VODAFONE LIMITED

Public Cloud Microsoft Azure offered by Vodafone

Microsoft Azure allows you to build, manage and deploy applications on a global basis. Azure provides a broad set of infrastructure services, such as computing power, storage options, networking and databases, delivered as a utility: on-demand, available in seconds, with pay-as-you-go pricing.

Features

• Scalable, reliable and secure global computing infrastructure
• Your application can scale up or down based on demand
• End-to-end approach to secure flexible infrastructure

Benefits

• Quick and secure hosting of your applications
• Flexibility to select all the services you need
• No long-term contracts or up-front commitments

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks_team@vodafone.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

123820579637036

Contact

Frameworks Team
07775671027
frameworks_team@vodafone.com

About your service

• Service categories:

  IaaS

  IaaS Compute

  Virtualised x86

  • General purpose
  • Compute optimised

Service scope

• Service constraints: Please view detailed Service Definition
• System requirements: Refer to Azure catalogue for system requirements on specific products
• Cloud deployment model: Public cloud

User support

• Email or online ticketing support: Yes
• Support response times: The standard response time is one hour with support available on a 24/7 basis. The Support Incident Escalation is available to be utilised for critical issues and whenever needed to resolve the issue speedily
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Vodafone will provide you with support for Microsoft Azure. Our Hosting Solutions Support team provides a 24x365 Service Desk and Incident Management team. Support will be provided in English. The Vodafone operational model for support is ITIL based. If you think there is a fault or problem with your public cloud environment, you are able to raise a fault via your usual Vodafone support route. Vodafone teams may contact the customer to work on the resolution of the fault. Customers must ensure that the correct contact details are submitted with their request. Vodafone’s support model for Microsoft Azure will triage issues into Microsoft if Vodafone is unable to resolve the issue. More details : Service Descriptions Support section
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Onboarding guidance is provided as part of the service. When the Azure service is ready the customer will be provided with the following: I. Service Terms – contains Vodafone and Microsoft Azure T&Cs II. Service Descriptions – a guide to cover all customer information inc. Azure products, support, global infrastructure etc. III : Cloud Ready website - Document area for all relevant information pack
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: From the application that uses Azure or through the Admin GUI. Vodafone may also be able to help you minimise the impact of off-boarding through our professional service capability.
• End-of-contract process: Customer must remove all of their data from the Platform notify Vodafone that they wish to terminate the Service. Vodafone will notify Customer of the date that the Service and any remaining data will be removed. It is Customer’s sole responsibility to remove their data from the Platform and Vodafone shall have no liability whatsoever for any of Customers data that remains on the Platform once Customer has notified Vodafone that Customer wishes to terminate the Service.
• Documentation accessibility standard: WCAG 2.2 AAA

Using the service

• Web browser interface: Yes
• Using the web interface: The Microsoft Azure public cloud provides a self-service web portal (Azure Resource Manager also known as ARM) and application programming interfaces (Azure Resource Management REST API) for the provision and management of Azure services. Both the API and web portal are available over the public Internet to Vodafone and our customers. Please note that the Azure classic portal is not provided as part of this product. https://docs.microsoft.com/en-us/azure/azure-resource-manager/
• Web interface accessibility standard: WCAG 2.2 AAA
• Web interface accessibility testing: It is accessible anywhere through an internet connection over HTTPs and end to end security can be assured by using Vodafone's secure networks.
• API: Yes
• What users can and can't do using the API: ***CHANGE*** The Microsoft Azure public cloud provides a self-service web portal (Azure Resource Manager also known as ARM) and application programming interfaces (Azure Resource Management REST API) for the provision and management of Azure services. Both the API and web portal are available over the public Internet to Vodafone and our customers. Please note that the Azure classic portal is not provided as part of this product. https://docs.microsoft.com/en-us/azure/azure-resource-manager/
• API automation tools:
  • Ansible
  • Chef
  • Puppet
• API documentation: Yes
• API documentation formats: HTML
• Command line interface: Yes
• Command line interface compatibility:
  • Windows
  • MacOS
  • Other
• Using the command line interface: Please visit; https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest

Scaling

• Independence of resources: Microsoft Azure has more global regions than any other cloud provider – offering the scale needed to bring apps closer to users around the world, preserving data residency and offering comprehensive compliance and resiliency options for customers.
• Usage notifications: Yes
• Usage reporting: Other
• Other usage reporting: Notified via the Azure Resource Manager
• Optimising consumption: No
• Automatic scaling: Yes

Analytics

• Infrastructure or application metrics: Yes
• Metrics types: Other
• Other metrics:
  • Broad set of global compute, storage, database analytic
  • Machine Learning and IoT
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: In Azure, organisations can encrypt data at rest without the risk or cost of a custom key management solution. Organisations have the option of letting Azure completely manage Encryption at Rest. Additionally, organisations have various options to closely manage encryption or encryption keys.; ; See: https://docs.microsoft.com/en-us/azure/security/azure-security-encryption-atrest; ; With regards to Billing, Provisioning and other customer metadata, it is understood that most of this data is not encrypted at rest.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Backup and recovery

• What’s backed up:
  • Replaces your existing on-premises or off-site backup solution
  • Azure Backup offers multiple components that you download and deploy
  • Back up data to a Recovery Services vault in Azure
• Backup controls: Backup applications need to be purchased by Azure portal. No Operational Support System (OSS) tooling is deployed (monitoring, backup, patch management and anti-malware).
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery:
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team
• Backup and recovery: Yes
• RPO/RTO: No

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Refer to Azure availability SLAs from here: https://azure.microsoft.com/en-gb/support/legal/sla/
• Approach to resilience: Microsoft Azure has more global regions than any other cloud provider – offering the scale needed to bring apps closer to users around the world, preserving data residency and offering comprehensive compliance and resiliency options for customers. An Azure Region is a set of data centres deployed within a latency-defined perimeter and connected through a dedicated regional low-latency network. With more global regions than any other cloud provider, Azure gives customers the flexibility to deploy apps where they need to. Azure is generally available in 42 regions around the world, with plans announced for 12 additional regions. Availability Zones are physically separate locations within an Azure region. Each Availability Zone is made up of one or more data centres equipped with independent power, cooling and networking. Availability Zones allow customers to run mission-critical apps with high availability and low-latency replication.; ; See: https://azure.microsoft.com/en-gb/global-infrastructure/regions/ for more information.
• Outage reporting: As part of the service offering you have access to Azure Service Health that provides personalised guidance and support when issues in Azure services affect you. It can notify you, help you understand the impact of issues and keep you updated as the issue is resolved. It can also help you prepare for planned maintenance and changes that could affect the availability of your resources.; ; Further information on Azure Service Health can be found here: https://azure.microsoft.com/en-gb/features/service-health/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: By default, Vodafone customers have no access to their Azure subscription and the CSP Partner (Vodafone) must grant the customer with access to the directory. The suggested subscription permissions will be using AoBo (Admin on Behalf of). Each Vodafone customer is provisioned each subscription with 1 Global Administrator which will be a separate account from the subscription owner. The customer is provisioned each subscription with 1 subscription owner which will be a separate account from the Azure AD Global administrator.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Vodafone policies align to ISO27002:2013

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Formal management responsibilities and procedures within Vodafone are in place to ensure satisfactory control of all changes. When changes are made, an audit log containing all relevant information is retained on the Vodafone change management system. Changes to operational systems are only made when there is a valid business reason to do so, such as an increase in the risk to the system.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: Cloud provider controls. Refer to https://docs.microsoft.com/en-us/azure/security-center/
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Vodafone has logging and monitoring capabilities in place along with appropriate storage of log data. The monitoring capability and events are managed and stored within the SIEM solution. The SIEM solution has been built in line with GPG13 DETER
• Incident management type: Undisclosed
• Incident management approach: Incident management processes are in line with ITIL best practice, and integrated with event, problem and change management processes.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Third-party
• Third-party virtualisation provider: Microsoft
• How shared infrastructure is kept separate: Please see our detailed Service Definition document (refer to Azure Shared responsibility model)

Energy efficiency

• Energy-efficient datacentres: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount

• Provide your minimum discount applicable to your baseline prices: 0%

Formula for calculating price of your services

• Formula for calculating price of your services:

  Which of the core deployment models you intend to offer

  Public Cloud

  Public Cloud - Formula for calculating price of your services

  ---

  Total Cost

  The Total Cost for a buyer's call off requirement in a Public Cloud Deployment

  =

  Baseline Pricing

  As per link below, which is also included in the service specific pricing document.

  Baseline Pricing - Web link

  https://aws.amazon.com/ec2/pricing/

  -

  Minimum Discounting

  0%

  +

  Onboarding Activity

  Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process

  +

  Additional sources of cost

  For IaaS compute services, Vodafone price these services in line with Hyperscaler recommended prices, which can be found in the link above as well as the service specific pricing document. These prices are subject to change by Hyperscaler but the Vodafone markup will remain the same for these services.

  -

  Additional sources of cost reduction

  For IaaS compute services, Vodafone price these services in line with Hyperscaler recommended prices, which can be found in the link above as well as the service specific pricing document. These prices are subject to change by Hyperscaler but the Vodafone markup will remain the same for these services.

  ---

• Total Cost: The Total Cost for a buyer's call off requirement in a Public Cloud Deployment
• Baseline Pricing: As per link below, which is also included in the service specific pricing document.
• Baseline Pricing - Web link: https://aws.amazon.com/ec2/pricing/
• Minimum Discounting: 0%
• Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
• Additional sources of cost: For IaaS compute services, Vodafone price these services in line with Hyperscaler recommended prices, which can be found in the link above as well as the service specific pricing document. These prices are subject to change by Hyperscaler but the Vodafone markup will remain the same for these services.
• Additional sources of cost reduction: For IaaS compute services, Vodafone price these services in line with Hyperscaler recommended prices, which can be found in the link above as well as the service specific pricing document. These prices are subject to change by Hyperscaler but the Vodafone markup will remain the same for these services.

Mandatory certifications

• Mandatory certifications:

  Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

  Reseller

  Cloud service suppliers you intend to resell with evidence

  Organisation 1

  Organisation name

  Amazon Web Services

  Website address/upload for organisation

  Website address

  Website address

  https://partners.amazonaws.com/partners/001E000000tfevOIAQ/Vodafone

  ISO 9001 certification

  Provided

  ISO 27001 certification

  Provided

  ISO 20000-1 certification

  Provided

  Are you reliant on the Cloud Service Provider for some accreditations

  Yes

Cyber Essentials

• Do you have a Cyber Essentials Plus certificate?: Yes
• Cyber Essentials Plus certificate Number: Af87bed1-45db-4396-b5a5-0703ffdc35ce

Non-mandatory Standards and certifications

• ISO 28000:2022 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: NCC Group Security Services Ltd
• PCI DSS accreditation date: Friday 6 December 2024
• What the PCI DSS doesn’t cover: This does not cover UC or Hosting - these are covered by separate certification.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks_team@vodafone.com. Tell them what format you need. It will help if you say what assistive technology you use.