Hosted Microsoft SPLA Licencing
The Microsoft Services Provider License Agreement (SPLA) service enables customers to access and use Microsoft software products on a subscription basis, hosted and managed by Cirro. The service allows organisations to consume Microsoft server and application software as an operational expense, without the need to purchase perpetual licenses.
Features
- Scalable Azure virtual machines, storage services
- Secure Azure foundations aligned to public sector best practice
- Azure AI services for language, vision and analytics workload
- Secure integration of organisational data with AI services where appropriate.
- Deployment and operation of Azure-native SIEM and SOAR capabilities
- Full management wrap and additional managed services
- management of Defender for Cloud and related security tooling
- Secure-by-design Azure architectures
- Options for dedicated or software defined networking
- Ongoing monitoring and optimisation of Azure consumption.
Benefits
- xpert design and management reduce risk and complexity.
- Integrated security and monitoring using Microsoft-native tooling.
- Safe adoption of AI and LLM capabilities within governed environments
- UK support direct from Cloud Architects
- Allows business to reduce risk and resource overhead
- Reduced internal burden through managed infrastructure and services.
- Azure environments that grow and adapt to organisational needs.
Pricing
- Education pricing available
- Free trial available
Service documents
Request an accessible format
Framework
G-Cloud 15
Service ID
4 0 3 4 7 1 5 3 0 1 1 4 2 1 8
Contact
CIRRO LIMITED
Michael Owen
Telephone: 020 3418 0412
Email: gov@cirro.dev
About your service
- Service categories
-
IaaS
IaaS Compute
Virtualised x86
- General purpose
- Compute optimised
- Memory optimised
Service scope
- Service constraints
- None
- System requirements
- Customer 1st line help desk
- Cloud deployment model
- Public cloud
User support
- Email or online ticketing support
- Yes
- Support response times
- P1 - 30 mins. p2 - 2hrs, p3 - 4hrs, p4 - working day
- User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- None or don’t know
- Phone support
- Yes
- Phone support availability
- 24 hours, 7 days a week
- Web chat support
- Yes
- Web chat support availability
- 24 hours, 7 days a week
- Web chat support accessibility standard
- None or don’t know
- How the web chat support is accessible
- None
- Web chat accessibility testing
- None
- Onsite support
- Yes, at extra cost
- Support levels
-
24x7 monitoring for infrastructure, security, and backups
Business Hours Support (typically 08:30–17:30, Mon–Fri)
Out-of-hours support for Priority 1 & 2 incidents
Optional 24x7 service desk where required
Incident Priority & Response Targets
P1 – Critical Complete service outage ≤ 15 minutes Response Continuous effort until restored
P2 – High Major degradation ≤ 30 minutes Same business day resolution
P3 – Medium Limited impact ≤ 4 business hours Planned fix
P4 – Low Minor issue / request ≤ 1 business day Scheduled
Backup & Disaster Recovery
Daily backups as standard (frequency configurable)
Immutable backups where required
Defined RPO/RTO per service
Regular test restores
Optional Azure Site Recovery (ASR) with documented failover testing
Commercial Support includes a named Account Manager, monthly Service Review documentation and Quarterly service improvement / strategic planning discussions.
Cirro supports and patches the hypervisor and the VM where agreed, or customer patches their Platforms
Access to Cloud Architects and system experts on Time and Material basis or under Agreement
Architects help scope & design where needed
Customer provided named contact to Support desk
Can incorporate bespoke maintenance patching windows & customer specific Policies (Change Control, Security, Major Incident) - Support available to third parties
- Yes
- AI chatbot
- No
Onboarding and offboarding
- Getting started
-
Cirro – Cloud Migration Best Practice Standards
Cirro follows recognised, industry‑standard cloud migration best practices, centred on the Microsoft Cloud Adoption Framework (CAF). This framework provides a structured and proven approach to planning, migrating, and optimising cloud environments.
Core Best Practice Framework
Cirro aligns its cloud migrations to the Microsoft Cloud Adoption Framework, which is wide-ly adopted as best practice for Azure migrations.
Migration Lifecycle Adopted by Cirro
• Analyse – Assessment of the existing environment, dependencies, risks, security and com-pliance requirements.
• Plan – Definition of migration strategy, workload prioritisation, timelines, rollback planning, and risk management.
