote access to your systems, as long as you have an Internet connection you can securely recover data and applications from wherever you happen to be. Who do I call in the event of a disaster? DCG Dedicated DR support line. They will also have a list of other numbers to call, including customer support and the Operations Manager. DCG offers 1, 4 and 24 Hour RTO Package 1 & 4 Hour RTO 24 Hour RTO Supported Platforms Microsoft Windows Server 2003, 2008, and 2012; supported with 4-Hour SLA option, Microsoft Exchange, SQL Server, File Server, and SharePoint; Blackberry Server; and others Microsoft Windows Server 2003, 2008, and 2012; IBM i, IBM AIX, Red Hat Linux, SUSE Linux, VMware, and other environments Comprehensive Package Hosted Active Directory VM, storage, secure network protocols, SSL VPN and IPSec tunnel (for secure cloud recovery) DCG System Restore (for Windows systems), VMs, storage, secure network protocols, SSL VPN (for secure cloud recovery Cloud Infrastructure Remote, top-tier data centres serving as a hot cloud an extension to your production environment for your key systems Remote top-tier data centres serving as a disaster recovery warm site DCG Cloud Backup Managed Service DR Tests Required Required One (1) scheduled complete DR test 7 of 19

What is DCG s Cloud Disaster Recovery Service? DCG s CDR is a managed remote disaster recovery service that ensures you can quickly recover your critical data and systems after a disaster and remotely access it in a secure virtual environment regardless of your location. We guarantee your recovery times, and back them with 4 or 24 hour Service Level Agreement (SLA) options. How does it work? DCG s CDR Managed Service backs up or replicates your systems to the ironclad DCG cloud. Then when there is a disaster, your critical systems are quickly recovered as virtual machines (VMs). What is the procedure for planning and testing your DR plan? One of DCG s CDR specialist works with you to: Document a systems recovery plan Provide a detailed configuration assessment Use guided DR simulation to confirm your recovery will execute as intended Where is your data stored? In our UK based level III data centre facilities. Is my data encrypted? Yes, end-to-end encryption ensures that data remains private, satisfying your organisation s specific regulatory compliance requirements. How accessible is my data after a disaster? DCG provides you with remote access to your systems, as long as you have an Internet connection you can securely recover data and applications from wherever you happen to be. Who do I call in the event of a disaster? DCG Dedicated DR support line. They will also have a list of other numbers to call, including customer support and the Operations Manager. 8 of 19

3.0 SERVICE MANAGEMENT DCG Managed Service DCG s Managed Service means the user s environment is managed, monitored, protected and recoverable 24 hours a day 365 days a year. Proactive management will resolve any issues affecting completion of the backup schedule in order that the contracted Service Levels are met and exceeded. The service includes all elements of customer service support including support calls, technical assistance, hardware and software faults and replacements on all elements of the solution. Service Reviews On a minimum of a monthly basis DCG will conduct service reviews which will assess the operational elements of the service with a drive towards continuous improvement. DCG provides 24x7x365 support in a three tier model. Its shift system and distribution of experience ensures users have access to relevant skills and knowledge at all times, day or night. 1 st Line Support is provided by the Service Operations Centre (SOC) Team Members, who are available at all times by both telephone and email. These personnel have a broad understanding of all DCG hardware, software and major product lines and are able to resolve most queries in a timely manner without a requirement for escalation. 2 nd Line Support is provided by our SOC Shift Leaders. These personnel have a deeper level of understanding of all services provided by DCG and have developed a greater level of customer specific knowledge through their enhanced training and experience. SOC Shift Leaders are available from 07:-00 to 17:-00 Monday to Friday and 09:-00 to 17:-00 on weekends, via both telephone and email. In addition, a Shift Leader is always on call during silent hours in order to ensure that escalation from 1st Line Support is never delayed where appropriate. 3 rd Line Support is provided by a named Escalation Manager, assigned to the user when the contract is agreed. This person will assume responsibility of any call which cannot be resolved by either 1 st or 2 nd Line Support and is also the first point of contact should the user have a complaint with any aspect of the service provided by DCG. This named contact has all relevant DCG resources at their disposal and is able to ensure a timely and satisfactory resolution to issues through the engagement of all company departments from 1 st Line to the Board members. The Escalation Manager is available from 09:-00 to 17:-00 Monday to Friday via telephone and email, and is also available for escalation from 2 nd Line and direct customer contact for urgent issues during silent hours. DCG provides a 24x7x365 Technical Support Service through its Service Operations Centre (SOC). DCG s engineers continually monitor the services provided by DCG through a number of specialised alerting systems and by conducting regular health checks on all key components. Incidents will be raised in the event of any failure and immediately enter the Technical and Management escalation chains where they will be progressed according to the priority assigned. 9 of 19

