NTT DATA BUSINESS SOLUTIONS LIMITED

NTT DATA Business Solutions - Infor SunSystems Hosted

Infor SunSystems Finance & Accounting solution combines the latest innovation and usability with a depth of functionality that has been achieved through decades of practical application.

SunSystems is a comprehensive, global financial management and accounting system that delivers real-time financial, operational, and reporting analysis with unparalleled adaptability.

Features

Unified Ledger
Budget and Commitment management
Purchase to Pay
Bank Management
Fixed Assets
Mobile working
Multi Company & Multi Currency & Multi Language
Reporting
Project Accounting
Business systems integration

Benefits

Simple and intuitive interface
Realtime access to data
Cloud ready accessibility on Mobile, Tablet and Desktop
Implement best practices locally and globally
Access In-Context business intelligence
Integrate key business systems providing deeper analysis through finance
Enable cross application process flows
Improve compliance readiness and data security
Meets local & regulatory reporting in over 190 countries
Meeting Accounting requirements of different industries locally & globally

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Info-solutions-uk@bs.nttdata.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

Contact

NTT DATA BUSINESS SOLUTIONS LIMITED Philip Newman
Telephone: 07554555951
Email: Info-solutions-uk@bs.nttdata.com

About your service

Service categories

IaaS

IaaS Compute

Virtualised x86

General purpose

Service scope

Service constraints: Platform and application updates and patch sets are applied at the customer’s discretion, but may attract additional consultancy charges
System requirements: Citrix Workspace receiver for thick client
Cloud deployment model: Private cloud

User support

Email or online ticketing support: Yes
Support response times: Response times based on priority of the incident raised. Initial response times based on priorities outlined below. 

P1 – IRT: within 1 hour of case submission. 

P2 – IRT: within 4 hours of case submission. 

P3 – IRT: within 1 business day of case submission. 

P4 – IRT: within 2 business days of case submission. 

 Response times change at weekends.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.2 AA
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: Support Includes: 

24-hour contact, 7 days a week. 

18 languages, English being the core language. 

Accessible by Phone, e-mail, and web portal. 

Each Support member has SunSystems experience. 

Total visibility over Support Call status with regular updates. 

WebEx support.

Transparent escalation path with access to Managers and Directors company wide. 

Extensive Knowledge Base, eLearning’s, and system tips at no additional cost. 

Regular webinar recordings. 

Dedicated Account Management.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: NTT DATA Business Solutions provide a full range of implementation services including, but not limited to, configuration consultancy, training, documentation and integration configuration
Service documentation: Yes
Documentation formats: PDF
End-of-contract data extraction: A backup of the relevant underlying SQL database can be provided to clients twice annually – this service would be available at the end of a contract if desired. In addition, data extraction services are part of the solution offered by NTT DATA, ensuring clients can de-couple from the solution and retain all of their data.
End-of-contract process: Contract end processes vary, but clients ought to review contract documents, review internal records and contact their NTT DATA account manager for specific requirements around ending their contract with NTT DATA or Infor.
Documentation accessibility standard: WCAG 2.2 AA

Using the service

Web browser interface: Yes
Using the web interface: The SunSystems Web client is based on Infor Hook and Loop design principles and encapsulates SunSystems core processes and business logic.

The Web client reads and writes from and to the same MS SQL company database used for the SunSystems desktop version.

With the Web client, you can:

Create, process, and update financial transactions and master data.

Utilize user-defined fields, tables and objects.

Choose your preferred deployment option: on-premise & in the cloud, both can be used side-by-side with the desktop SunSystems client.

The SunSystems web-enabled version is accessed via a Web Browser.

Prerequisites:

You are using one of the following Web browsers:

Mozilla Firefox.

Google Chrome.

Microsoft Edge.

Apple Safari (Mac and iPad).
Web interface accessibility standard: WCAG 2.2 AA
Web interface accessibility testing: N/A
API: Yes
What users can and can't do using the API: SunSystems API Gateway is a service that provides a unified service endpoint for you to access business data through an API call from a source system outside SunSystems. You can use this API Gateway to log in to SunSystems once and then have access to the data in all the business units which can then consumed on other user interfaces.
API automation tools: Other
Other API automation tools: SunSystem API Gateway
API documentation: Yes
API documentation formats: HTML
Command line interface: Yes
Command line interface compatibility: Other
Using the command line interface: Clients can customize various areas of the system to suit their requirements; from the chart of accounts and analysis structure, to static data and transactional authorization workflows and screen layouts, menus, inquiry filters, customer-specific business rules, order types, calculations and price/value books.

Scaling

Independence of resources: Deployments are based on a single-tenant architecture. Each client sits within their own AWS Account. Multi-VPC architecture allows client workloads to be isolated from different parts of our client's infrastructure, simplifies and improves security due to less error-prone and more precise access control. User workloads are not affected by other users placing a demand on the service.
Usage notifications: Yes
Usage reporting: Email
Optimising consumption: Yes
Automatic scaling: Yes

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

Other
Other metrics: RAM

Platform Uptime
Reporting types: Reports on request
Resource tagging: No
FOCUS resource tagging: No

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: Infor

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v4.0

Physical access control, complying with SSAE-18 / ISAE 3402
Data sanitisation process: Yes
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Backup and recovery

Backup controls: Amazon EBS provides the ability to create snapshots (backups) of any Amazon EBS volume. It takes a copy of the volume and places it in Amazon S3, where it is stored redundantly in multiple Availability Zones.

EBS volumes for EC2 Instances (virtual machines), backed up once every 24 hours.

Each volume attached to the EC2-instance is backed up using a 7-day Retention period. Each EC2 instance thereby will have 7 snapshots of their EBS volumes at any given time going back 7 days. Apart from the above, there are scheduled backups used for Application-level recovery on demand.
Datacentre setup: Multiple datacentres with disaster recovery
Scheduling backups: Supplier controls the whole backup schedule
Backup recovery: Users contact the support team
Backup and recovery: Yes
RPO/RTO: Yes

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability: 99.9%

If service availability is breached service credits are issued .
Approach to resilience: Additional information provided upon request.
Outage reporting: Service outages are reported via email, which includes a RCA (Root Cause Analysis).

Identity and authentication

User authentication needed: Yes
User authentication: Multi-Factor Authentication (MFA)

Public key authentication (including by TLS client certificate)

Other
Other user authentication: Authentication takes place via Citrix Cloud as well as application level – SunSystems Authentication.

SSO can be enabled leveraging clients Azure AD with Citrix Cloud.

MFA is included for all our customers and employees.

We also use a PAM tool for admin access to customer servers.
Access restrictions in management interfaces and support channels: At least once a year via specific protocols embedded
Access restriction testing frequency: At least once a year
Management access authentication: Multi-Factor Authentication (MFA)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password
Devices users manage the service through: Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: ISO 27001 and SOC 2 Type 1.

The policies are enforced by the infosec team and IT controls are in place to ensure these are followed. Regular online training sessions are enforced and tracked for all employees throughout the employment term. All new starters go through a security induction program.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: A change control process is in place to control changes to all critical company information resources (i.e., hardware, software, system documentation and operating procedures). This includes management responsibilities/procedures. 

Wherever practicable, operational and application change control procedures should be integrated. The change control process should include the following phases:

Logged Change Requests;

Identification, prioritization and initiation of change;

Proper authorization of change;

Requirements analysis;

Inter-dependency and compliance analysis;

Impact Assessment;

Change approach;

Change testing;

User acceptance testing and approval;

Implementation and release planning;

Documentation;

Change monitoring;

Defined responsibilities and authorities of all users and IT personnel;

Emergency change classification parameters.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Vulnerabilities identified on a regular basis via scanning, and must be remediated in accordance CVSS score.

