boxxe VMware Horizon Subscription

Service scope

Software add-on or extension: No
Cloud deployment model: Hybrid cloud
Service constraints: To use the Horizon subscription offering, you must manage your own VMware
SDDC-based infrastructure capacity, whether that capacity is in your own onpremises environment or in a hosted environment. To connect a Horizon
environment (whether in your VMware SDDC-based on-premises
environment or in a hosted environment) to the Horizon Cloud control plane,
you must deploy the Horizon Cloud Connector, which is a virtual appliance
that pairs with the Horizon Cloud control plane and creates an appropriately
configured cloud-connected “Horizon Pod” (or “Pod”).
System requirements: You must manage your own VMware SDDC-based infrastructure capacity

Customer must provide anti-virus system licensing on their own

Please visit https://via.vmw.com/EhIO for more details

User support

Email or online ticketing support: Email or online ticketing
Support response times: Please refer to our website for support details:
https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/support/vmwareseverity-definitions-response-time-business-hours-datasheet.pdf ● Production Support
details can be reviewed directly by visiting:
https://www.vmware.com/support/services/production.html ○ Production Support
Overview: ○ Available by Region ○ 24x7 support for Severity 1 issues ○ Unlimited number of
Support Requests ○ Up to 6 Administrators ○ Online access to documentation and technical
resources, knowledge base, discussion forums ○ Cloud updates
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: VMware supports software components of VMware Horizon Subscription that are hosted by
VMware in the cloud. It includes support for the deployment of the Pod, VDI-Desktops, RDSdesktop and remote application availability, access to the components in the Horizon Cloud
Service cloud control plane, and the software components of VMware Horizon Cloud
Service ● Production Support details can be reviewed directly by visiting:
https://www.vmware.com/support/services/production.html ○ Production Support
Overview: ○ Available by Region ○ 24x7 support for Severity 1 issues ○ Unlimited number of
Support Requests ○ Up to 6 Administrators ○ Online access to documentation and technical
resources, knowledge base, discussion forums ○ Cloud updates
Support available to third parties: Yes

Onboarding and offboarding

Getting started: For IT Admins, extensive training and support is provided to help ensure a
successful deployment. This training is conducted by a dedicated
deployment team with support from our solution architecture group.
Customers are responsible for training their end users in how to use the
View clients. Documentation is available on VMware.com, and the clients
are very simple to use.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: Users have a variety of ways to extract the data via third-party tools such
as Data Backup, File Shares or by using USB Drive Redirection or Client
Drive Redirection to copy files from the VDI Desktop to an on-premises
location
End-of-contract process: Full termination of the Horizon Subscription service due to contract
expiration, termination, cancellation, or any other cause will result in
permanent loss of access to the environments, discontinuation of
account services, and a deletion of such environments, configurations
and data according to VMware’s internal data retention policy. Prior to
terminating the Horizon Subscription service we would recommend that
all data be removed by the customer from the desktops and platform.
VMware take no responsibility for backing up or retaining customer data

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome
Application to install: Yes
Compatible operating systems: Android

IOS

MacOS

Windows

Other
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Horizon Subscription supports mobile access with the use of the Horizon Client
or HTML 5 from a supported browser. Features specific for mobile devices
include easy navigation and access to program and user's files called unity
touch, external keyboards, native gestures, onscreen keyboard and external
monitor support. The VMware Horizon HTML Access client does not support
certain features when used in mobile browsers. See features listed in the note
on this topic page in the VMware Horizon HTML Access User Guide 4.10:
docs.vmware.com/en/VMware-Horizon-HTML-Access/4.10/html-accessuser/GUID-20F0C9F6-7DE9-4D3D-8095-391C9F795F54.html . For more
information, see the VMware Horizon HTML Access documentation topic at
docs.vmware.com/en/VMware-Horizon-HTML-Access/4.10/html-accessinstallation/GUID-649151B0-070F-463B-B7FD-12B500973BF0.html.
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: The Service Offering includes access to two self-service consoles: VMware
Account Management Console (“VMware Customer Connect”) provides access
to subscription status, integrating navigation, viewing and management of all
VMware product licenses and support under a single account. It also allows you
to download the Horizon Cloud software components such as Agents, etc.
VMware Horizon Cloud Manager (“Console”) is the primary interface for
consumption and management of the Service Offering, including domain
binding, gold pattern management, desktop provisioning, application
provisioning, user customization provisioning, end user entitlement, and other
management operations.
Accessibility standards: None or don’t know
Description of accessibility: VMware is dedicated to support customers to make VMware products and
technologies accessible to people with disabilities. However, Horizon Cloud
Service has not undergone an accesibility assesment at this time
Accessibility testing: Please visit https://www.vmware.com/uk/help/accessibility.html for an
overview of the accessibility testing conducted on the various VMware products
and services at this time
API: Yes
What users can and can't do using the API: Horizon Subscription customers can use administrative credentials to
programmatically (via REST API) instruct any action that is available via the
Horizon Administration Console. That includes but is not limited to provisioning
and changing pools, entitling users to pools, and extracting reporting
information. Documentation is available upon request. There is no test
environment for the API.
API documentation: Yes
API documentation formats: PDF