Please see below the Incident Definition matrix to understand how DCG will prioritise them. Incident Definitions Priority Business Impact Description Scenario 1 Critical A major outage affecting multiple systems or users that will have maximum impact Full site outage. Master / Vault server unreachable. DR invocation. 2 Major A major system component failure that has or has the potential to cause a high impact Media / Satellite server unreachable. Network connectivity. Tape Library unavailable. 3 Degraded System is degraded, but operational although impaired Critical application backup failure:- Exchange, SQL, Oracle, SharePoint, Enterprise Vault. 4 Standard A single user call File System Backup Failure. Standard requests. Immediate Action When an incident occurs, whether raised through active monitoring or by the user, DCG staff will raise a call on the DCG Incident Management System (HEAT), obtaining all relevant information and assigning the appropriate priority level as detailed above. HEAT automatically generates a unique reference number, which will be provided to the user. 10 of 19

Technical Escalation Once an incident is logged in HEAT, it will enter the Technical Escalation process. This process ensures that an engineer with the relevant level of expertise is assigned to resolving the incident and is escalated in a timely manner to more specialist teams where required, according to the matrix below. Support Provided By Priority 1 Priority 2 Priority 3 Priority 4 Level 1 SOC Engineer Immediate Immediate Immediate Immediate Level 2 SOC Shift Leader Immediate 12 Hours 48 Hours 72 Hours Level 3 Professional Services / Vendor (as appropriate) 4 Hours As required As required As required From the matrix above, it can be seen that a Priority 3 incident will be managed by Level 1 technical support immediately and escalated to Level 2 support within 48 hours if no resolution is found. Level 2 support will, in conjunction with management, further escalate the incident to our Professional Services Team or the product/service vendor if no timely resolution can be found. By contrast, a Priority 1 incident will be immediately managed by a Level 2 engineer, and further escalated after no more than 4 hours. Management Escalation DCG s Management Escalation Process is designed to ensure maximum management awareness and promote rapid incident resolution. Whilst the user s incident is managed at a technical level according to the previous matrix, it is also advanced through the management team who will drive resolution through regular communication with the technical team. Management involvement also ensures regular and accurate communication with the customer at all stages of incident resolution. 11 of 19

Management Escalation Matrix Management Level Priority 1 Priority 2 Priority 3 Priority 4 Named Escalation Manager Immediate 2 Hours 12 Hours 24 Hours Operations Manager Immediate 4 Hours 24 Hours 72 Hours Operations Director Immediate 8 Hours As required As required The user s named Escalation Manager, assigned at the time the contract is agreed, is the initial point of Management Escalation and is involved in every incident after no more than 24 hours. In order to ensure the swiftest possible turnaround of all high impact incidents the DCG Operations Director is involved immediately when a Priority 1 call is raised 24x7x365. Regular Updates Customers will be updated on a regular and as appropriate basis. Updates will be provided to customers as follows: At a significant change in the progress of an incident (E.g. when Engineer ETA determined) At a point agreed with the customer Incident logged with Third Party Supplier Incident resolved All updates to the customer will reference the unique case reference number generated by the Incident Management System. 4.0 SERVICE IMPLEMENTATION AND OFF-BOARDING DCG adhere to Prince II and ITIL methodologies and have tried and tested processes and procedures that are reviewed and refined after each project. Using the methodology DCG have undertaken numerous projects to install and implement its Managed Cloud Disaster Recovery Service and have migrated existing customers from various other solutions. The major priority in the implementation of the solution and service is to ensure that DCG works very closely with you throughout the project and agree and review each task and activity both before and after. Therefore DCG will design, develop and implement the Project Implementation Plan in conjunction with you. 12 of 19

Once a contract has been awarded a dedicated project manager will be assigned to work with you who has overall responsibility for planning all aspects of the project and the ultimate success of the implementation. The service can be implemented within 4 weeks of a contract being agreed and a purchase order being received by DCG. Based on our experience of delivering this type of project the overall plan is broken down, at a high level, into 7 logical stages as follows:- Stage 1:- Requirements Definition Stage Review requirements Allocation of DCG resource Production and update the project plan / SOW Internal review plan & design Stage 2:- Planning Stage Project Kick-off meeting Review design Agree timescales Stage 3:- Building, Test and Implementation Stage Hardware & Software Procurement Building and configuration of Satellite Vaults Network Configuration Agree communication plan Stage 4:- Pilot & Rollout Identification of initial pilot severs Run pilot for 1 week Restore testing Performance tuning Agree roll out process & timescales Migrate servers according to schedule Mothball NetBackup Stage 5:- Review of the environment Review performance Review success failure Review policies, schedules and retentions Stage 6:- Maintenance and Support Documentation Reporting User training 13 of 19