• Transition – Phased migration using Azure-native tools to minimise downtime and disruption.
• Operate – Ongoing operational management, monitoring, security and cost optimisation.
• Transform – Adoption of cloud-native services and modern workplace technologies to im-prove performance and scalability.
• Continual Improvement – Continuous optimisation using lessons learned, service reviews and performance reporting.
In summary, Cirro delivers cloud migrations using the Microsoft Cloud Adoption Framework, supported by ISO-accredited quality, security and continuity standards. This ensures migra-tions are secure, low-risk, well-governed, and continuously optimised after go-live. - Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
-
At exit, we will deliver a structured, time-boxed handover ensuring you or your successor MSP receives all data in open formats:
Databases: Native SQL .bak files (full/differential/log chain), CSV exports, schema docu-mentation.
File Shares: Robocopy with ACL preservation, or packaged archive (ZIP/TAR).
SFTP Zones: Structured export including logs.
Configurations: AD, GPOs, RAS farm exports, SFTP configs, certificates (via escrow).
Verification & Handover: Data integrity checked via checksums, with joint sign-off.
Secure Destruction: Certified wiping of residual data post-handover.
This guarantees no vendor lock-in, UK-only handling, and a risk-free transition. - End-of-contract process
- The contract and Sales Order will detail all the pricing elements for the delivery and running of the services as and when the agreement ends. The customer may wish to extend for an additional or shorter term, these commercial terms can be accommodated under G-Cloud guidelines / restrictions. Should the customer wish to exit at the end of the contracted term, then the Exit Plan will be invoked. This document looks at an exit plan including migrating services to another provider, to internal platforms or whatever other options have been detailed. This will also include likely costs. At this time a formal SoW will be produced to detail the level of involvement required from Cirro to transition services to another provider. This is charged on a Time & Materials basis, the rates of which are details at the start of the Agreement. A Customer may wish to request the new provider assists with the transition and therefore limiting assistance and costs from Cirro . Cirro will always look to provide professional support and assistance to reduce risk and maintain service during any major transition.
- Documentation accessibility standard
- WCAG 2.2 AAA
Using the service
- Web browser interface
- No
- API
- No
- Command line interface
- No
Scaling
- Independence of resources
-
Through logical resource segregation and resource allocation to each environment, ensuring consistent performance of all users in each customer environment. This approach ensures no one customer can act as a resource thief against another and that complete independence exists. When customers approach resource limits, auto-scaling can be applied to a predefined upper agreed limit.
Each customer has a designated resource pool which is proactively monitored and managed. - Usage notifications
- Yes
- Usage reporting
-
- API
- Optimising consumption
- Yes
- Automatic scaling
- Yes
Analytics
- Infrastructure or application metrics
- No
Resellers
- Supplier type
- Reseller providing extra support
- Organisation whose services are being resold
- Innovate Limited
Staff security
- Staff security clearance
- Conforms to BS7858:2019
- Government security clearance
- Security Clearance (SC)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 4.0)
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- ‘IT Health Check’ performed by a CHECK service provider
- Protecting data at rest
-
- Physical access control, complying with CSA CCM v4.0
- Physical access control, complying with SSAE-18 / ISAE 3402
- Encryption of all physical media
- Data sanitisation process
- Yes
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
- Data sanitisation type
-
- Deleted data can’t be directly accessed / Cryptographic Erasure
- Data Erasure
Backup and recovery
- What’s backed up
-
- Hypervisor, VMware, HyperV, Xen
- Virtual Machine instances
- IOS, MAC OSX, Windows, Android, Linux
- Backup controls
- Each user has a dedicated UI to manage back-up routines, set retention policies and periods and invoke restoration to an existing restoration device; which can be a Cirro server on a pre-allocated vLAN. Many organisations will already be using Veeam Cloud Connected which is fully supported and heavily used by Cirro. Infrascale is also used in some instances. Users have full control over setting schedules for data sets. All data is encrypted locally on the source device, encrypted in transit and at rest at the Cirro destination. Alerts based on failed back-ups can be sent
- Datacentre setup
-
- Multiple datacentres with disaster recovery
- Multiple datacentres
- Single datacentre with multiple copies
- Single datacentre
- Scheduling backups
- Users schedule backups through a web interface
- Backup recovery
-
- Users can recover backups themselves, for example through a web interface
- Users contact the support team
- Backup and recovery
- Yes
- RPO/RTO
- Yes
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Legacy SSL and TLS (under version 1.2)
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Legacy SSL and TLS (under version 1.2)
Availability and resilience
- Guaranteed availability
- 99.99%
- Approach to resilience
- Resilience is built into the core fabric of our operations and cloud compute platforms, we build resilience in customer deployments against requirements. This approach ensures that as a business, we are highly resilient, and as a customer, you have the flexibility to have the right level of resilience based on required update, data loss sensitivity, risk and cost.