Other
API sandbox or test environment: No
Customisation available: No

Scaling

Independence of resources: Scalability of the solution is contingent on how you choose to
deploy the solution, whether in your on-premises
environment or in a hosted environment

Analytics

Service usage metrics: Yes
Metrics types: Use the console's Reports page to access various reports related to
end users' desktop and application sessions that are provided by
your Horizon Cloud tenant. Specific reporting varies depending on
which monitoring method customer administrators choose to
implement Please visit https://docs.vmware.com/en/VMwareHorizon-Cloud-Service/services/hzncloudmsazure.admin15/GUID0723415B-F6D1-439B-B4F8-3FEB05CB1904.html#how-to-exportdata-for-a-sessions-vdi-applications-usage-or-user-usage-report-1 for
additional details
Reporting types: API access

Real-time dashboards

Regular reports

Reports on request

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: None

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with SSAE-16 / ISAE 3402
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: In-house destruction process

Data importing and exporting

Data export approach: Users can export their data using USB Drive Redirection or Client Drive
Redirection which is part of Horizon Cloud Users have a variety of ways to
extract the data via 3rd party tools such as Data Backup, File Shares or by
using USB Drive Redirection or Client Drive Redirection to copy files from the
VDI Desktop to an on-prem location.
Data export formats: CSV

Other
Other data export formats: Export or print data from the Service Center user interface:

Export to CSV, Excel or PDF formats

Import templates from Horizon View with Helpdesk Console

Tool includes three folders (export, repos, software) and five files:

Hvexport.bat

Hvexport.jar

Hvexport.sh

ImgUploadSvc.conf

Readme.txt
Data import formats: Other
Other data import formats: Import desktop templates from Horizon View

Tool includes three folders (export, repos, software) and five files

Hvexport.bat

Hvexport.jar

Hvexport.sh

ImgUploadSvc.conf

Readme.txt

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

Other
Other protection between networks: External access includes the use of VMware Unified Access Gateway to provide
secure edge services. The Horizon Client authenticates to a Connection Server
through the Unified Access Gateway. The Horizon Client then forms a protocol
session connection, through the gateway service on the Unified Access
Gateway, to a Horizon Agent running in a virtual desktop or RDSH server
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability: 99.9% SLA - Additional information is available here:
https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/support/vmwarehorizon-cloud-on-azure-service-level-agt.pdf
Approach to resilience: The Horizon Cloud Control Plane which is the VMware maanged component of a Horizon
Subscription deployment is designed for high availability through dedicated hardware and
services per tenant. More information is available on request. - The Horizon Cloud service has a
99.9% uptime
https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/downloads/eula/vmweuc-consolidated-service-level-agreement.pdf
Outage reporting: https://status.horizon.vmware.com - Customers can optionally subscribe to updates