Stage 7:- Project Sign Off Review agreed sign of criteria Sign off as complete Official handover to DCG Service Operation Centre Off-boarding There are no technical or commercial handcuffs that would constrain you from moving to an alternative solution at the end of the contract. DCG would simply restore the data to a location specified by you, using a quick ship server if required. As you own the encryption keys the data could then be stored locally. Providing all data has been removed from our data centers at the end of the contract term, there will be no additional charges following the contract end date. If you require that some or all of the data, remains in our data centers after the contract expiry data, DCG will only charge for the volume of data retained, which would be invoiced monthly. 5.0 SERVICE CONSTRAINTS Backups are dependent on the client(s) being Online. Maintenance Windows: maintenance tasks are performed in the back ground on a regular basis. Scheduled out-of-hours maintenance slots are published to end users and convenient times are agreed for any offline maintenance activities. The customer must notify us in the event of any changes to the environment ( drive selections/s/w upgrades etc.) CDR is a prescribed process for Sever Disaster Recover. There are specific steps and processes that need to be followed to a)ensure the data is secured and b) access to the recovered server.. this level of detail is highlighted in the discovery phase of an engagement. 14 of 19

6.0 SERVICE LEVELS Service Levels Initial Contact The DCG support desk is be available 24x7x365. All calls (incidents and problems) are responded to by 1 st line support within 15 minutes of the call being raised. Thereafter the escalations and service levels in the table below apply. Support Provided By Priority 1 Priority 2 Priority 3 Priority 4 Level 1 SOC Engineer Immediate Immediate Immediate Immediate Level 2 SOC Shift Leader Immediate 12 Hours 48 Hours 72 Hours Level 3 Professional Services / Vendor (as appropriate) 4 Hours As required As required As required Backups In excess of 95% of submitted backup jobs will complete to the backup device according to the agreed Backup Schedule. If jobs fail they will be resubmitted to meet the service level. Restores 100% of restores will complete as requested by the user. Restores will be performed as requested by the user against a Recovery Time Objective (RTO) of:- Next business day, after call has been logged on DCG s system For emergency restores DCG will endeavour to achieve a 4 hour RTO from tape Times to restore will be dependent on the amount of data being restored and available connectivity. Change Requests Change requests submitted through DCG s Change Management process will be acknowledged within 4 hours of receipt. Changes will be implemented within 48 hours of request Monday to Friday. However each change request will be assessed on an individual basis and scheduled in line with user requirements as well as the nature of the change required. 15 of 19

7.0 TRAINING As part of the implementation plan DCG will provide training at no additional cost. As DCG are providing a fully managed service based there will not be a requirement for a great level of training for you. However in order to give your staff a good understanding of the environment DCG propose to provide knowledge transfer during the implementation process. This will comprise a half day on-site training conducted by one of DCG s technical consultants and include hands-on familiarisation for as many staff as required. It will provide a good understanding on the system, how to use the Control Console, how to view the backup environment, vault/vault replication setup and daily vault management. 8.0 ORDERING AND INVOICE PROCESS A purchase order should be made out to DCG with an agreed service start date and end date. Minimum term is 1 year. DCG will bill monthly with most forms of payment accepted. Free trial The service can be trialled with no obligation and no charge. A quick and easy, 14 day free trial is available upon request. 9.0 TERMINATION There are no technical or commercial handcuffs that would constrain you from moving to an alternative solution at the end of the contract. DCG would simply restore the data to a location specified by you, using a quick ship server if required. As you own the encryption keys the data could then be stored locally. Providing all data has been removed from our data centers at the end of the contract term, there will be no additional charges following the contract end date. If you require that some or all of the data, remains in our data centers after the contract expiry data, DCG will only charge for the volume of data retained, which would be invoiced monthly. 16 of 19

