Virtual Desktop (AWS and Azure) Managed

Service scope

Software add-on or extension: No
Cloud deployment model: Hybrid cloud
Service constraints: No constraints. CGI can support clients on-site or remotely, and across a range of security classifications including Above Secret with suitably cleared professionals.
System requirements: Buyer has appropriate Public Cloud provider support agreement in place

Or leverage CGI's agreement at a small additional cost

User support

Email or online ticketing support: Yes, at extra cost
Support response times: 30 minutes
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Yes, at an extra cost
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: End users can access webchat functionality via Amelia, which will be available via plugin to MS Teams. Amelia will transfer to a live agent if the issue cannot be resolved.
Web chat accessibility testing: Web chat accessibility testing
Onsite support: Yes, at extra cost
Support levels: Full support of CGI services are provided as standard via the CGI Service Desk. The Service Desk is 24x7x365 and is resourced with 1st/2nd line technical support engineers to support Cloud instances and a range of technologies hosted on those cloud instances. The service desk has direct escalation to 3rd line support and onward escalation to product vendors
Support available to third parties: No

Onboarding and offboarding

Getting started: Investigation of existing requirements and services which will then allow for us to plan a suitable implementation to meet needs of client. Documentation will be provided to assist user training.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: User data will remain in possession of the customer (customers will be expected to host using their organisation cloud subscription).
End-of-contract process: User data will remain in possession of the customer (customers will be expected to host using their organisation cloud subscription).

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Chrome
Application to install: Yes
Compatible operating systems: Android

IOS

MacOS

Windows

Other
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Please find links below to both Microsoft and Amazon websites for comparison:

AWS :https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-clients.html
Microsoft:
https://learn.microsoft.com/en-us/azure/virtual-desktop/compare-remote-desktop-clients
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: Vendor specific cloud management portal.
Accessibility standards: None or don’t know
Description of accessibility: Remote desktop window, that allows user to utilise native windows desktop services e.g. screen reader, desktop resolution change.
Accessibility testing: None
API: Yes
What users can and can't do using the API: API reserved for admin use only.
API documentation: No
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Customisation can be summarised by OS features, applications and appearance. Scaling options and company logos. Options to customise from customer and in the event this is not possible, through support function.

Scaling

Independence of resources: Both options allow for individual user assignment. Scaling possible to allow guaranteed compute per user (Microsoft/AWS availability levels).

Analytics

Service usage metrics: Yes
Metrics types: Reporting available, subject to vendor limitations on metrics that are measureable. Examples are: compute usage, active users, licence assignment
Reporting types: Regular reports

Reports on request

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: Public Cloud, IaaS.

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)
User control over data storage and processing locations: Yes
Datacentre security standards: Managed by a third party
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Other
Other data at rest protection approach: .
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: Data retained by customer, as their own subscription will be used.
Data export formats: Other
Other data export formats: Not applicable
Data import formats: Other
Other data import formats: Not applicable

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)

Other
Other protection between networks: All prospective services, are limited by vendor offering (AWS/Microsoft). Any solution CGI offer would be subject to appropriate security assessment and appropriate network protection required by that assessment.
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: Service Levels agreed with client subject to service solution requirements and level of availability required. Specific service levels for availability will be constrained by availability levels and any scheduled unavailability that the public cloud vendor (AWS and Microsoft) offer within their commercial terms.
Approach to resilience: Options for resilience are offered in solution when requirements are known. Public cloud vendors offer multiple options, that can be considered, subject to complexity and pricing requirements.
Outage reporting: The console provides alerts for IaaS, PaaS and SaaS by email as default. In addition, CGI can provide proactive alerting solution for Public Cloud using webhooks. This takes the URL calls produced by webhooks and can deliver alerts in 3 ways:
• Email to a resolver group
• Direct import to CGI's enterprise ITSM tool, Remedy. This raises a ticket targeted at the resolver queue embedded in the URL call
• Integration with CGI's enterprise control bridge In addition, CGI also provide Virtual Server OS health monitoring.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)
Access restrictions in management interfaces and support channels: CGI members requiring access to customer's resources and environments within Public Cloud use a secure site-site VPN to establish a secure connection. Credential authentication is done via Active Directory installed as part of the initial service setup for each customer and is unique to them. and will have RBAC controls implemented to ensure restricted privileges.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Dedicated link (for example VPN)

