N4 Cloud

N4Cloud provides access to a self-service virtualisation platform hosted on infrastructure owned by Node4. The infrastructure is securely shared across multiple customers and hosted in three Node4 UK data centre. Node4 manage the infrastructure up to the Hypervisor and ensure a portal is available for provisioning.


  • Self service portals offering control over provisioning your resource.
  • Granular pricing based on only the resource you need
  • Backup options for off-site data protection
  • Full Suite of Security options, managed by our SOC
  • DRaaS, RPO's sub 10minutes and RTO's of down to 1Hr
  • Managed Services Offering - Four levels of outsourced management
  • Digital Transformation, Design and Migration Consultancy
  • Cloud Readiness Consultancy and Reports.


  • Self provision cloud resource on demand, upload Virtual Machine images.
  • Access immediate scalability with additional resource available on demand.
  • Recover administration time by using our integrated managed backup service
  • Deploy 360 degree security with managed reporting SOC services
  • Limit Business interruption using DR services for critical Virtual Machines
  • Refocus your IT team focus on applications and innovation
  • Realise a lower cost of ownership with reduced Administration
  • Cloud Readiness Reports offer detailed information on existing utilisation


£0.06 to £0.45 per gigabyte per month

  • Free trial available

Service documents

G-Cloud 11



Vicky Withey

0845 123 2222

Service scope

Service scope
Service constraints Where Node4 plans to perform essential works and the changes are service affecting, Node4 will use reasonable endeavours to perform such works between the hours of 00:00 and 04:00 and will use reasonable endeavours to give the Customer at least five (5) days prior notice for network related work and at least ten (10) days prior notice for Infrastructure related work. In the event of an emergency or Service Affecting Fault such notice may be less than 24 hours. This is without prejudice to or limitation of the definition of Planned Outage.
System requirements
  • Customers using own licenses are responsible for ensuring their mobilityrights
  • Connectivity Requirements and Firewalling (if not supplied by Node4)
  • Patching&Update maintenance of OS (if not supplied by Node4)

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Acknowledgement with 30 mins and action within 1 hour for P1
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support Yes, at extra cost
Support levels Node4 will provide 24/7 support
Support available to third parties No

Onboarding and offboarding

Onboarding and offboarding
Getting started As part of service onboarding, there is online training and user documentation and support as required.
Service documentation Yes
Documentation formats PDF
End-of-contract data extraction Provide the Customer with the ability to retrieve data held on the Node4 systems via electronic transfer, or provide a hard copy of data on to a device provided by the Customer.
End-of-contract process Price includes the ability to extract data and any specific requirement ss are chargeable.

Using the service

Using the service
Web browser interface Yes
Using the web interface Customers can use the web interface to access the ticketing system.

A self-service portal which the customer can use to perform a set of provisioning and management of tasks for their virtual machines, storage and backup. A maximum increase of 20% of the existing virtual data centre resource can be completed each month within the portal.
Web interface accessibility standard None or don’t know
How the web interface is accessible Customers can make changes to virtual machines, storage and backup.
Web interface accessibility testing Not presently
Command line interface No


Scaling available No
Independence of resources Resource management tools are used at the Hypervisor layer which deploy learning and predictive analysis features. These tools constantly optimise the shared cloud environments to avoid resource bottlenecks.

N4Cloud is build in defined PODs of resource so that there are clear barriers between groups of customers. This segregation further reduces the risk of an issue on one piece of hardware affecting an individual customer.
Usage notifications Yes
Usage reporting
  • Email
  • Other


Infrastructure or application metrics Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Security Clearance (SC)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations United Kingdom
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach In-house
Protecting data at rest Physical access control, complying with another standard
Data sanitisation process Yes
Data sanitisation type Deleted data can’t be directly accessed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Backup and recovery Yes
What’s backed up
  • Virtual Machines
  • File Data
  • SQL Databases
  • On-Premise virtual infrastructure
  • Physical Servers & Workstations
Backup controls Standard N4Cloud Backups are run nightly for 30days on a rolling schedule and capture the virtual machine only.

Optional Custom Backup schedules are available to capture virtual machines and databases more frequently and with a longer retention. Additional cost may apply.

On Premise or Third Party Datacentre infrastructure can be protected using Veeam Cloud Connect technology, in this scenario the backup jobs are completely managed by the customer.
Datacentre setup Multiple datacentres with disaster recovery
Scheduling backups Users contact the support team to schedule backups
Backup recovery Users contact the support team

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks Private network or public sector network
Data protection within supplier network Other
Other protection within supplier network As a network provider, Node4 would not as standard encrypt data in transit (over MPLS network or Internet). Node4 can, however, provide customer specific solutions which use IPSec encryption through encrypted MPLS (Cisco DMVPN for example) or SD WAN type services.

