ISO 27001 Virtual Server Hosting
Virtual Server (virtual machine) website hosting offering secure, scalable, high-performance hosting for websites applications. Hosting is quickly mobilised, UK-based and scalable (up or down) within 24 hrs. Solutions are tailor-made, from single server to private cloud with Windows, IIS, .NET, Linux, Apache, MySQL, PHP, WordPress, Umbraco and custom applications supported.
- Uses KVM open source technology
- Hosting single server VM solutions to dedicated private cloud offerings
- Performance and sizing options tailored to your requirements
- ISO27001, ISO9001, Cyber Essentials accredited data centre hosting
- 24/7/365 monitoring systems in place
- Choose from PRINCE2 or Agile like project management
- Backup of data included
- Windows or Linux VMs
- Scale up/down hosting CPU, RAM, Disk within 24 hours
- Expert advice and support for database and applications available
- Typical availability exceeds 99.9%
- Resilient internet connections with high availability firewalls
- Multiple physical servers operate in high availability cluster
- Multiple Storage Area Networks (SANs) operate in high availability cluster
- Storage uses RAID and is replicated
- Low Contention: VMs are not over provisioned
- Robust system monitoring, support and project management
- Hosting systems entirely and only within the UK
- Experienced in working with NHS and Public Sector
- Experts in open source technologies, Linux (LAMP), WordPress, Umbraco
£99 per virtual machine per month
- Free trial available
- Pricing document
- Skills Framework for the Information Age rate card
- Service definition document
- Terms and conditions
Connect Internet Solutions Ltd
+44 (0) 1512824321
Any routine downtime required for system maintenance is scheduled outside normal office hours. A maximum 1 hour per month window is provisionally allocated for system maintenance, if required. In any month when the maintenance window is to be used, customers are notified at least seven working days in advance.
Expected data transfer 1mbps per transfer. A Fair Usage Policy applies.
After initial setup, firewall change requests will be limited to 3 per month, further changes will require support hours to be purchased.
|System requirements||Buyer can use own existing licences or we supply licences.|
|Email or online ticketing support||Email or online ticketing|
|Support response times||
Target response time:
2 hrs for critical support requests during normal working hours;
4 hrs for non-critical support requests.
|User can manage status and priority of support tickets||Yes|
|Online ticketing support accessibility||None or don’t know|
|Phone support availability||9 to 5 (UK time), Monday to Friday|
|Web chat support||No|
|Onsite support||Yes, at extra cost|
Helpdesk: 9am to 5pm Monday to Friday (excluding bank holidays)
Hosting support: 8am to 6pm Monday to Friday (excluding bank holidays)
Tickets can be logged 24/7
Out of hours support response (extra cost - see pricing document): 24/7
Contact details for Service Manager will be supplied.
|Support available to third parties||Yes|
Onboarding and offboarding
Support manual is provided.
Custom support and training is available.
|End-of-contract data extraction||
When off-boarding, the client can be supplied with an export (image) of the Virtual Machine. Images can be supplied in qcow or raw format. Other formats can be supplied subject to cost (billable at hourly rates).
All consumer generated data will be returned during the off-boarding process.
Flexible options are available for handing over the export to the client, dependent upon client preferences (Client transfers via SFTP, Connect transfers via SFTP on client’s behalf, physical transfer via appropriate medium/channel).
Single copy of VM in raw format
Liaison with new supplier
Transfer of data by non-electronic means
Using the service
|Web browser interface||No|
|Command line interface||No|
|Independence of resources||Systems are monitored continually. Systems are not over-provisioned. Throttling can be applied.|
|Infrastructure or application metrics||Yes|
|Reporting types||Reports on request|
|Supplier type||Not a reseller|
|Staff security clearance||Other security clearance|
|Government security clearance||Up to Developed Vetting (DV)|
|Knowledge of data storage and processing locations||Yes|
|Data storage and processing locations||
|User control over data storage and processing locations||Yes|
|Datacentre security standards||Supplier-defined controls|
|Penetration testing frequency||At least once a year|
|Penetration testing approach||In-house|
|Protecting data at rest||Physical access control, complying with another standard|
|Data sanitisation process||Yes|
|Data sanitisation type||
|Equipment disposal approach||Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001|
Backup and recovery
|Backup and recovery||Yes|
|What’s backed up||
|Backup controls||Different schedule on request.|
|Scheduling backups||Supplier controls the whole backup schedule|
|Backup recovery||Users contact the support team|
|Data protection between buyer and supplier networks||
|Data protection within supplier network||Other|
|Other protection within supplier network||Systems are managed using Secure Shell. Where web interfaces are used for management, this is provided over HTTPS/SSL. Management interfaces are separately firewalled from the other networks.|
Availability and resilience
Availability – 99.9%
In any calendar month in which we have unscheduled down time that causes the service level to drop below agreed performance level, the basic monthly charge is reduced by 10% for every 1% below agreed level, up to a maximum credit in that month of 100%.
