Version 1 Solutions Limited

Infrastructure as a Service - Microsoft Azure

Enhanced partnerships with leading providers ensure we can offer independent advice to customers across a range of services for Public Cloud including strategy, design, build, migration, ongoing management and optimisation of enterprise workloads. We have a deep understanding of the entire lifecycle of enterprise applications and technologies that underpin them.

Features

  • Proven cloud consultancy, strategic advice and migration expertise
  • Well Architected infrastructure design and build
  • Official and Official Sensitive supported
  • ITIL Incident, Problem and Change Management processes
  • ISO 20000 Certified and ISO 27001 Certified
  • Enterprise Monitoring Service and Proactive Maintenance
  • Disaster Recovery options
  • Optimisation, Economics, Integration Services
  • Sectors: Healthcare, Ambulances/GRS, Police, Local Government, Central Government, Higher Education
  • Microsoft Gold Partner: Azure Specialisation in Apps Modernisation

Benefits

  • Microsoft Gold Partner; Cloud Platform; Cloud Productivity;
  • Automation for infrastructure builds and workload migrations
  • Ongoing advice on best cloud services to meet requirements
  • Best practice governance, security and compliance
  • Continual service improvement
  • Value for money ensured through cloud management and optimisation
  • Additional services available for platform management and software development
  • Optional: Expert advice on maximising current licence investments

Pricing

£250 a server a month

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tendernotices@version1.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 12

Service ID

5 3 2 4 6 8 0 7 4 3 0 7 0 6 8

Contact

Version 1 Solutions Limited Matt Gorman
Telephone: +44 203 859 4790
Email: tendernotices@version1.com

Service scope

Service constraints
For constraints relating to the underlying Azure platform see- https://docs.microsoft.com/en-gb/azure/ to determine applicable constraints based on buyers requirements.
System requirements
  • Currently supported web browser
  • Communications link with sufficient capacity for the service
  • See also - https://docs.microsoft.com/en-gb/azure/

User support

Email or online ticketing support
Email or online ticketing
Support response times
Standard SLA covers Office Hours:
1 hour priority calls
4 hour response standard
Can be tailored to customer requirement including weekend cover
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
None or don’t know
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
Web chat
Web chat support availability
9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard
WCAG 2.1 A
Web chat accessibility testing
Version 1 uses Skype for our web chat support. The following is a list of devices with supported accessibility features available for Skype on Windows 8 desktop:

• Narrator screen reader enables blind people to use their computer or other device as its purpose is to read text on the screen aloud. Skype for Windows desktop and Skype for Windows 8 may also work well with third-party screen readers such as NVDA (free download) and JAWS.
• High-contrast settings benefit low vision users and users with little or no color perception as it makes text easier to read.
• Magnifier is a feature intended for low vision users as it enlarges the screen and makes text easier to read and images easier to see
Onsite support
Yes, at extra cost
Support levels
The Managed Service provided by Version 1 is based on our ISO 20000 processes and procedures. The ISO 20000 standard held by Version 1 since July 2011, is aligned to the ITIL service framework and covers standard service processes such as Incident Management, Change Management and Release Management . During on-boarding we can tailor these processes and agree the detail of their implementation, in particular how they integrate with the client’s own internal processes. There is an additional charge for this tailoring which can be incorporated in the on-boarding costs. Version 1 has an ITIL based Service Governance structure in place for each client to ensure SLAs are met and the overall support service is managed in a responsive, customer-focused manner. The focus of the service governance will be a regular Service Management Board or Service Review Meeting attended by key stakeholders. Each managed service client is assigned a service manager to co-ordinate their service provision and ensure customer satisfaction levels are maintained. At Version 1, Continuous Service Improvement as a core element of our Managed Service offering and we incorporate it into the client's Managed Service at the outset of our engagement
Support available to third parties
Yes

Onboarding and offboarding

Getting started
A critical aspect of any project is the need to conduct comprehensive training for the users in the use of the application. Version 1 is committed to conducting professional training to ensure that users of the system can gain maximum benefit from using it. Version 1 normally propose a ‘train the trainer’ approach to user training be adopted, integrated with the testing and overall acceptance phase of the project. This requires a difference in approach from standard training courses, as users need to be trained in both the application and in how to pass this on to their colleagues. A number of “super users” for the system should be nominated by the client and could also be identified through a Training Needs Analysis process
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
Version 1 will assist with service migration and can provide a data extract in an agreed format
End-of-contract process
The migration work at end-of-contract will be chargeable based on the standard G-Cloud rate card. For Azure platform Microsoft contractually commits to specific processes when a customer leaves a cloud service or the subscription expires. Please see https://www.microsoft.com/en-us/trustcenter/privacy/you-own-your-data. In our Online Services Terms, Microsoft contractually commits to specific processes when a customer leaves a cloud service or the subscription expires. This includes deleting customer data from systems under our control. If you terminate a cloud subscription or it expires (except for free trials), Microsoft will store your customer data in a limited-function account for 90 days (the “retention period”) to give you time to extract the data or renew your subscription. During this period, Microsoft provides multiple notices, so you will be amply forewarned of the upcoming deletion of data. After this 90-day retention period, Microsoft will disable the account and delete the customer data, including any cached or backup copies. For in-scope services, that deletion will occur within 90 days after the end of the retention period. (In-scope services are defined in the Data Processing Terms section of our Online Services Terms.) See http://www.microsoftvolumelicensing.com/Downloader.aspx?DocumentId=13655

Using the service

Web browser interface
Yes
Using the web interface
Manage and deploy services via a portal. See https://azure.microsoft.com/en-gb/ for details on the Azure portal
Web interface accessibility standard
WCAG 2.1 AA or EN 301 549
Web interface accessibility testing
See https://www.microsoft.com/en-us/accessibility/ for information relating to the Azure portal
API
Yes
What users can and can't do using the API
Users are able to utilise the Azure API Managament service to create their own API's for the solutions they deploy on to the platform. Additionally we have the Azure Service Management API which provides
API automation tools
  • Ansible
  • Chef
  • SaltStack
  • Terraform
  • Puppet
API documentation
Yes
API documentation formats
HTML
Command line interface
Yes
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
Using the command line interface
Azure CLI 2.0 is optimized for managing and administering Azure resources from the command line, and for building automation scripts that work against the Azure Resource Manager. See https://docs.microsoft.com/en-us/cli/azure/install-azure-cli

Scaling

Scaling available
Yes
Scaling type
  • Automatic
  • Manual
Independence of resources
Azure represents a hyper-scale public cloud service
Usage notifications
Yes
Usage reporting
  • API
  • Email
  • SMS

Analytics

Infrastructure or application metrics
Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
Reporting types
API access

Resellers

Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Microsoft

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Other
Other data at rest protection approach
See http://download.microsoft.com/download/0/D/D/0DD8FB12-6343-4A50-80B2-545F2951D7AE/MicrosoftAzureDataProtection_Aug2014.pdf , and https://docs.microsoft.com/en-us/azure/storage/storage-service-encryption
Data sanitisation process
Yes
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Yes
What’s backed up
Under user control
Backup controls
Please see https://docs.microsoft.com/en-gb/azure/backup/backup-azure-vms-first-look
Datacentre setup
Multiple datacentres with disaster recovery
Scheduling backups
Users schedule backups through a web interface
Backup recovery
Users can recover backups themselves, for example through a web interface

Data-in-transit protection

Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
See Microsoft's Online Service Terms at http://www.microsoftvolumelicensing.com/Downloader.aspx?DocumentId=13655
Approach to resilience
Please see https://www.microsoft.com/en-us/cloud-platform/global-datacenters and https://www.microsoft.com/en-us/TrustCenter/
Outage reporting
Please see https://azure.microsoft.com/en-us/status/ and https://portal.azure.com/#blade/HubsExtension/ServicesHealthBlade

Identity and authentication

User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Username or password
Access restrictions in management interfaces and support channels
Azure-AD can designate separate administrators to serve different functions. These administrators will have access to features in the Azure portal and, depending on their role, will be able to create or edit users, assign administrative roles to others, reset user passwords, manage user-licenses, and manage domains, among other things. A user who is assigned an admin role will have the same permissions across all of the cloud services that your organization has subscribed to, regardless of whether you assign the role in the Office365 portal, or in the Azure classic-portal, or by using the Azure-AD module for Windows PowerShell. https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign-admin-roles
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Devices users manage the service through
Dedicated device on a segregated network (providers own provision)

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
Between 6 months and 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
Between 6 months and 12 months
How long system logs are stored for
Between 6 months and 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Certification Europe
ISO/IEC 27001 accreditation date
29/07/2015
What the ISO/IEC 27001 doesn’t cover
The scope of the certification covers all Version 1 Managed Service activities
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Version 1 recognise that the relationship between information security and IT service management is so close that we implemented an Integrated Management System (IMS) that has been certified to ISO 27001:2013 and ISO 20000-1:2011 with matching scopes. The Version 1 IMS is based on the guidance provided in the International Standard for the Corporate Governance of IT (ISO/IEC 38500) and the International Standard for Risk Management (ISO 31000). The Version 1 IMS has a broad scope that supports all of our ICT services. The Version 1 IMS is audited every 3 months, alternately by internal and external auditors. An Information Security Officer along with the IT Governance Committee are responsible for maintaining the IMS, as well as providing advice and guidance on policy implementation

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
Verison 1 has developed formal standard operating procedures (SOPs) governing the change management process. These SOPs cover both software development and hardware change and release management, and are consistent with established regulatory guidelines including ISO 27001 and ISO 20000
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
When providing the Antimalware solution for Virtual Machines, Azure is responsible for ensuring the service is highly available, definitions are updated regularly, that configuration through the Azure Management Portal is effective and that the software detects and protects against known types of malicious software. MCIO-managed hosts in the scope boundary are scanned to validate anti-virus clients are installed and current signature-definition files exist. Vulnerability scans are performed on a quarterly basis at a minimum. Microsoft Azure contracts with independent assessors to perform penetration testing of the Microsoft Azure boundary.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
Microsoft Azure employs sophisticated software-defined service instrumentation and monitoring that integrates at the component or server level, the datacenter edge, our network backbone, Internet exchange sites, and at the real or simulated user level, providing visibility when a service disruption is occurring and pinpointing its cause. Proactive monitoring continuously measures the performance of key subsystems of the Microsoft Azure services platform against the established boundaries for acceptable service performance and availability. When a threshold is reached or an irregular event occurs, the monitoring system generates warnings so that operations staff can address the threshold or event.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
Microsoft has developed robust processes to facilitate a coordinated response to incidents. • Identification – System and security alerts may be harvested, correlated, and analyzed. • Containment – The escalation team evaluates the scope and impact of an incident. • Eradication – The escalation team eradicates any damage caused by the security breach, identifies root cause for why the security issue occurred. • Recovery – During recovery, software or configuration updates are applied to the system and services are returned to a full working capacity. • Lessons Learned – Each security incident is analyzed to protect against future reoccurrence.

Secure development

Approach to secure software development best practice
Supplier-defined process

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart
Yes
Who implements virtualisation
Supplier
Virtualisation technologies used
Hyper-V
How shared infrastructure is kept separate
Please see https://www.microsoft.com/en-us/TrustCenter/Security/default.aspx.

Energy efficiency

Energy-efficient datacentres
No

Pricing

Price
£250 a server a month
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tendernotices@version1.com. Tell them what format you need. It will help if you say what assistive technology you use.