Availability and resilience

Availability and resilience
Guaranteed availability The component is considered available if all Hypervisor hosts hosting the Customer Virtual Machines are operating in a normal state.
If a Hypervisor node fails, and the Virtual Machines are migrated to another node, then downtime shall be considered as the time between a) the time the Hypervisor node is detected as no longer functioning and b) the time the Virtual Machines start to power on another host.
Availability levels apply to the Hypervisor platform and are not measured per virtual machine.
The following equation will be used to calculate the Compute Resource (Shared) availability. References to hours are to the number of hours in the applicable Monthly Review Period:
((Total minutes – Total minutes Unavailable)/Total minutes) x 100
Node4 will provide the Customer with service credits, as set out in section 11 of the N4Cloud Service Schedule which is published here:
Approach to resilience Node4 operate fully resilient Datacentres, core DWDM network and our Cloud platforms use our own buildings and assets.

Detail on how we so this is sensitive and therefore information is only available on request.
Outage reporting Node4 may raise faults against alarms on the Node4 Network or customers monitored equipment. If a fault affects your services then we will use reasonable endeavours to promptly inform the named contact(s) via our helpdesk system primarily, or by telephone in circumstances where the fault means that that they would not receive email. The start time of a fault is the time it is detected by us and a Service Ticket number is allocated. For services affecting multiple customers we will post updates on

Identity and authentication

Identity and authentication
User authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
Access restrictions in management interfaces and support channels Access is only granted to those that require access. Access can only be provided by those with the correct permission to authenticate. Management networks are isolated.
Access restriction testing frequency At least every 6 months
Management access authentication
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password
Devices users manage the service through Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for Between 1 month and 6 months
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for Between 1 month and 6 months
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 Lloyds Register
ISO/IEC 27001 accreditation date 12/12/2017
What the ISO/IEC 27001 doesn’t cover N/A
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications Yes
Any other security certifications
  • Cyber Essentials

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes Node4 operates an Information Security Management System (ISMS) which conforms to ISO27001. The purpose of the ISMS is to assess and manage risk and to protect the organisation’s information assets from all threats, whether internal or external, deliberate or accidental. The CEO has approved the information security policy. The Information Security Objectives of Node4 are to:
• Protect information against unauthorised access
• Assure the confidentiality of information
• Maintain the integrity of the information
• Ensure the availability of information as required by the business processes
• Meet all regulatory and legislative requirements
• Implement, maintain and test DR / BC plans in line with the security policy
• Train all staff on information security
• Continually review and improve the ISMS
Additional policies and procedures exist to support the Information Security Policy. These include, but are not limited to, physical and logical access controls, network security, malware controls, vulnerability management and business continuity.

Operational security

Operational security
Configuration and change management standard Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach Moves, adds and changes at the Virtual Machine level are all manageable through the vCloud Director portal. Change requests at the infrastructure level or that are unavailable in the portal can be raised using the service desk. All changes are assessed for their potential security impact through the Change Advisory Board. A Low-Risk change is one which has a possibility of causing up to a Priority 3 or 4 Incident. A High-Risk change is one which has a possibility of causing a Priority 1 or 2 Incident or a large amount of Priority 3 and 4 Incidents for multiple customers.
Vulnerability management type Undisclosed
Vulnerability management approach Vulnerability testing is performed monthly using internal and external tool sets. Vulnerabilities are assessed and remediation actions performed depending on risk. Information about potential threats is provided by the vulnerability scanning tools.
Protective monitoring type Undisclosed
Protective monitoring approach Protective monitoring is performed by the SIEM tool and monitored by the Security Operations Centre. The SIEM provides realtime alerts of any potential compromises and a process of detect, analyse and response is followed with 1 hour.
Incident management type Undisclosed
Incident management approach The following approach in used for incident management to ensure the objectives are achieved

• Incident Resolution is achieved in the most effective manner
• All Incidents are identified promptly and correctly
• All Incidents are evaluated, categorised, and prioritised correctly
• Communication is maintained with all Stakeholders throughout the lifecycle of all Incidents
• All Incidents are constantly monitored throughout their lifecycle

Secure development

Secure development
Approach to secure software development best practice Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

Separation between users
Virtualisation technology used to keep applications and users sharing the same infrastructure apart Yes
Who implements virtualisation Supplier
Virtualisation technologies used VMware
How shared infrastructure is kept separate Compute separation is provided by a hypervisor.

Network and storage virtualisation techniques are also employed.

We operate a software defined Cisco ACI network which standardises the deployment of secure networks for our customers

Energy efficiency

Energy efficiency
Energy-efficient datacentres Yes
Description of energy efficient datacentres Node4 is ISO 50001 certified.


Price £0.06 to £0.45 per gigabyte per month
Discount for educational organisations No
Free trial available Yes
Description of free trial A 1 to 3 month proof of concept trial period is available subject to an application process.

This provides a test cloud environment and limited resources for up to x5 basic virtual machines including operating system licensing.

A success criteria is agreed prior to the trial being approved.

Service documents

pdf document: Pricing document pdf document: Skills Framework for the Information Age rate card pdf document: Service definition document pdf document: Terms and conditions pdf document: Modern Slavery statement
Service documents
Return to top ↑