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password

Other
Other user authentication: Horizon Subscription is integrated and tied to a customer's Active
Directory environment. End Users authenticate with their credentials along
with optional 2FA. Administrators can also use 2FA for authentication to
the Administration Console. - Authenticate access via identity provider
when Horizon Cloud is integrated with Workspace ONE
Access restrictions in management interfaces and support channels: Access management controls for VMware personnel aligns to PCI
standards. Access controls for customer administrators is outlined by
visitng https://docs.vmware.com/en/VMware-Horizon-CloudService/services/hzncloudmsazure.admin15/GUID-1DD4F3A7-E3CB4786-A2D4-C356C0EDA9CE.html
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Schellman
ISO/IEC 27001 accreditation date: May 4, 2018
What the ISO/IEC 27001 doesn’t cover: The scope of the ISO/IEC 27001:2013 certification is limited to the information security management system (ISMS) supporting the
management of the infrastructure and services used to support VMware’s in-scope cloud services and in accordance with the statement of
applicability version 1.8, dated June 9, 2021, and aligned to the control sets in ISO/IEC 27017:2015 and ISO/IEC 27018:2019. Assets within the
scope of the ISMS include information, software, databases, hardware, and employees supporting the in-scope VMware cloud services.
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 25/03/ 2022
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: VMware provides CAIQ listings for a number of services. Listings specific to VMware can be found by visiting
https://cloudsecurityalliance.org/star/registry/vmware-inc/ Horizon Cloud Control Plane, which is the VMware-managed component in a Horizon
Subscription offering is available by visiting https://cloudsecurityalliance.org/star/registry/vmware-inc/services/horizon-cloud-control-plane/
PCI certification: Yes
Who accredited the PCI DSS certification: 360 Advanced
PCI DSS accreditation date: June 2018
What the PCI DSS doesn’t cover: For a comprehensive understanding of the PCI DSS certification, please refer to the PCI AOC by visiting
https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/cloud/Horizon%20Cloud%20Control%20Plane%20PCI%20AOC.pdf
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: SOC2 type 2

ISO 270017

ISO 270018

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: No
Security governance approach: We model our security framework using the NIST SP 800-53
and ISO 27001 guidelines. - We have an Information Security
Governance Committee (ISGC) that is chaired by members of
senior management and representatives from our Information
Security, IT Operations, HR, Marketing, Facilities and Legal
teams.
Information security policies and processes: - Our Information Security Program is modeled using industry
best practices and regulatory standards, including NIST SP
800-53 and ISO 27001. We maintain our own Information
Security Program and Policies to protect customer data
hosted in our systems and perform annual reviews and audits
of our program to ensure the integrity of our hosted offering. --
The VMware Information Security team manages the
enforcement, development, and maintenance of information
security policies and standards to ensure VMware Information
Assets are preserved in a security environment, in accordance
with generally accepted best practices, focusing on VMware
business and risk objectives. The VMware Information
Security Team is responsible for updating policies as threats
and technologies change, initiating and managing periodic
reviews of the information security policies and standards, as
well as evaluating exceptions to information security policy
and standards. -- Our Information Security team oversees
organizational compliance while team leads in conjunction
with IT and HR teams help enforce department-level
compliance.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Our Change Management process for updating the solution is executed
according to our standard internal change management policy. The
process involves completion and submission of change control forms,
review and analysis of the change by the appropriate operations teams
and scheduling of the update or change according to its severity level. All
changes undergo our standard testing and validation process. If for any
reason a change is unsuccessful or does not pass the required testing
phases, our teams execute a fallback plan as documented in the change
control form.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: VMware has a Vulnerability Management program backed by approved
and tested policies and procedures. Vulnerability scans are performed
regularly on internal and external systems.System and application
owners are required to address critical/high vulnerabilities with a plan of
corrective action within 5 days of discovery.Other vulnerabilities need to
be addressed with a plan of corrective action within a reasonable
timeline.Risk analysis/acceptance are performed on vulnerabilities to
confirm the vulnerability and determine the appropriate means of
addressing it. Senior management and IT and Information Security senior
management are required to approve the existence of risks associated
with vulnerabilities that are not patched.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: Our cloud support staff have configured the system to notify IT personnel
if the central processing unit (CPU) utilization is too high, disk space
limited, memory issues, key service failures, bandwidth utilization, power
consumption, or other performance items. - IT Operations has
subscriptions to pertinent vendor security and bug-tracking mailing lists.
- After analyzing the severity and impact, network, utility and security
equipment is patched or upgraded.
Incident management type: Supplier-defined controls
Incident management approach: -In the unlikely event of an incident, we follow a formal Incident
Management Plan that is maintained as part of our Information Security
Program. Incidents and breaches are reported to the appropriate Cloud
Operations team for categorization and resolution, and issues are
escalated to senior management according to a pre-defined protocol
(e.g., if the incident is categorized as "Urgent"). Alerts, responses and
resolutions are tracked through to completion, and a post mortem report
is prepared for review by internal stakeholders and our Information
Security Governance Committee.