- Outage reporting
- All of the above
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- Multi-Factor Authentication (MFA)
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Username or password
- Access restrictions in management interfaces and support channels
- All management interfaces are only accessible by named and security vetted individuals via a two factor authenticated session on an IPSEC v2 VPN tunnel. All connections are logged and audited. Multiple failed attempts automatically lock the individual user account with automated notification sent. All passwords are timed and must be unique and can't be recycled. Cirro also support Software Defined Networking (SDN) virtualisation technologies, including Network Virtualization using Generic Routing Encapsulation (NVGRE) and Virtual Extensible LAN (VXLAN). These technologies are designed to supported better connectivity, access and scalability specifically for cloud computing environments.
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- Multi-Factor Authentication (MFA)
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Limited access network (for example PSN)
- Username or password
- Devices users manage the service through
-
- Dedicated device on a segregated network (providers own provision)
- Dedicated device on a government network (for example PSN)
- Dedicated device over multiple services or networks
- Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
- Directly from any device which may also be used for normal business (for example web browsing or viewing external email)
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- At least 12 months
- Access to supplier activity audit information
- Users have access to real-time audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- At least 12 months
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- ISO/IEC 27001
- Information security policies and processes
-
We follow ISO 27001 Information Security Management Systems (ISMS) and CSA guidelines as well as best practice for Cyber Security.
Our providers are accredited to the appropriate standards, such as ISO 27001, 9001, PCI DSS, Cyber Security Essentials.
Cirro will be completing ISO 27001 independently.
Reporting - our Designated DPO monitors compliance with policies. Any incidents or deviations from policy are reported from the service manager directly with the Account Manager is also informed
Operational security
- Configuration and change management standard
- Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
- Configuration and change management approach
- Changes made by the Customer to their Cloud environment which they support themselves is done so at the Customers risk. Where Cirro provides Support of the Customers environment, all change requests must be formally submitted and approved by Cirro, they are fully audited and assessed against risk. The request has to include: 1. Reason a. Improving security b. Improving performance or functionality c. Reduce operational overhead or cost 2. Request to be approved by Cirro’s: a. Service Manager b. System Architect c. InfoSecurity 3. Change request must include: a. Expected outcome b. Test plan c. Roll-back plan d. SoW
- Vulnerability management type
- Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
- Vulnerability management approach
- All systems are scanned for vulnerabilities every month. Cirro uses the Common Vulnerability Scoring System (CVSS) for all Common Vulnerabilities and Exposures (CVE) provided by the National Vulnerability Database. Scoring for non-CVE vulnerabilities is provided by UB’s vulnerability scanning tool. A priority is placed on patching or mitigating the vulnerability based on these scores and the logical location of the vulnerability within Cirro's network infrastructure. Remediation occurs within 10 business days for critical vulnerabilities.
- Protective monitoring type
- Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
- Protective monitoring approach
- Our service management processes are ITIL aligned and have a particular focus on Security Incident Management System and Continuous Service Improvement. Some of the components of this system have been provided below: - Network and Host-based IDS/IPS - Traffic monitoring and intelligent traffic analysis - Packet capture and analysis to enable investigations into alerts - DNS monitoring to detect DNS lookups to known or suspected malware - Botnet monitoring – hunts for and alerts on any type of connection - Web and email threat monitoring - Geographic analysis of all attacks and traffic Automated systems ensure ultimate continual protection.
- Incident management type
- Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
- Incident management approach
- Prevention: The understanding of and application of insight gained from the intelligence Detection: The interpretation of any events of interest occurring to discriminate between legitimate and abnormal events to identify anomalous activity Investigation: The analysis of anomalies to determine whether they are emerging threats that may lead to a security incident Reaction: Our analysts use tailored, predefined and configured Playbooks to efficiently inform their reaction to an identified threat Response: The planning of effective mitigation in response to the cyber-attack, the communication of these plans to all relevant stakeholders, and the collaboration with all relevant parties to carry out mitigation.
- Post-quantum cryptography secure
- No
Secure development
- Approach to secure software development best practice
- Conforms to a recognised standard, but self-assessed
Separation between users
- Virtualisation technology used to keep applications and users sharing the same infrastructure apart
- Yes
- Who implements virtualisation
- Supplier
- Virtualisation technologies used
- Hyper-V
- How shared infrastructure is kept separate
- An organisation is the container for a tenant and forms logical boundaries between tenants. Each organisation gets units of resources defined by the Org vDCs it has. The resources that get defined at the Org vDC are compute, storage and network. When a Org vDC is created, a Provider vDC is used to allocate resources to the Org vDC. The Provider vDC maps these resources into different containers, which isolates the units of compute.
Energy efficiency
- Energy-efficient datacentres
- Yes
- Description of energy efficient datacentres
- Data centres adhere to ISO 50001 Energy Management and 14001 Environment Management (which we also hold)
Pricing
- Discount for educational organisations
- Yes
- Free trial available
- Yes
- Description of free trial
- A tailored trial can be arranged in a limited form for a 30-day period. Customer go through User Acceptance Testing to ensure the Cirro solution is fit for purpose. Trials may be limited in functionality and integration. All Terms & Conditions apply to trial users
Discount
- Provide your minimum discount applicable to your baseline prices
- 0%
Formula for calculating price of your services
- Formula for calculating price of your services
-
Which of the core deployment models you intend to offer
- Public Cloud
- Private Cloud
Public Cloud - Formula for calculating price of your services
- Total Cost
- The Total Cost for a buyer's call off requirement in a Public Cloud Deployment
- =
- Baseline Pricing
- Pricing provided as part of each service description
- Baseline Pricing - Web link
- https://www.cirro.dev
- -
- Minimum Discounting
- 0%
- +
- Onboarding Activity
- Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
- +
- Additional sources of cost
- Additional application testing, additional resources
- -
- Additional sources of cost reduction
- lesser service levels, reduced resilience
Private Cloud - Formula for calculating price of your services
- Total Cost
- The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
- =
- Baseline Pricing
- Pricing provided as part of each service description
- -
- Minimum Discounting
- 0%
- +
- Onboarding Activity
- Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
- +
- Additional sources of cost
- Additional application testing, additional resources
- -
- Additional sources of cost reduction
- lesser service levels, reduced resilience
Mandatory certifications
- Mandatory certifications
-
Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure
Sole Control and also accredited to resell other providers' servicesCloud service suppliers you intend to resell with evidence
Organisation 1
Organisation name
Innovate LtdWebsite address/upload for organisation
UploadUpload
ProvidedISO 9001 certification
ProvidedISO 14001 certification
ProvidedISO 27001 certification
ProvidedISO 20000-1 certification
ProvidedISO 27017 certification
ProvidedAre you bidding to provide services under Lot 1b or both Lot 1a and Lot 1b?
YesISO 27018 certification
Provided
Cyber Essentials
- Do you have a Cyber Essentials Plus certificate?
- Yes
- Cyber Essentials Plus certificate Number
- 0f502da2-6ecb-4b4e-a52f-8c9c99388c62
Non-mandatory Standards and certifications
- ISO 28000:2022 certification
- No
- Quality management systems (QMS)
- Yes
- CSA STAR certification
- No
- PCI certification
- No
- Other security certifications
- No
Social value
- Section B - Commitment for Future: Delivery
-
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority
- New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
- Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
- Plans to engage the contract workforce in deciding the most important workplace issues to address
- Ensuring new workers are informed of their right to join a trade union
- Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
- Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
- Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
- Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
- Activities to cascade good practice on fair working conditions throughout the supply chain
- Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
- Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
- Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
- Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
- Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
- Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
- Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
- Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
- Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
- Volunteering opportunities for staff
- Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
- Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
- Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
- How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
- How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
- Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.
- Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
- Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
- Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises
- Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
- Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
- Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
- Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
- Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
- Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
- Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
- Plans to respond flexibly and adapt approaches to community engagement and initiatives
-
Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain
Policy Outcome 6: Employment and training: For those who face barriers to employment
- Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition
-