Epiq Systems Ltd

Microsoft 365 (O365)

Microsoft 365 is a cloud based integrated Enterprise productivity application that helps transform the way organisations work. It enables employees to connect to people, collaborate, share content and information from any device and anywhere, whilst securely safeguarding organisations’ assets with intelligent security.

Features

  • Information Governance
  • Advanced Threat Protection
  • Data Loss Prevention
  • Record Management
  • Data Privacy
  • Data Investigation
  • Insider Risk Management
  • Advanced eDiscovery
  • Azure Information Protection
  • Data Migration

Benefits

  • Content classification and retention policy
  • Advanced protection against malware, malicious attacks
  • DLP to protect data from intentional or accidental loss
  • RM provides regulatory, legal, critical records for all corporate data
  • GDPR, DSR, discovery, governance and protection
  • Triage, investigate and remediate data related incidents
  • Minimize internal risks by detecting, investigate, action on risky activities
  • Electronic workflow for legal cases including hold
  • Automatic, optional classification, protection documents, emails by applying labels
  • Migration from on premise to cloud

Pricing

£120 to £240 a unit an hour

  • Education pricing available

Service documents

Framework

G-Cloud 12

Service ID

7 9 3 9 8 4 7 5 8 6 5 9 2 8 0

Contact

Epiq Systems Ltd Sandeep Patel
Telephone: 020 7367 9173
Email: contracts@epiqglobal.com

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Microsoft 365 provides enablement and implementation of the various modules.
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints
Requires Microsoft 365 licences.
System requirements
Microsoft 365 software licences and Tenant

User support

Email or online ticketing support
Yes, at extra cost
Support response times
Projects will be managed by consultants and project managers based on issue levels. The service is based on the provision of Professional Services for the implementation and deployment of the required services or functionalities. Support following project sign off will be the responsibility of the internal IT Support Team and will be agreed at contract award.
User can manage status and priority of support tickets
No
Phone support
No
Web chat support
No
Onsite support
Onsite support
Support levels
Onsite support is provided during the project implementation and deployment of the required services by the implementation project team.
Support available to third parties
No

Onboarding and offboarding

Getting started
Awareness workshop
On site training
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
The data will reside at the user's end.
End-of-contract process
Review of the project will be conducted including all follow up actions.
All project design and configuration documentations will be provided.

Using the service

Web browser interface
No
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
Microsoft enabled
Service interface
No
API
No
Customisation available
Yes
Description of customisation
Customisation available to the level of support the users require

Scaling

Independence of resources
All projects are managed based on availability of internal resources and planned schedule

Analytics

Service usage metrics
Yes
Metrics types
Volumes of data received and processed; Volumes of data hosted; Active users; Breakdowns of data hosted by custodian, data, file type and other criteria as requested by clients.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Reseller providing extra support
Organisation whose services are being resold
Microsoft

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
The software can be configured to enable users to download both documents and data, subject to user profiles and permissions. For large data sets or formal productions to other parties, it is highly recommended that a system administrator manages this process.
Data export formats
  • CSV
  • Other
Other data export formats
  • Native
  • TIFF
  • PDF
  • HTML
Data import formats
  • CSV
  • Other
Other data import formats
  • Native
  • Tiff
  • PDF
  • HTML

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
We train staff to answer phones within three rings, acknowledge emails within one hour and escalate all unusual queries to their manager. We maintain a formal policy for handling queries and all personnel are trained in our escalation process. Specific service level agreements for availability are agreed with clients on a case-by-case basis.
Approach to resilience
The physical protection of all data centres encompasses multiple layers including 24x7 onsite staff, strict personnel access controls utilising badge and/or biometric access and mantraps, and 24x7x365 video surveillance both inside and outside the facility. Hardware, servers, and network devices are maintained on raised flooring and are secured in locked cabinets. Visitors must be escorted at all times, sign in, and be assigned an electronic photo ID badge that does not grant access to any raised floor areas. Further information is available on request.
Outage reporting
Email alerts are sent directly to the IT support team who will then investigate and report back to clients confirming the start and end times for any outage, our analysis of the cause of the outage and how the issue was resolved. Reports will also include recommendations for any future changes or upgrades if these are required.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Username or password
Access restrictions in management interfaces and support channels
Our internal environments are restricted to internal staff only and no external access to management interfaces and support channels are permitted. Support during the project is carried out by the Project Manager or consultants working on the project and reviewed during regular client meetings.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
British Standards Institute (BSI)
ISO/IEC 27001 accreditation date
02/04/2019
What the ISO/IEC 27001 doesn’t cover
Services outside our core services which are Legal Services and Court Reporting. A statement of applicability can be provided on request.

Check content
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
Yes
Any other security certifications
  • Cyber Essentials
  • Add any other Microsoft security certifications

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Information security is managed through a dedicated information security team who are responsible for designing and updating polices relating to user access, physical controls, network storage, appropriate use of systems and compliance with existing legislation. Policies are reviewed and updated on a quarterly basis. Mandatory training on security issues is provided to all employees when they join the company and at least annually during their tenure. Our data centre and operations centre have been accredited to ISO 27001 standard and as part of this certification we are regularly interviewed and audited by an external auditor - a process that evaluates our policies and practices to identify and resolve potential vulnerabilities.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
As part of the project progress all Change Requests have to be documented and agreed and signed off by the client, including the update of the risk log and configuration and design documentations.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Our environments are centrally managed adhering to our strict cyber security policy. Services to clients are delivered by our Professional Services resources only and our environment does not have an impact on the service being delievered to clients. Any work carried out is within the client's own environment.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Everyone within the organisation has to adhere to strict security and compliance policies to prevent potential compromise. Any concern around potential compromise has to be immediately reported to the immediate line manager, local IT Department, and where necessary escalated to the Vice President of the EMEA region, followed by informing the global IT team. Strict governance and procedures are required to be followed at all times.
Incident management type
Supplier-defined controls
Incident management approach
As part of the project process all incidents are recorded, reported to the relevant users and where necessary escalated to the Project Sponsor as well as the Director of Information Governance of the EMEA region.

Following necessary actions, preventive measures and mitigation will be introduced to prevent similar incidents occuring.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Price
£120 to £240 a unit an hour
Discount for educational organisations
Yes
Free trial available
No

Service documents