Rackspace Managed VMC on AWS
Rackspace Managed VMC on AWS is the ideal solution for customers looking for a simplified path to a hybrid
cloud through VMC on AWS. Rackspace brings multi-cloud expertise, world-class account management and operations, including cross-platform billing, flexible payment options, proactive monitoring, market-leading SLAs, and 24x7x365 support.
Features
- 17 availability zones, 5 EU regions (including the UK)
- Elastic, web-scale computing made easier for developers
- Pay as you go infrastructure
- Architecture design, best practice advice & operating system management
- Tools to build failure resilient and scalable applications.
- Rapid capacity expansion, extending existing VMware infrastructure
- Infrastructure risk mitigation, use VMware Site Recovery for DR
- Rapid VDI expansion, use VMC to expand VMware Horizon VDI
- Pilot-light environments for warm DR
- Supports VMware HCX, seamless extension of on-premises environments
Benefits
- Ongoing Cloud Architecture Design to meet evolving needs
- 24x7x365 Operations to deploy and manage VMC & AWS efficiently
- Environment optimisation to improve cost, performance and scalability
- Quickly scale capacity, both up and down
- Comprehensive, cross service API audit logging and security (CloudTrail)
- Complies with 14 Cloud Security Principles to provide additional assurance
- 24x7x365 service desk
- Flexible service blocks to minimise cost while maximising service.
- Custom run books to optimise service operations
- Comprehensive incident management and service operations
Pricing
£11,556.34 a unit a month
Service documents
Request an accessible format
Framework
G-Cloud 13
Service ID
1 9 9 9 0 3 2 1 4 9 9 4 8 6 5
Contact
Rackspace Ltd
UK Public Sector Sales
Telephone: +44 (0)208 734 8107
Email: ukpublicsector@rackspace.com
Service scope
- Service constraints
- As part of contract negotiations, Rackspace will work with the customer to agree maintenance windows for pre-approved changes and patching.
- System requirements
- None
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
-
Priority One incidents are responded to within 15 minutes of the incident being logged, 24 hours a day, 7 days a week. Incidents are logged either by phone, email or the automated monitoring of infrastructure and applications.
Full details of the service response targets for incidents, changes and requests can be found in the terms and conditions. - User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- None or don’t know
- Phone support
- Yes
- Phone support availability
- 24 hours, 7 days a week
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
-
One of the primary ways that you can interact with Rackspace is by creating a ticket in the Rackspace Customer Portal
Incident response: All customer-submitted requests are automatically categorized as Standard requests. Rackspace will respond to your support requests in the following time frames:
Standard: If your site is functioning within acceptable parameters, but you require assistance in loading software or have a help desk–type question, Rackspace will respond to your request within four hours.
Urgent: If your server or site is accessible but in a reduced state (timeouts or slow response), Rackspace will respond to your support request within one hour.
Emergency: If you cannot access your server or site from the public internet, Rackspace will respond within 15 minutes.
Note: For requests that require an urgent or emergency classification, please call the 24x7x365 support line directly. - Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
-
Onboarding team assists Customer throughout the deployment process and transitions a finalised environment to ongoing support and account management. Each customer is assigned a customer success manager and deployment engineer (technical system administrator), who work with Customer in delivering the contracted solution.
These teams are available to Customer as needed throughout the onboarding process. During the deployment, Customer receives direct communication via scheduled meetings, email, phone calls, and Rackspace ticket updates. For new customers, Rackspace offers a walk-through of the Rackspace Customer Portal to help Customers become familiar with Rackspace ticketing services and notifications. Upon successful completion of the contracted solution, Customer has an opportunity to review and accept the new AWS environment.
More details on the options for onboarding can be found in the attached service design document. - Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
- Rackspace can facilitate onboarding and offboarding of AWS accounts from managed services and transfer the account under the customers own AWS agreement. For offboarding from AWS, it is dependant on which AWS services are used, Rackspace can assist in exporting data from the various services using AWS Snowball for large data transfers. Data may be copied out using OS-level tools (such as xcopy or rsync) or AWS APIs directly or with assistance from Rackspace.
- End-of-contract process
-
Buyer may terminate the relationship with the Supplier for any reason by (i) providing the Supplier with 30 days notice (as per call-off contract terms) and (ii) closing Buyers account for all services for which the Supplier provide an account closing mechanism.
Buyers pay for the services they use to the point of account termination.
The Supplier customers' retain control and ownership of their data. The Supplier will not erase customer data for 30 days following an account termination. This allows customers to retrieve content from the Supplier services so long as the customer has paid any charges for any post-termination use of the service offerings and all other amounts due.