The scope of scans is regularly reviewed, to ensure new or changed systems are discovered and added to the regular scanning cycle

Security risks must be reviewed before the next patching cycle.

o CRITICAL–Will be considered a security incident and managed through the incident management process

o HIGH–Within 30 days of the patch being released

o MEDIUM–Within 180-days of the patch being released

o LOW/NONE–Patching not required but should be patched along with MEDIUM risks if possible
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: There is a Global Incident Management Policy in place at NDBS

Please be aware we are not permitted to share copies of our internal policies. Security Policies meet ISO27001 requirements. If required, after signing an NTT DATA Business Solutions Non-Disclosure Agreement the Title and Contents pages may be shared.
Incident management type: Supplier-defined controls
Incident management approach: NDBS provide clearance checks as part of any staff onboarding, however specific clearance checks can be organised on request, for example for customers working in government sectors or industries with certain compliance regulations. If a cost is associated with the clearance checks, this would be reviewed with the commercial team.
Post-quantum cryptography secure: No

Secure development

Approach to secure software development best practice: Supplier-defined process

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
Who implements virtualisation: Third-party
Third-party virtualisation provider: AWS
How shared infrastructure is kept separate: All workloads run on AWS Services.

Energy efficiency

Energy-efficient datacentres: No

Pricing

Discount for educational organisations: No
Free trial available: No

Discount

Provide your minimum discount applicable to your baseline prices: 0%

Formula for calculating price of your services

Which of the core deployment models you intend to offer

Private Cloud

Private Cloud - Formula for calculating price of your services

Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
=
Baseline Pricing: The baseline pricing is calculated based on the core components required to design, build, and operationally hand over a secure and supported environment.

These services cover hosting build coordination and the creation of a dedicated AWS account, followed by server build and configuration activities. Security and access controls are established through multifactor authentication (MFA) and user creation, alongside configuration of file server services.

The baseline also includes publishing external URLs, application publishing via Citrix and/or RDWeb, and associated server troubleshooting to ensure the environment is stable and ready for use. Final activities include support transition and customer handover, supported by the production of a Hosting Design Document that captures the agreed architecture and configuration.

Together, these elements ensure a production-ready hosting environment.

The pricing is calculated using variable such as the software to be installed, the selected AWS data centre location, and the anticipated number of users, all of which influence infrastructure sizing, performance, and regional hosting costs.
-
Minimum Discounting: 0%
+
Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
+
Additional sources of cost: Costs associated with this deployment model may increase depending on the scale, security, and connectivity requirements of the service. Infrastructure costs are influenced by server size and performance requirements, including compute, storage, and resilience levels needed to support the solution. Where integration with external or on-premise systems is required, additional integration servers may be needed, increasing hosting and support costs.

Secure connectivity requirements can also increase cost. For example, the use of VPNs or private network connections to buyer environments introduces additional configuration, licensing, and ongoing management overheads.

User-based costs may apply where pricing is linked to the number of named or concurrent users, as this impacts capacity planning, access management, and support effort. An increase in user numbers may require larger server instances or additional application servers to maintain performance and availability.

Other potential cost sources include environment build and configuration activities, security controls such as authentication services, and ongoing operational support and monitoring.

Together, these factors ensure the solution is appropriately sized, secure, and aligned to the buyer’s operational requirements.
-
Additional sources of cost reduction: One source of cost reduction is the ability to lower availability or resilience options for noncritical environments, reducing infrastructure and hosting costs where high availability is not required.

Longer contract terms may also enable improved commercial arrangements, providing greater cost efficiency and budget predictability over the duration of the contract. Additional savings can be achieved through the use of savings plans and reserved instances, which offer discounted pricing in exchange for committed levels of usage when compared to on-demand consumption.

Storage lifecycle management provides further opportunities for cost optimisation by automatically transitioning data to lower-cost storage tiers based on usage and access patterns, ensuring buyers only pay premium storage costs where necessary.

These approaches allow buyers to reduce overall service costs while maintaining appropriate levels of performance, security, and operational support, ensuring value for money throughout the contract term.

Mandatory certifications

Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

Reseller

Cloud service suppliers you intend to resell with evidence

Organisation 1

Organisation name

AWS