CIRRO LIMITED

Virtual Desktop Infrastructure (VDI)

Hosted Virtual Desktop or Azure Virtual Desktop with Microsoft 365. Highly tailored solution to customer requirement, with golden desktops for user types and profiles. Include application sequencing and distribution and can support Terminal Services. Single or high-availability load-balanced design, Cyber Security suite for AV, IDS/IPS.

Features

• Azure Virtual Desktop, HyperV VDI, Citrix or bespoke solution
• Multiple UK data centre locations
• Multiple UK data centre locations
• Simplifying maintenance, updates, patching & application deployments
• IDS, IPS, AV, Firewall, Load-balancers with Cisco FirePower
• Each VDI can be firewalled for zero trust
• Secure Bring Your Own Device (BYOD)
• Application sequencing & streaming. Microsoft 365 suite

Benefits

• Enhanced security and access controls
• Flexibility and Scalability,
• Disaster recovery, business continuity, office relocations, WFH
• Lower cost, higher performance & more secure than Public Cloud
• Service Performance you test & sign-off on before you commit
• Support home and remote workers
• VDIs enable centralised management of desktop images and applications
• Allows business to reduce risk and resource overhead - GDPR
• Fixed pricing-model; know exactly what you are paying
• Control and optimise desktop performance and user productivity

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gov@cirro.dev. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

409019360379084

Contact

Michael Owen
020 3418 0412
gov@cirro.dev

About the service

• Service categories:
  • Systems Infrastructure Software
    • Physical and virtual computing
      • Virtual client computing
        • Virtual client computing
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: None
• System requirements: Nothing specific

User support

• Email or online ticketing support: Yes
• Support response times: Usually within 2hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• AI chatbot: No
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: Part of the solution we offer is to deliver a full solution for assistive technologies. We will typically use tools like WAVE, BrowserStack or Site Improve.
• Onsite support: Yes, at extra cost
• Support levels: Incidents are categorised by severity and handled according to defined runbooks. For high and critical incidents, we provide rapid escalation, clear communications, and recommended or executed containment actions, such as endpoint isolation, account suspension, or malicious email removal. All actions are auditable and agreed with the customer in advance.; ; Customers receive timely notifications and regular status updates throughout incident handling. Post-incident reports include impact assessment, actions taken, and recommendations to prevent recurrence.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding follows a structured approach including discovery, secure configuration, testing, and transition to live service. The service is scalable and can be adapted as customer environments change.; On exit, we provide knowledge transfer, configuration documentation, and support to ensure continuity, including handover to another supplier or in-house team. Customer data remains under customer control at all times.; This Managed Microsoft Defender service enables buyers to maximise the value of their Microsoft security investment while reducing operational risk and improving cyber resilience.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AAA
• End-of-contract data extraction: At the termination or expiry of the VDI service contract, we will support the orderly extraction and return of customer data in accordance with the agreed exit management process.; ; The following customer-owned data is typically eligible for extraction:; ; User Data; ; User profiles (e.g. roaming profiles, FSLogix containers); ; Documents and files stored within virtual desktops; ; User-specific application data; ; Shared Data; ; Data stored on shared file systems associated with the VDI environment; ; Departmental or team shares hosted within the service; ; Configuration Data (where agreed); ; Virtual desktop configuration settings; ; Group policies or equivalent configuration objects; ; Application configuration files specific to the customer environment; ; Data is provided in industry-standard, non-proprietary formats wherever possible (e.g. NTFS file structures, ZIP/TAR archives, CSV/JSON for configuration data).; Data Transfer Method; ; Secure transfer mechanisms are used, such as:; ; Encrypted network transfer (SFTP, HTTPS); ; Encrypted removable media (where agreed); ; Secure cloud storage handover; ; All transfers are protected using encryption in transit and access controls.; ; Exit Assistance & Timelines; ; Data extraction is performed within an agreed exit period (commonly 30–90 days).; ; Reasonable assistance is provided to support data validation and handover.; ; Additional exit support beyond standard scope may be chargeable.
• End-of-contract process: We would agree an exit plan with detailed timings and dates. Data extraction formats would be finalised. ; ; We would cooperate with and in-house or alternative provider to ensure uninterrupted transfer.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.2 AAA
• API: No
• Customisation available: Yes
• Description of customisation: Reporting, SLAs and alters are customisable

Scaling

• Independence of resources: Customers are protected from the impact of other users’ demand through isolation, capacity management, and SLA controls. Each customer operates in a logically separated SIEM/SOAR environment with dedicated alert queues and case management, preventing cross-customer contention. ; ; The SOC is sized using peak-demand modelling and maintains reserved surge capacity to handle spikes without degradation. Per-customer SLAs drive prioritisation and automated escalation to ensure response times are met regardless of wider demand. Continuous performance monitoring and regular service reviews provide assurance that workloads remain isolated and service levels are consistently maintained.

Analytics

• Service usage metrics: Yes
• Metrics types: We measure specific, quantifiable metrics. These include service availability (e.g. 99.9% monthly uptime) and desktop availability for user logins, along with unplanned outage count and mean time to restore. User login time (average and 95th percentile, e.g. <30 seconds), application launch time, and session disconnect rate are used to assess user experience. Concurrent session capacity and CPU, memory, storage, and network utilisation measure platform scalability. Patch compliance within defined timeframes and security incident count assess security posture. Incident response and resolution times, desktop provisioning time, change success rate, and customer satisfaction scores measure operational performance and service quality.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Innovate Limited

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data Format; ; Data is provided in industry-standard, non-proprietary formats wherever possible (e.g. NTFS file structures, ZIP/TAR archives, CSV/JSON for configuration data).; ; Virtual machine images may be provided in standard formats (e.g. VHD/VHDX/OVA) if explicitly included in the contract.; ; Data Transfer Method; ; Secure transfer mechanisms are used, such as:; ; Encrypted network transfer (SFTP, HTTPS); ; Encrypted removable media (where agreed); ; Secure cloud storage handover; ; All transfers are protected using encryption in transit and access controls
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • JSON
  • ZIP-TAR
  • VHD/VHDX/OVA
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: Our platforms are designed for high availability and are operated on a 24×7 basis. Availability is 99.95% (≈ 4.4 hours downtime per year).; ; Availability is achieved through:; Multi-node, clustered SIEM architectures; Redundant ingestion, storage, and correlation components; Automated failover and rolling maintenance; Continuous monitoring and alerting; ; Planned maintenance is excluded from availability calculations or performed using rolling updates to avoid disruption. Importantly, SOC SLAs distinguish between SIEM platform availability and SOC analyst service availability, which is guaranteed at 24×7×365 even during platform maintenance.
• Approach to resilience: Resilience in our system is achieved through a combination of architecture, operational practices, and governance controls, designed to ensure continuous detection and response even during failures or spikes in demand.; ; At a technical level, our SIEM platform is deployed using a high-availability architecture, with clustered components for log ingestion, processing, storage, and search. Critical services are distributed across multiple nodes and, where required, multiple availability zones or data centres, allowing automatic failover if a component fails. Data is replicated to prevent loss and to enable rapid recovery.; ; Operationally, resilience is strengthened through capacity headroom, surge handling, and continuous health monitoring. Ingestion pipelines can buffer or queue events during transient outages, ensuring logs are not lost. Planned maintenance is carried out using rolling updates so the service remains available.
• Outage reporting: A dashboard and email and SMS alerts are available

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: All management interfaces are only accessible by named and security vetted individuals via a two factor authenticated session on an IPSEC v2 VPN tunnel. All connections are logged and audited. Multiple failed attempts automatically lock the individual user account with automated notification sent. All passwords are timed and must be unique and can't be recycled. Cirro also support Software Defined Networking (SDN) virtualisation technologies, including Network Virtualization using Generic Routing Encapsulation (NVGRE) and Virtual Extensible LAN (VXLAN). These technologies are designed to supported better connectivity, access and scalability specifically for cloud computing environments.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow ISO 27001 Information Security Management Systems (ISMS) and CSA guidelines as well as best practice for Cyber Security. Our providers are accredited to the appropriate standards, such as ISO 27001, 9001, PCI DSS, Cyber Security Essentials. Cirro will be completing ISO 27001 independently. Reporting - our Designated DPO monitors compliance with policies. Any incidents or deviations from policy are reported from the service manager directly with the Account Manager is also informed

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Change is managed through an ITILV4 compliant process
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: All systems are scanned for vulnerabilities every month. Cirro uses the Common Vulnerability Scoring System (CVSS) for all Common Vulnerabilities and Exposures (CVE) provided by the National Vulnerability Database. Scoring for non-CVE vulnerabilities is provided by UB’s vulnerability scanning tool. A priority is placed on patching or mitigating the vulnerability based on these scores and the logical location of the vulnerability within Cirro's network infrastructure. Remediation occurs within 10 business days for critical vulnerabilities.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Our protective management approach for VDI focuses on preventing service disruption, data loss, and security compromise. This includes layered security controls such as strong identity and access management, multi-factor authentication, network segmentation, and least-privilege access. Continuous monitoring is used to detect performance degradation, security threats, and anomalous user behaviour. Regular patching, vulnerability management, and configuration hardening protect the VDI platform and hosted desktops. Capacity and resilience are proactively managed through redundancy, backup, and tested recovery procedures. Changes are tightly controlled and tested to minimise risk, ensuring the VDI service remains secure, resilient, and available.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: No
• Incident management approach: Prevention: The understanding of and application of insight gained from the intelligence Detection: The interpretation of any events of interest occurring to discriminate between legitimate and abnormal events to identify anomalous activity Investigation: The analysis of anomalies to determine whether they are emerging threats that may lead to a security incident Reaction: Our analysts use tailored, predefined and configured Playbooks to efficiently inform their reaction to an identified threat Response: The planning of effective mitigation in response to the cyber-attack, the communication of these plans to all relevant stakeholders, and the collaboration with all relevant parties to carry out mitigation.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Police National Network (PNN)
  • Joint Academic Network (JANET)
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Contact Cirro for a demonstration of the service

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 2.5%
• Between £2,500,001 and £5,000,000: 3%
• Over £5,000,001: 5%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: IQS Audits Ltd
• ISO/IEC 27001 accreditation date: Monday 14 July 2025
• What the ISO/IEC 27001 doesn’t cover: All Cirro´s operations are covered
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: IQS Audits Ltd
• ISO 9001 accreditation date: Monday 14 July 2025
• What the ISO 9001 doesn’t cover: All operations are covered
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 444257b3-e39b-43a1-ac7a-38aaaf1c49ff
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 0f502da2-6ecb-4b4e-a52f-8c9c99388c62
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
  • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
  • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
  • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
  • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
  • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
  • Plans to respond flexibly and adapt approaches to community engagement and initiatives
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gov@cirro.dev. Tell them what format you need. It will help if you say what assistive technology you use.