Secure development

Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Equal opportunity
Wellbeing

Fighting climate change

boxxe is committed to supporting environmental protection and improvement and to delivering and influencing environmentally conscious solutions to address the critical issue of climate change, focusing on achieving net zero greenhouse gas emissions and influencing all stakeholders towards environmental protection and improvement.
Our latest Carbon Reduction Plan, available on our website confirms we are carbon neutral across all sources of emissions through investing in the Carbon Exchange-Traded Commodity. We aim to reach Net Zero by 2050 at the latest through emissions reduction initiatives e.g. renewable electricity procurement and supplier engagement.
Environmental protection is embedded in everything boxxe does and offers and we are proud to have been named as a finalist in the Best Value Chain Initiative category at the CRN Sustainability in Tech Awards 2024.
We maintain an accredited ISO 14001 Environmental Management System covering the entire scope of our business, and our goal is to be recognized as the UK’s most sustainable IT reseller and service provider.
boxxe is committed to adopting, promoting, and implementing the principles of a Circular Economy and have developed a Circular Management Plan which articulates our strategy for waste minimisation and the enhancement of material reuse and recycling in our operations and the products we supply. This underscores our dedication to environmental stewardship, resource efficiency, and sustainable growth, driven by innovative and accountable resource and waste management practices.
We ensure that our supply chain is aware of and understand our environmental policies and we work with them to manage and continuously improve their environmental performance. We prioritise the purchase of recycled, recyclable, or re-furbished products and materials where these alternatives are available, economical, and suitable.
We conform to WEEE regulations and seek to sustainably reduce, reuse, and recycle, to ensure we and our customers minimise the impact of IT waste on the environment.

Covid-19 recovery

The COVID-19 pandemic fundamentally changed boxxe’s ways of working, leading us to implement a fully remote workforce to maintain customer service and operational functionality during the crisis. This transition enabled us to develop and implement a "Work from Anywhere in the UK" policy. By allowing our employees to work from any location, we have broadened our recruitment reach, enabling us to attract the best talent regardless of their geographic location. This approach has reduced barriers to inclusion, enhanced employee retention, and supported a healthier work-life balance. Additionally, remote recruitment strategies have allowed us to target candidates from areas particularly impacted by Covid-19, thereby positively contributing to their local economic recovery.
Recognising the significant skills shortages highlighted by the pandemic within the IT industry, we have taken proactive steps to retain and enhance our workforce's capabilities. We encourage continuous training and development in our employees' respective fields of expertise. Experienced staff and external specialists provide mentoring, offering a hands-on learning experience that ensures the effective application of newly acquired skills. Moreover, we are committed to inspiring the next generation by inviting local youth to experience the day-to-day life of our tech teams and organising regular hackathons and think tanks for soon-to-be graduates, providing them with career guidance.
Building on our pandemic experiences, we have developed a robust business continuity plan, ensuring that we are well-prepared to maintain uninterrupted service in the event of a similar crisis. It is worth noting that during the height of COVID-19, our strategies allowed us to maintain seamless business operations, underscoring our resilience and adaptability in challenging times. This foundation not only prepares us for future challenges but also reinforces our commitment to innovation and excellence in a post-pandemic world.

Tackling economic inequality

boxxe is committed to addressing disparities in employment, skills, and pay within our workforce and across our supply chain. Our ‘Work from Anywhere in the UK’ policy allows us to recruit the best talent regardless of their geographic location, removing barriers to inclusion, improving retention, and promoting a healthier work-life balance. By enabling staff to work remotely, we foster collaboration and create more equitable opportunities for all potential and current boxxe employees.
To address the skills shortages in tech industry, we invest in our staff’s continuous in-work skills development, facilitating career progression and helping retain talent. All staff have access to on-demand learning opportunities, available irrespective of role or seniority. We provide funding for a variety of training programs: specialist vendor/industry accreditations and professional qualifications. Experienced staff provide mentoring, ensuring that newly acquired skills are applied effectively.
We are dedicated to maintaining a robust and diverse supply chain by actively supporting SMEs, startups, and specialist suppliers. We invite these partners to collaborate with us, providing them with a route to market and guidance on best practices in industry and environmental, social, and governance (ESG) standards. Moreover, we have created the boxxe Community, where every employee can contribute 11½ days each year to support community and social value activities. We prioritise a local-first approach to giving, ensuring that support reaches grassroots charities and local causes where it is needed most. This includes our involvement in the 'Graduation to Employment' programme where experienced personnel volunteer to provide career coaching to university graduates.
Through the boxxe Academy, we offer apprenticeships and seasonal internships to encourage the next generation into IT. We welcome interns and apprentices to our customer service, HR, service delivery, and service delivery teams, providing them with all-round experience to kick-start a career in tech.