|Approach to resilience||Available on request.|
|Outage reporting||Email alerts|
Identity and authentication
|Access restrictions in management interfaces and support channels||Management interfaces are available to Connect Internet Solutions Ltd staff only. Roles and responsibilities are defined at project initiation and access to support channel granted to named contacts.|
|Access restriction testing frequency||At least once a year|
|Management access authentication||
|Devices users manage the service through||Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)|
Audit information for users
|Access to user activity audit information||Users contact the support team to get audit information|
|How long user audit data is stored for||At least 12 months|
|Access to supplier activity audit information||Users contact the support team to get audit information|
|How long supplier audit data is stored for||At least 12 months|
|How long system logs are stored for||At least 12 months|
Standards and certifications
|ISO/IEC 27001 certification||Yes|
|Who accredited the ISO/IEC 27001||Alcumus ISOQAR|
|ISO/IEC 27001 accreditation date||15/06/2016|
|What the ISO/IEC 27001 doesn’t cover||The scope of our ISO27001 certification covers web hosting.|
|ISO 28000:2007 certification||No|
|CSA STAR certification||No|
|Other security certifications||Yes|
|Any other security certifications||Cyber Essentials|
|Named board-level person responsible for service security||Yes|
|Security governance certified||Yes|
|Security governance standards||ISO/IEC 27001|
|Information security policies and processes||
All new starters undergo security clearances.
Security Manager reports to Board.
Policies linked to contracts of employment.
Internal audits carried out annually.
External audits by ISOQAR carried out annually.
|Configuration and change management standard||Supplier-defined controls|
|Configuration and change management approach||
Connect’s change management process ensures that no change is made to the operating environment without the necessary authority and ensures that a log of any changes made is completed. A Request for Change Form is completed when a change is deemed necessary. This is signed by all relevant parties before the change can take place. Areas under change control usually include:
• New hardware installations
• Software changes for the operating system / software
• Network upgrades for any change in hardware, upgrades to equipment, changes in topology/protocols/addresses.
Changes assessed for potential security impact as part of our ISO27001 processes.
|Vulnerability management type||Supplier-defined controls|
|Vulnerability management approach||
We monitor potential threats from a variety of sources including CERT, supplier notifications and industry updates
Potential threats are assessed by technical team.
Critical patches are deployed as soon as possible. Non-critical patches are applied on a weekly basis.
|Protective monitoring type||Supplier-defined controls|
|Protective monitoring approach||
We identify potential compromises using log analysis and host intrusion detection system.
Compromised system is isolated, treated, brought back into service.
Response is immediate.
|Incident management type||Supplier-defined controls|
|Incident management approach||Processes for incident management are defined within ISO27001. Incidents can be reported by end user, staff or other channel. Incident reports detail whether confidentiality, integrity or availability has been compromised. Incident reports are provided in document format.|
|Approach to secure software development best practice||Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)|
Separation between users
|Virtualisation technology used to keep applications and users sharing the same infrastructure apart||Yes|
|Who implements virtualisation||Supplier|
|Virtualisation technologies used||KVM hypervisor|
|How shared infrastructure is kept separate||
Restriction of root level/administrator access
Separation of network traffic using VLANs
Separate firewall zones
Separate iSCSI luns
|Description of energy efficient datacentres||
Connect works to reduce energy consumption in its data centre by:
* Using shared monitors to access servers
* Using virtual machines in preference to physical servers
* Keeping servers at optimum temperature for efficiency
|Price||£99 per virtual machine per month|
|Discount for educational organisations||No|
|Free trial available||Yes|
|Description of free trial||Dependent upon requirements. Limited period applies.|