In case, for any reasons, customers want to end their contract with Rackspace but continue to service with AWS, Rackspace can assist in transitioning a customer's account directly to AWS or the preferred AWS service provider.
Using the service
- Web browser interface
- Yes
- Using the web interface
- Almost all functionality for each of our services is exposed through the web console. The web console facilitates management for all aspects of the AWS account in a consolidated view whilst providing access to all services and their respective functionalities. In some cases, specific configuration parameters of a service are dedicated to, and only available from, the CLI, SDK, or API interface.
- Web interface accessibility standard
- None or don’t know
- How the web interface is accessible
- Customers can access the Rackspace Cloud Portal via secured internet, this supports dynamic page resizing. This portal will in turn sign in to AWS console associated with your AWS account
- Web interface accessibility testing
- No testing with users of assistive technology has been completed to date.
- API
- Yes
- What users can and can't do using the API
- All contracted AWS functionality can be accessed via an API.
- API automation tools
-
- Ansible
- Chef
- SaltStack
- Terraform
- Puppet
- Other
- Other API automation tools
-
- A range of 3rd party services hook into AWS APIs
- SDKs for Python, Ruby, PHP, JavaScript, Java, .NET, Node.js
- API documentation
- Yes
- API documentation formats
-
- HTML
- Other
- Command line interface
- Yes
- Command line interface compatibility
-
- Linux or Unix
- Windows
- MacOS
- Using the command line interface
- All AWS functionality is available via the CLI.
Scaling
- Scaling available
- Yes
- Scaling type
- Automatic
- Independence of resources
-
Customer environments are logically segregated to prevent users and customers from accessing resources not assigned to them.
Services which provide virtualized operational environments to customers (i.e. EC2) ensure that customers are segregated via security management processes/controls at the network and hypervisor level.
AWS continuously monitors service usage to project infrastructure needs to support availability commitments/requirements. AWS maintains a capacity planning model to assess infrastructure usage and demands at least monthly, and usually more frequently. In addition, the AWS capacity planning model supports the planning of future demands to acquire and implement additional resources based upon current resources and forecasted requirements. - Usage notifications
- Yes
- Usage reporting
-
- Other
Analytics
- Infrastructure or application metrics
- Yes
- Metrics types
-
- CPU
- Disk
- HTTP request and response status
- Memory
- Network
- Number of active instances
- Other
- Other metrics
-
- AWS resources: e.g. Amazon EC2/Amazon RDS DB instances, DynamoDB tables
- Custom metrics generated by customers’ applications and services
- Metrics associated with log files generated by the application
- Reporting types
-
- API access
- Real-time dashboards
- Regular reports
Resellers
- Supplier type
- Reseller providing extra features and support
- Organisation whose services are being resold
- Amazon Web Services (AWS), VMware
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- None
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
-
- United Kingdom
- European Economic Area (EEA)
- Other locations
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Supplier-defined controls
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- ‘IT Health Check’ performed by a CHECK service provider
- Protecting data at rest
- Other
- Other data at rest protection approach
-
AWS adheres to independently validated privacy, data protection, security protections and control processes.
AWS is responsible for the security of the cloud; Rackspace provides guidance and resources to assist security in the cloud for the customers.
AWS enables customers to control their content (where it will be stored, how it will be secured in transit or at rest, how access to their AWS environment will be managed).
Wherever appropriate, we offer customers options to add additional security layers to data at rest, via scalable and efficient encryption features. AWS offers flexible key management options and dedicated hardware-based cryptographic key storage. - Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Hardware containing data is completely destroyed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Backup and recovery
- Backup and recovery
- Yes
- What’s backed up
-
- Machine Image
- Volume / Block Volume
- Cross-region replication; bucket versioning, lifecycle rules
- Files on EFS
- Tables and data
- Directory Snapshot
- Logs/Config Logs(to S3)
- Code download
- Backup controls
- Manual or scheduled API call and Rackspace EBS-Snapper (Lambda) based capability for scheduled EBS snapshots. Customers can define backup coverage as part of the initial service design. Any changes to standard backup schedules may incur additional charges.
- Datacentre setup
- Multiple datacentres with disaster recovery
- Scheduling backups
- Users schedule backups through a web interface
- Backup recovery
- Users can recover backups themselves, for example through a web interface
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Bonded fibre optic connections
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Legacy SSL and TLS (under version 1.2)
- Other
- Other protection within supplier network
-
Customer environments are logically segregated to prevent users and customers from accessing resources not assigned to them. AWS gives customers ownership and control over their content by design through simple, but powerful tools that allow customers to determine how their content will be secured in transit.
AWS enables customers to open a secure, encrypted channel to AWS services using TLS, and/or IPsec or TLS VPN (if applicable), or other means of protection the customer wish to use.
API calls can be encrypted with TLS to maintain confidentiality; the AWS Console connection is encrypted with TLS.
Availability and resilience
- Guaranteed availability
-
AWS currently provides SLAs for several services. Due to the rapidly evolving nature of AWS’s product offerings, SLAs are best reviewed directly on their website via the links below:
• Amazon EC2 SLA: http://aws.amazon.com/ec2-sla/
• Amazon S3 SLA: http://aws.amazon.com/s3-sla
• Amazon CloudFront SLA: http://aws.amazon.com/cloudfront/sla/
• Amazon Route 53 SLA: http://aws.amazon.com/route53/sla/
• Amazon RDS SLA: http://aws.amazon.com/rds-sla/
• AWS Shield Advanced SLA: https://aws.amazon.com/shield/sla/
Well-architected solutions on AWS that leverage AWS Service SLA’s and unique AWS capabilities such as multiple Availability Zones, can ease the burden of achieving specific SLA requirements - Approach to resilience
-
Rackspace will work with customers to understand their disaster recovery/resilience requirements, and will architect a solution designed to meet the defined recovery time / point objectives.
The AWS Business Continuity plan details the process that AWS follows in the case of an outage, from detection to deactivation. AWS has developed a three-phased approach: Activation and Notification Phase, Recovery Phase, and Reconstitution Phase. This approach ensures that AWS performs system recovery and reconstitution efforts in a methodical sequence, maximizing the effectiveness of the recovery and reconstitution efforts and minimizing system outage time due to errors and omissions.
AWS maintains a ubiquitous security control environment across all regions. Each data centre is built to physical, environmental, and security standards in an active-active configuration, employing an n+1 redundancy model, ensuring system availability in the event of component failure. Components (N) have at least one independent backup component. In case of failure, there is sufficient capacity to enable traffic to be load-balanced to the remaining sites.
AWS provides a robust continuity plan, including the utilization of frequent server instance back-ups, data redundancy replication, and the flexibility to place instances and store data within multiple geographic regions across multiple Availability Zones. - Outage reporting
- Public dashboard; personalised dashboard with API and events; configurable alerting (email / SMS / messaging).
Identity and authentication
- User authentication
-
- 2-factor authentication
- Identity federation with existing provider (for example Google apps)
- Username or password
- Other
- Other user authentication
-
AWS controls access via unique user ID/password authentication. No actions are permissible without authentication. Remote access is multi-factor, login attempts are limited, remote administrative access attempts are logged and reviewed by Security. Suspicious activity initiates incident response procedures.
A session lock out policy that is systematically enforced: locks are retained until identification/authentication procedures are concluded.
AWS’s Identity and Access Management (IAM) system controls access to AWS services/resources. IAM facilitates the issuance of access permissions per user/group. MFA is available at no extra cost. - Access restrictions in management interfaces and support channels
-
IAM provides user access control to AWS services, APIs and specific resources. Other controls include time, originating IP address, TLS use, and whether users authenticated via MFA devices.
API calls to launch/terminate instances, change firewalls, and perform other functions are signed by customers’ Amazon Secret Access Key (either the root AWS Account’s Secret Access Key or the Secret Access key of a user created with AWS IAM). Amazon EC2 API calls cannot be made on customers’ behalf without access to customers’ Secret Access Key.
API calls can be encrypted with TLS for confidentiality and customers can use TLS-protected API endpoints. - Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Dedicated link (for example VPN)
- Username or password
- Devices users manage the service through
- Dedicated device on a segregated network (providers own provision)
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- At least 12 months
- Access to supplier activity audit information
- Users have access to real-time audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- At least 12 months
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- British Standards Institute (BSI) Certificate reference: IS 636168
- ISO/IEC 27001 accreditation date
- 21/10/2021
- What the ISO/IEC 27001 doesn’t cover
- Software development controls are excluded and some international office space is not in scope.
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- Yes
- Who accredited the PCI DSS certification
- Protiviti
- PCI DSS accreditation date
- 31/07/2021
- What the PCI DSS doesn’t cover
- Services outside the scope of our managed dedicated cloud, managed public cloud and managed security.
- Cyber essentials
- No
- Cyber essentials plus
- Yes
- Other security certifications
- Yes
- Any other security certifications
-
- Cyber Essentials Plus
- SOC 1/2/3
- ISO 27017
- ISO 27018
- ISO 9001
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
-
- ISO/IEC 27001
- Other
- Other security governance standards
- Cyber Essentials Plus; ISO 27017; ISO 27018; SOC 1/2/3
- Information security policies and processes
-
AWS implements formal, documented policies and procedures that provide guidance for operations and information security within the organisation. Policies address purpose, scope, roles, responsibilities and management commitment.
Employees maintain policies in a centralised and accessible location. AWS Security Assurance is responsible for familiarizing employees with the AWS security policies.
AWS has established information security functions that are aligned with defined structure, reporting lines, and responsibilities. Leadership involvement provides clear direction and visible support for security initiatives.
The output of AWS Leadership reviews include any decisions or actions related to:
• Improvement of the effectiveness of the ISMS.
• Update of the risk assessment and treatment plan.
• Modification of procedures and controls that affect information security to respond to internal or external events that may impact the ISMS.
• Resource needs.
• Improvement in how the effectiveness of controls is measured.
Policies are approved by AWS leadership at least annually or following a significant change to the AWS environment.
Operational security
- Configuration and change management standard
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Configuration and change management approach
-
Changes to AWS services and features follow secure software development practices, including security risk reviews prior to launch. Developer access to production environments is via explicit access system requests, subject to owner review and authorisation. All production environment changes are reviewed, tested and approved. Stages include design, documentation, implementation (including rollback procedures), testing (non-production environment), peer to peer review (business impact/technical rigour/code), final approval by authorised party.
All customer related changes will be managed through Rackspace change management systems. Rackspace will manage the change as scheduled, keeping you fully informed on progress. - Vulnerability management type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Vulnerability management approach
-
AWS Security performs vulnerability scans on the host operating system, web applications, and databases in the AWS environment. Approved 3rd party vendors conduct external assessments (minimum frequency: quarterly). Identified vulnerabilities are monitored and evaluated. Countermeasures are designed and implemented to neutralise known/newly identified vulnerabilities.
AWS Security monitors newsfeeds/vendor sites for patches and receives customer intelligence via http://aws.amazon.com/security/vulnerability-reporting/.
AWS customers are responsible for all scanning, penetration testing, file integrity monitoring and intrusion detection for their Amazon EC2 and Amazon ECS instances/ applications. Scans should include customer IP addresses (not AWS endpoints). AWS endpoint testing is part of AWS compliance vulnerability scans. - Protective monitoring type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Protective monitoring approach
-
Rackspace will confirm any monitoring requirements in addition to our default configuration. Your account manager will provide guidance and consultation around best practices. AWS deploys (pan-environmental) monitoring devices to collect information on unauthorized intrusion attempts, usage abuse, and network/application bandwidth usage. Devices monitor:
• Port scanning attacks
• Usage (CPU, processes, disk utilization, swap rates, software-error generated losses)
• Application metrics
• Unauthorized connection attempts
Requests to AWS KMS are logged and visible via the account’s AWS CloudTrail Amazon S3 bucket. Logs provide request information, under which CMK, and identify the AWS resource protected through the CMK use. - Incident management type
- Supplier-defined controls
- Incident management approach
- Rackspace will apply a consistent approach to all incidents, except where a specific approach is agreed upon with you in accordance with your custom runbook. Incidents can be initiated by either: Named customer contacts, Rackspace, Event management tools (e.g., Rackspace Watchman or AWS CloudWatch). All incidents are logged in tickets accessible via the AWS Control Panel. Rackspace Support teams will investigate the incident in accordance with the agreed service level. Rackspace support will carefully review instructions on your account, will communicate regularly with you throughout the incident and may escalate the incident at any time until resolution is achieved.
Secure development
- Approach to secure software development best practice
- Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)
Separation between users
- Virtualisation technology used to keep applications and users sharing the same infrastructure apart
- Yes
- Who implements virtualisation
- Supplier
- Virtualisation technologies used
- Other
- Other virtualisation technology used
- Different instances running on the same physical machine are isolated from each other via the Xen hypervisor. AWS is active in the Xen community, which provides awareness of the latest developments. In addition, the AWS firewall resides within the hypervisor layer, between the physical network interface and the instance's virtual interface. All packets must pass through this layer, thus an instance’s neighbours have no more access to that instance than any other host on the Internet and can be treated as if they are on separate physical hosts. The physical RAM is separated using similar mechanisms.