Equal opportunity

Equal opportunities, and our dedication to DEI are rooted in our mission to Making Tech Human.
boxxe is committed to a workforce that reflects diverse populations with the skills to drive a compassionate and inclusive culture and a genuine sense of belonging. We embed inclusivity, celebrate uniqueness, and foster collaboration to eradicate inequalities in employment, skills, and pay in our workforce and our supply chain.
Recruitment is focused on inclusivity and fairness, encouraging diversity in ethnicity, gender, sexuality, and socio-economic backgrounds by anonymising our candidates, concentrating on the alignment of their skills and experience, reducing conscious or unconscious bias. Our Competency Framework gives employees clear guidance on progression and developing the necessary competencies for higher level roles, integrating both technical and behavioural aspects in a Skills Matrix, and mapping out potential career paths. We offer online training and invest in our staff’s professional qualifications. Our annual pay review maintains market-aligned salaries, and we are a certified Real Living Wage employer. We offer enhanced, inclusive family policies including maternity, parental, and fertility-treatment paid leave.
We hold Flexa accreditation and operate a ‘Work from Anywhere in the UK’ policy which enhances accessibility for candidates facing barriers to inclusion, bolsters retention and facilitates a healthier work-life balance. We are a Level 1 Disability Confident Committed employer, aiming to achieve Level 2 by 2025. We actively address underrepresentation, particularly women in tech, and racial inequality as a founding member of Technology, Community for Racial Equality. We are proud of our advancement of female leadership, recognised at the CRN Women & Diversity in Channel Awards 2023. Our involvement with the Stonewall Diversity Champions reflects our dedication to LGBTQ+ allyship.
As a silver accredited Armed Forces Covenant member, we work to help create employment opportunities for ex-service personnel and support staff who are military reservists.

Wellbeing

boxxe’s Wellbeing Strategy, built on direct feedback from our employees, reflects our dedication to prioritising our workforce’s mental, physical, social, and financial wellbeing. This holistic approach recognises the importance of a comprehensive support system for overall health, satisfaction, and effectiveness of the workforce. We adhere to the Mental Health at Work Commitment and incorporate elements from the Thriving at Work guidance, despite being an organisation of less than 500 employees. This includes tailored mental health support, financial advice and low interest support loans, an EPA, occupational health support, and counselling services provided in-house by Mental Health First Aiders.
We champion a healthy workplace environment through the Mindful Business Charter, which emphasises removing unnecessary stress and promoting mental wellbeing with strategies including smart meetings, respecting rest periods, and mindful delegation. This charter serves as a guideline for all employees on small, practical changes to safeguard personal and colleague health.
To encourage open discussions about health, we foster a supportive culture where physical and mental health issues can be openly discussed, creating a safe space for employees to express concerns. We encourage our staff to participate in the boxxe Community programme, which has been shown to positively impact physical and mental wellbeing.
Our proactive engagement with the workforce includes regular wellbeing surveys, specialised training for managing stress at work, and comprehensive health benefits that cover physical and mental resources. We promote active lifestyles through incentivised physical activities, and we maintain health and safety standards in line with our ISO 45001 accreditation. We ensure wellbeing extends to our supply chain through our Supplier Code of Conduct, emphasising the importance of ethical standards and worker health and wellbeing, demonstrating our dedication to fostering a culture of health and wellbeing across all facets of our operations.

Pricing

Price: £6.17 a user a month
Discount for educational organisations: Yes
Free trial available: No

boxxe VMware Horizon Subscription

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

boxxe VMware Horizon Subscription

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents