COOLSPIRiT

COOLSPIRiT a Databarracks Company: GUARDiAN Backup-as-a-Service, Commvault Cloud and Metallic AI

GUARDiAN BaaS, a cloud-based solution
simplifies data protection, empowers users to safeguard valuable data assets and enjoy peace of mind in an increasingly data-driven world.

Powered by Commvault Cloud and Metallic AI, GUARDiAN BaaS is securely controlled in an easy-to-use self-service portal, protecting all your platforms and applications from anywhere.

Features

• Backup and Recovery for Hypervisors & Kubernetes
• Backup and Recovery for Database applications
• Backup and Recovery for File & Object
• Backup and Recovery for Endpoint & Active Directory
• Backup and Recovery for Microsoft 365
• Backup and Recovery for Microsoft Dynamics 365
• Backup and Recovery for Salesforce
• Backup and Recovery for Cloud storage
• Integral Security: Virtual Air-Gap, Immutability, Deception & Detection (Threatwise)

Benefits

• Reduce Operational Costs
• Save Time & Free Up Internal Resource
• Improve Security & Compliance
• Streamline Operations
• Assisted Recovery Testing, Software Configuration, Remote Management & Monitoring
• Automated Reporting, Capacity Planning, Quarterly Service Reviews
• GUARDiAN Support - Industry-Leading Master Accredited Expertise
• COOLSPIRiT Commvault Expert Certified Professional Services
• Complete Cyber Resiliency
• Ransomware Protection & Recovery

£1.33 a licence a month

• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@coolspirit.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

181335581515065

Contact

Alex Raben
01246 454 222
frameworks@coolspirit.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: N/A
• System requirements:
  • Network Connectivity & Bandwidth availability
  • Network Gateway Server

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Support including questions is targetted between 1 hour for critical severity to 24 hours for Low severity
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 A
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 A
• Web chat accessibility testing: N/A
• Onsite support: Yes, at extra cost
• Support levels: Support is included within the SaaS cost, with the following Targetted Response times; ; Critical Severity - 1 Hour; High Severity - 2 Hours; Medium Severity - 4 Hours; Low Severity - 24 Hours
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Commvault offer comprehensive product training and accreditations, delivered both onsite and remotely. Access is made available to Commvault's free online self paced training as well as the Commvault documentation
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
  • Other
• Other documentation formats:
  • PPTX
  • DOCX
• End-of-contract data extraction: Data can be restored from the Service to a choice of the customers choosing as long as access exists.
• End-of-contract process: At the end of the contract the Services are terminated preventing any further backups and recovery from the service...Where Storage has been selected as part of the service, all data will be removed from the storage service within 30 days of the termination date,

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Commvault provides an HTML frontend called Command Center which is supported on a number of different web browsers.
• Accessibility standards: WCAG 2.1 A
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: Commvault REST APIs represent operations that are performed in the CommCell Console. This is implemented on HTTP protocol for common programming language & tools. REST API also available for Datto so can be used for reporting
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Every user is provided with unlimited storage

Analytics

• Service usage metrics: Yes
• Metrics types: Consumption metrics are provided detailing peak daily, and monthly usage.; Job completion; SLA Met
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Metallic a Commvault venture

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: A variety of reports are available
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • PPTX
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Service Credits of 10% are offered for less than 99.9% availability, and 25% Services Credits is offered for less that 99% availability
• Approach to resilience: The Commvault Metallic Service is hosted in Microsoft Datacentres on Azure infrastructure and the physical security is provided by Microsoft. ; The following information is supplied by Microsoft and the full document can be accessed here https://docs.microsoft.com/en-us/azure/security/fundamentals/physical-security; ; Microsoft designs, builds, and operates datacentres in a way that strictly controls physical access to the areas where your data is stored. Microsoft understands the importance of protecting your data and is committed to helping secure the datacentres that contain your data. We have an entire division at Microsoft devoted to designing, building, and operating the physical facilities supporting Azure. This team is invested in maintaining state-of-the-art physical security.; ; Azure keeps your data durable in two locations. You can choose the location of the backup site. In both locations, Azure constantly maintains three healthy replicas of your data.; Database availability; Azure ensures that a database is internet accessible through an internet gateway with sustained database availability. Monitoring assesses the health and state of the active databases at five-minute time intervals.
• Outage reporting: Outages are communicated through the HTML Interface dashboard.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Other
• Other user authentication: OKTA
• Access restrictions in management interfaces and support channels: Metallic has built in Role Based Access Controls (RBACs) to restrict access to authorized users. A role is a collection of permissions administrators assign to users and entities to create a three-way security association. Roles can be assigned to grant appropriate access to any user or user group.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: 23/10/2023
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • CSA
  • ISO/IEC 27001:2013
  • SOC 2 Type II
  • FedRAMP High Compliant
  • FIPS 140-2
  • GDPR
  • HIPAA

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: SOC 2 Type II; FedRAMP High Compliant; FIPS 140-2; GDPR; HIPAA; https://metallic.io/trust
• Information security policies and processes: Cyber Essentials, Cyber Essentials Plus, ISO 27001 and SOC2 Type II compliant.; ; Security threat detection and response, zero trust authentication, zero trust access, virtual air-gap, immutability.; https://metallic.io/trust

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: At a minimum, the change control process includes the following steps: ; • All requests are logged; • Undergoes a preliminary review and is appropriately prioritized; • Authorized by appropriate personnel; • Requirements to implement the change are identified and analyzed; • Dependencies resulting from the change are identified; • Impact analysis to the current environment or business units assessed; • Change approach is identified and reviewed; • Change is tested in a controlled environment; • Acceptance of the change tested and approved; • Implementation and release of the change into production ; • Change process from initiation to post-implementation is documented
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Any vulnerability or threat detected through automated or manual scans must be remediated within the timeframes specified below: ; Critical - A week from detection date. If vulnerability is detected on a critical server/device, it should be remediated within 24- 48 hours. ; High - Within 2 weeks from Within a week if it is a Page Information Technology Vulnerability Management Policy 3 detection date critical server/device. ; Medium - Condition based remediation Medium vulnerabilities are not required to be remediated immediately. However, Information Security Team may upgrade the Severity level of vulnerability to High as necessary to ensure appropriate action is taken.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Cloud Alerts are standard Commvault Alerts that syncs to cloud.comvault.com. The feature is the framework for the Event Monitoring service. Event monitoring are based around the following purposes:; ; • Detect when Commvault is operating outside of the normal based on historic data and smart algorithms.; • Detect anomalies using machine learning/AI based code integrated into Commvault’s core.; • Detect thresholds, conditions and standard events that occur within Commvault.; • Detect CommCell events or exceeded thresholds; • Detect parameter and configuration changes in the Commvault software and its protected data; • Detect failures on various CommCell and Job based entities.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Commvault’s Incident Response Plan includes the following processes: ; ; • To protect information and information systems.; • To provide reporting incidents step-by-step.; • To detect attacks or intrusions.; • Restoration process to mitigate the effects of incidents and services.; • Closeout process for reporting and documenting lessons learned.; ; Our guidelines are flexible and unique shaped by the incident. Our IRP documents information about responding to incidents that can be used regardless of hardware platform or operating system. It describes the five stages of incident handling, with the focus on preparation, follow-up, including reporting guidelines and requirements with defined roles and responsibilities

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  As an organisation, COOLSPIRiT is wholly committed to improving our social & sustainability record and drive real change through to delivery of our contracts. We take great pride working with our supply chain and customers to understand how our services can be provided with reduced emissions seeking a net zero impact on our environment. We employ a number of activities / initiatives to help accelerate us towards our global population becoming carbon neutral, including, Partnering with World Land Trust to plant trees in Borneo, SME Climate Commitment, Working from solar-powered offices, Availability of electric car charge points, Electric-powered company vehicles, Upgrading to LED lighting throughout our offices, Eradicating the use of single-use plastic, Achieving ISO 14001 Certification, Supporting the 721 Challenge. We understand that our business has a direct impact on the environment, so we're actively working towards best practices in the technology sector. In regard to our Social Responsibility, we also thrive on making differences wherever possible, be it big or small, to help support the overall impact that organisations can have on our local communities. Initiatives we have in place include, Apprenticeships for local people, Employment skills structure, Supporting the community, Donations of technology equipment, Local collaboration, Sustainability and environmental focus, Supporting Charity. We're excited to have now partnered with the World Land Trust (Registered Charity No. 1001291) as a corporate supporter. The World Land Trust carries out essential reforestation projects, supporting conservation and creation of wildlife-rich habitats benefitting local communities, reconnecting forest areas, and storing carbon. In addition to the measures noted above we will automatically plant a tree for every contract placed with us. More information can be found on our website https://www.coolspirit.co.uk/

Pricing

• Price: £1.33 a licence a month
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: COOLSPIRiT offers a free of charge 30-day trial of any GUARDiAN BaaS, powered by Commvault Cloud and Metallic AI feature.
• Link to free trial: https://www.coolspirit.co.uk/guardian-backup-as-a-service

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@coolspirit.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.