10.0 CUSTOMER RESPONSIBILITIES The end user is responsible for supplying the Backup Schedule, Selection and Retention Policies. It is recommended that this is reviewed on an annual basis for currency. Backup volumes are limited by the capacity of the agreed limit. The customer must will be notified of their volumes and must take the necessary actions should their volumes reach the contracted limit. The Customer will need to provide us with access to each server via an agreed method to enable remote diagnosis of any problems. Without access, the customer will be responsible for performing installs/recovery actions. Server hardware requirements Each server: 1. Must meet Microsoft's requirements for one of the following installed operating systems: a) Windows Server 2003 x86 and x64 Standard / Enterprise / R2 with SP1 or SP2 b) Windows Server 2008 x 86 and x64 Standard / Enterprise with SP1 or SP2 c) Windows Server 2008 R2 x64 Standard / Enterprise / Datacenter with SP1 2. 1 GB RAM minimum, 2 GB RAM recommended This requirement is in addition to the memory required for the Operating System and installed applications. 3. Minimum available RAM required for DCG Replication processes and components (recommended 1GB). a) Minimum of 256 MB available for DCG Replication processes and components on Windows Server 2003. b) Minimum of 512 MB available for DCG Replication processes and components on Windows Server 2008/R2. 4. 2 GB of available hard disk space - For installation only, once installed, the Send\Receive queue is configured with a default of 10 GB. 5. Number of NICs: a) In a Pair configuration: 2 non-teamed NICs required. One NIC will be used for Public access, the other for Channel Access. All replication will take place over the Channel NIC. 17 of 19

6. Multiple hard disk drives are recommended as per application vendors' requirements. Avoid locating OS, database, and log files on the same disks. Server Software requirements Installed operating system: o o o Windows Server 2003 x86 and x64 Standard / Enterprise / R2 with SP1 or SP2 Windows Server 2008 x 86 and x64 Standard / Enterprise with SP1 or SP2 Windows Server 2008 R2 x64 Standard / Enterprise / Datacentre with SP1 Latest Microsoft security updates Installation of DCG Replication Heartbeat requires local admin rights When installing into a Windows Server 2008 environment, DCG Replication Heartbeat requires that the Windows Server Backup Feature and Command Line Tools are installed. When installing Windows Server Backup Feature, it is also necessary to include Windows PowerShell. Prior to the implementation beginning the following pre-requisites also need to be completed: Customer to complete the Data Collection sheet showing detail of servers being included in CDR. Customer to confirm that they agree to configure networking components in their environment to create VPN client as required for the CDR environment. DCG will sign a customer NDA agreement if required. The customer agrees to inform DCG of any future changes to the environment which may impact the CDR configuration. This includes planned maintenance to network, server upgrades (hardware and software), patches, installation of new applications or any other change that would affect the BMR backup. 18 of 19

11.0 COSTS Our pricing model is very simple and is based upon how many VM Servers you require. Cloud Disaster Recovery 1hr RTO 12 MONTH CONTRACT SKU Details Cost Per VM CDR-001-001 CDR 4HR up to 1 virtual recovery server Monthly fee 12 month term 360.00 CDR-001-002 CDR 4HR 2 to 5 virtual recovery servers Monthly fee 12 month term 324.00 CDR-001-003 CDR 4HR 6-10 virtual recovery servers Monthly fee 12 month term 318.00 CDR-001-004 CDR 4HR 11-15 virtual recovery servers Monthly fee 12 month term 312.00 CDR-001-005 CDR 4HR 16-20 virtual recovery servers Monthly fee 12 month term 306.00 CDR-001-006 CDR 4HR 20-25 virtual recovery servers Monthly fee 12 month term 300.00 Cloud Disaster Recovery 4hr RTO 12 MONTH CONTRACT SKU Details Cost Per VM CDR-003-001 CDR 4HR up to 1 virtual recovery server Monthly fee 12 month term 300.00 CDR-003-002 CDR 4HR 2 to 5 virtual recovery servers Monthly fee 12 month term 270.00 CDR-003-003 CDR 4HR 6-10 virtual recovery servers Monthly fee 12 month term 265.00 CDR-003-004 CDR 4HR 11-15 virtual recovery servers Monthly fee 12 month term 260.00 CDR-003-005 CDR 4HR 16-20 virtual recovery servers Monthly fee 12 month term 255.00 CDR-003-006 CDR 4HR 20-25 virtual recovery servers Monthly fee 12 month term 250.00 Cloud Disaster Recovery 24hr RTO 12 MONTH CONTRACT SKU Details Cost Per VM CDR-005-001 CDR 24HR up to 1 virtual recovery server Monthly fee 12 month term 200.00 CDR-005-002 CDR 24HR 2 to 5 virtual recovery servers Monthly fee 12 month term 170.00 CDR-005-003 CDR 24HR 6-10 virtual recovery servers Monthly fee 12 month term 165.00 CDR-005-004 CDR 24HR 11-15 virtual recovery servers Monthly fee 12 month term 160.00 CDR-005-005 CDR 24HR 16-20 virtual recovery servers Monthly fee 12 month term 155.00 CDR-005-006 CDR 24HR 20-25 virtual recovery servers Monthly fee 12 month term 150.00 All prices are exclusive of VAT. 19 of 19