- How shared infrastructure is kept separate
-
Customer environments are logically segregated, preventing users and customers from accessing unassigned resources. Customers maintain full control over their data access. Services which provide virtualized operational environments to customers, ensure that customers are segregated and prevent cross-tenant privilege escalation and information disclosure via hypervisors and instance isolation.
Different instances running on the same physical machine are isolated from each other via the Xen hypervisor. The Amazon EC2 firewall resides within the hypervisor layer, between the physical network interface and the instance's virtual interface. All packets pass through this layer. The physical random-access memory (RAM) is separated using similar mechanisms.
Energy efficiency
- Energy-efficient datacentres
- Yes
- Description of energy efficient datacentres
- Customer environments will be hosted in AWS European DCs and so will meet EU energy efficiency standards.
Social Value
- Fighting climate change
-
Fighting climate change
Rackspace has committed to achieving net zero carbon emissions by 2045. This is five years ahead of the UN Paris Agreement on Climate Change ambition to limit the global warming of the planet to 1.5 degrees Celsius, compared to pre-industrial levels. We have begun the process of automating our large facilities with smart, energy-saving features that, so far, have resulted in a 2,000-kilogram reduction of C02 in our main office in UK, in Hayes. We have assembled a cross-functional team to define our ESG-related goals more clearly so we can better measure our impact in the future. We have also invested in and are deploying smart building automation systems in five locations globally and three data centres, both including London. These systems will drive reduced energy consumption in each of these locations, through building control systems that provide the ability to efficiently manage light, heat and cooling zones based on operational demand. - Covid-19 recovery
-
Covid-19 recovery
We have evolved physical health programmes and developed new mental and emotional wellness programs to better serve and support our Rackers, as we recover from COVID. In addition, we began to look for ways we could help those organisations that support our communities. To that end, we initiated our first company-wide donation match program, matching Racker donations to COVID-19 relief organisations and other non-profit organisations that provide valuable services and support to local communities. During this two-week campaign, Rackspace and its employees donated more than £152,000 toward the COVID-19 relief efforts of over 360 organisations around the globe. - Tackling economic inequality
-
Tackling economic inequality
At the core of every Racker (Rackspace employee) is a drive to leave the world better than we found it and we are passionate about giving back to our communities across the globe. While Rackers can leverage paid volunteer time off for any cause, our Rack Gives Back programme creates opportunities for Rackers to give our time and talent to others. So far we have donated 27,000 hours to charity.
One of the many examples of Rackspace tackling economic inequality is our head office location, which we call “The Castle”. The building was an abandoned shopping mall in a run-down neighbourhood. Rackspace took over the mall and converted it into our head office, bringing employment opportunities and much needed economic vibrancy to the area. Rackspace offers community support programs including big brother and big sister (a mentoring programme) and regular charity drives for local causes. - Equal opportunity
-
Equal opportunity
Having a diverse workforce – made up of team members who bring a wide variety of skills, abilities, experiences and perspectives – is essential to Rackspace’s success. We are committed to the principles of equal employment opportunity, inclusion and respect. We do not tolerate discrimination against anyone – team members, customers, business partners, or other stakeholders – on the basis of race, colour, religion, national origin, sex (including pregnancy), age, disability, sexual orientation, gender identity, marital status, past or present military service, or any other status protected by the laws or regulations in the locations where we operate. We provide equal employment opportunity to everyone who is legally authorised to work in the applicable country. We provides reasonable accommodations to individuals with disabilities and removes any artificial barriers to success.
Rackspace has also introduced a number of initiatives to help working parents and allow the sometimes disadvantaged to thrive in our workplace with flexible hours and other support specifically designed for working parents. - Wellbeing
-
Wellbeing
Rackspace has a number of wellbeing programs in place to keep our teams healthy. We have invested in this area additionally over the COVID period, since it is widely viewed that the isolation introduced through lockdown has introduced new challenges for some of our teams. We offer a comprehensive employee assistance programme (EAP) providing Rackers with access to confidential professional support with any of the following challenges: depression, anxiety and mental health, family or relationship problems, improving work life balance, financial or legal problems, child or elder care challenges. We have a monthly wellbeing challenge (The Racker Recharge), which is a fun competition with a small prize focused on a particular area of wellbeing. The purpose of the challenge is to build awareness of heathy practices and build good habits in our teams. As an example, March’s challenge was on nutrition, hydration and sleep.
One of our core values is compassion – we are one team doing the right thing for our customers, communities and each other. In many of our locations we offer discounted membership to local gyms to allow Rackers to keep their bodies as fit as their brains.
Pricing
- Price
- £11,556.34 a unit a month
- Discount for educational organisations
- No
- Free trial available
- No