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Intertek Certification Limited
ISO/IEC 27001 accreditation date: 28/03/2024
What the ISO/IEC 27001 doesn’t cover: Nothing. Our certification covers the provision of outsourcing, project and consultancy services including development and delivery activities plus the management of people, technologies and physical security.
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Our security, information security and data protection management system for CGI is established through the Enterprise Security Management Framework (ESMF). The framework applies to the work we conduct for ourselves and for clients under UK contracts. All CGI UK members and contractors are expected to comply with its principles and processes. The ESMF is comprised of: A first level suite of security policies and security requirements that apply across the CGI enterprise. A second level set of standards set out how these policies and requirements are met, these being detailed within the following operational categories:- Access Control- Operations- Technology- Applications- Data management- HR and Organisation- Physical Microsoft uses OSA to minimize risk by helping to ensure that on-going operational activities follow rigorous security guidelines and by validating that guidelines are actually being followed effectively. When issues arise, a feedback loop helps ensure that future revisions of OSA contain mitigations to address them.

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Effective configuration and change management processes are essential for ensuring service integrity and security. CGI maintains a comprehensive approach, defining clear roles and responsibilities within client and CGI teams. Our process includes a detailed configuration plan, specifying service components and dependencies, and clear deliverables to ensure documentation accuracy. Changes undergo thorough evaluation, requiring signoff from both parties to align with expectations and mitigate unauthorized alterations. We closely monitor and track all changes, maintaining detailed records for auditing purposes. By adhering to these processes, CGI ensures structured, accountable management, minimizing risks and upholding service integrity and security.
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Our vulnerability management process involves continuous monitoring, assessment, and routine remediation. Our security team will identify vulnerabilities through regular scans and assessments. Prioritisation is based on severity and potential impact on cloud resources. Remediation plans are promptly devised and executed, addressing vulnerabilities with urgency. We use automated tools as such Defender for Cloud, AWS Inspector and AWS Security Hub, to streamline detection and response. Regular updates and patches are applied to maintain security posture. Post-remediation evaluations ensure effectiveness.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: CGI provides cloud security tooling and pro-active system monitoring linked to our control bridge. This helps ensure the effectiveness of the controls that are adopted and to verify conformity to the Public Cloud provider, CGI and our client's security policies/ standards. CGI typically interfaces with the Public Cloud Provider protective monitoring tools e.g. Azure Defender, Sentinel, AWS Trusted Advisor, which will detect and respond to attempted and successful attacks, misuse, and malfunction. Securities threats, detected vulnerabilities and breaches are escalated, actioned and remediated with the appropriate playbooks to ensure security events are managed promptly and effectively.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: CGI operate an ITIL aligned incident management process with associated procedures for security related incidents. The process has a clearly defined governance framework, including roles & responsibilities, clear policies and associated KPIs. CGI provide a single point of contact via our service desk using voice, or web portal, for any issues related to the Public Cloud platform. Regardless of the Public Cloud support agreement owner (CGI or the customer), CGI can open and track incidents on the buyer's behalf . We provide routine monthly reporting via our ITSM processes for all incident categories .

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change

As a member of the Government Digital Sustainability Alliance, CGI leads others to protect and improve the health of our planet.
CGI in the UK has committed to achieve net zero by 2026, based on Science Based Targets (SBTs), achieving an 84% reduction in emissions across our operations from our 2019 baseline. We will use our Carbon Impact Tool to identify and track contracting body contract associated emissions, building these into our net zero plans to reduce any negative environmental impacts of contracts.
We have extended our climate change commitment into our supply chain such that 50% of our suppliers, by spend, will have set their own SBTs to reduce their climate impact by 2026. This will apply to suppliers we engage to support the delivery of call-off contracts. We are supporting suppliers through quarterly net zero knowledge sharing webinars. So far 23% of our suppliers, by spend, have set SBTs.
Our environmental engagement programme 'No Planet B' influences CGI members, clients, suppliers and communities to support environmental protection and improvement. We achieve this through activities such as litter picking and our tree and hedge planting programme where, together with clients and suppliers we have planted 19,500+ UK native trees. Our members partner with clients and suppliers on tree-planting days. We will invite contracting bodies and their ecosystem partners to participate in such activities, connecting them with the environment and increasing protection and enhancement awareness.
CGI's UN-supported research programme, Sustainability Exploration Environmental Data Science (SEEDS), brings organisations, academics and experts together to collaboratively devise/deliver environmental solutions. SEEDS is accelerating efforts to address climate change by researching climate mitigation solutions and waste reduction.
We will continue our partnerships with charities and Social Enterprises, including Canal and River Trust to mobilise action on environmental protection objectives through collaborating with local communities.

Pricing

Price: £720 to £1,300 a unit a day
Discount for educational organisations: No
Free trial available: No

Virtual Desktop (AWS and Azure) Managed

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Virtual Desktop (AWS and Azure) Managed

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents