Six Degrees Technology Group Limited

Windows 365 Managed Service

Our Windows 365 (“W365”) Managed Service provides you management services for your Windows 365 Enterprise Cloud PCs which run in Microsoft 365. Please see the attached Service Description for more details.

Features

• W365 infrastructure setup and configuration to Windows OS level.
• Windows OS quality updates.
• Managed Microsoft Defender for Endpoint Service.
• Break/Fix Support - investigating/resolving server-side problems with your W365 platform.
• Change management support.

Benefits

• Enable an effective Windows 365 solution for your users.
• Access to specialist support for maintenance or guidance.
• Delivered in-line with best practices.
• Azure Expert MSP with awarded five Microsoft Solutions Partner designations

£34.90 to £104.80 a unit a month

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Publicsector.sales@6dg.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

429956516650220

Contact

Six Degrees' Public Sector team
08000128060
Publicsector.sales@6dg.co.uk

Service scope

• Service constraints: Please see attached Service Description for dependencies on this service.
• System requirements: Please see Service Description for requirements to utilise this service.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Dependant on incident/request and priority level - please see attached Service Description for details.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 A
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Please see attached Service Description for support levels.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Please see a list of standard Service Implementation activities within the attached Service Description.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Online videos and interactive learning portals
• End-of-contract data extraction: Customer are able to remove their data at any time through the same means they uploaded. Either over their network (internet or express route) or via the Azure Import/Export services. Also see https://www.microsoft.com/en-us/trustcenter/privacy
• End-of-contract process: Please see https://www.microsoft.com/en-us/trustcenter/privacy/you-own-your-data. In our Online Services Terms, Microsoft contractually commits to specific processes when a customer leaves a cloud service or the subscription expires. This includes deleting customer data from systems under our control. If you terminate a cloud subscription or it expires (except for free trials), Microsoft will store your customer data in a limited-function account for 90 days (the “retention period”) to give you time to extract the data or renew your subscription. During this period, Microsoft provides multiple notices, so you will be amply forewarned of the upcoming deletion of data. After this 90-day retention period, Microsoft will disable the account and delete the customer data, including any cached or backup copies. For in-scope services, that deletion will occur within 90 days after the end of the retention period. (In-scope services are defined in the Data Processing Terms section of our Online Services Terms.) See http://www.microsoftvolumelicensing.com/Downloader.aspx?DocumentId=13655

Using the service

• Web browser interface: Yes
• Using the web interface: W365 can be accessed through supported modern web browsers.
• Web interface accessibility standard: WCAG 2.1 AA or EN 301 549
• Web interface accessibility testing: See https://www.microsoft.com/en-us/accessibility/
• API: No
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: W365 represents a hyper-scale public cloud service.
• Usage notifications: No

Analytics

• Infrastructure or application metrics: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: See http://download.microsoft.com/download/0/D/D/0DD8FB12-6343-4A50-80B2-545F2951D7AE/MicrosoftAzureDataProtection_Aug2014.pdf , and https://docs.microsoft.com/en-us/azure/storage/storage-service-encryption
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: No

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: For data in transit, Azure uses industry-standard secure transport protocols, such as TLS/SSL, between user devices and Microsoft datacentres. You can enable encryption for traffic between your own virtual machines (VMs) and your users. With Azure Virtual Networks, you can use the industry-standard IPsec protocol to encrypt traffic between your corporate VPN gateway and Azure as well as between the VMs located on your Virtual Network.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: ACL Based Network Security Groups are also used. See https://azure.microsoft.com/en-us/blog/network-security-groups/

Availability and resilience

• Guaranteed availability: See Microsoft's Online Service Terms at http://www.microsoftvolumelicensing.com/Downloader.aspx?DocumentId=13655
• Approach to resilience: Please see https://www.microsoft.com/en-us/cloud-platform/global-datacenters and https://www.microsoft.com/en-us/TrustCenter/
• Outage reporting: Please see https://azure.microsoft.com/en-us/status/ and https://portal.azure.com/#blade/HubsExtension/ServicesHealthBlade

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google apps)
  • Username or password
  • Other
• Other user authentication: Azure Active Directory is Microsoft’s multi-tenant cloud based directory and identity management service. Azure-AD provides an affordable, easy to use solution to give employees and business partners single sign-on (SSO) access to thousands of cloud SaaS Applications like Office365, Salesforce.com, DropBox, and Concur. For application developers, Azure-AD lets you focus on building your application by making it fast and simple to integrate with a world class identity management solution used by millions of organizations. Azure-AD also includes a full suite of identity management capabilities including multi-factor authentication, device registration, self-service password management, self-service group management, privileged account management.; ; https://docs.microsoft.com/en-us/azure/active-directory/active-directory-whatis
• Access restrictions in management interfaces and support channels: Azure-AD can designate separate administrators to serve different functions. These administrators will have access to features in the Azure portal and, depending on their role, will be able to create or edit users, assign administrative roles to others, reset user passwords, manage user-licenses, and manage domains, among other things. A user who is assigned an admin role will have the same permissions across all of the cloud services that your organization has subscribed to, regardless of whether you assign the role in the Office365 portal, or in the Azure classic-portal, or by using the Azure-AD module for Windows PowerShell.; ; https://docs.microsoft.com/en-us/azure/active-directory/active-directory-assign-admin-roles
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: See https://docs.microsoft.com/en-gb/azure/role-based-access-control/manage-access-to-azure-resources
• Devices users manage the service through: Dedicated device on a segregated network (providers own provision)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: 03/10/2022
• What the ISO/IEC 27001 doesn’t cover: This relates to Six Degrees' own security accreditations, for our platforms and service. Microsoft have their own set of accreditations.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: IT Governance
• PCI DSS accreditation date: 08/11/2023
• What the PCI DSS doesn’t cover: Only the physical and environmental security at the data centres we use in our operations were included in this assessment. The relates to the provision of the secure physical environment for the Colocation Services that Six Degrees provides to its clients. All other services provided by Six Degrees, internal systems supporting business operations or for other clients are specifically excluded from this assessment.; ; This relates to Six Degrees' own security accreditations, for our platforms and service. Microsoft have their own set of accreditations.
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • ISO 9001
  • ISO 22301
  • PSN Compliance Certified
  • SOC 1 Type 2
  • SOC 2 Type 2

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: FACT, FedRamp, NIST 800-171, EU Model Clauses, Cyber Essentials Plus
• Information security policies and processes: An Information Security Management Program has been established to enable Microsoft Azure to maintain and improve its management system for information security. Through establishment of the ISMS, Azure plans for and manages protection of its assets to acceptable security levels based on defined risk management processes. In addition, Azure monitors the ISMS and the effectiveness of controls in maintaining the confidentiality, integrity and availability of assets to continuously improve information security. ; ; The ISMS framework encompasses industry best-practices for information security and privacy. The ISMS has been documented and communicated in a customer-facing Information Security Policy, which can be made available upon request (customers and prospective customers must have a signed NDA or equivalent in place to receive a copy).; ; Microsoft Azure performs annual ISMS reviews, the results of which are reviewed by management. This involves monitoring ongoing effectiveness and improvement of the ISMS control environment by reviewing security issues, audit results, and monitoring status, and by planning and tracking necessary corrective actions.; Also see https://www.microsoft.com/en-us/TrustCenter/Compliance/ISO-IEC-27001 and The Microsoft Cloud Security Policy is available via the Service Trust Platform aka.ms/stp

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Azure has developed formal standard operating procedures (SOPs) governing the change management process. These SOPs cover both software development and hardware change and release management, and are consistent with established regulatory guidelines including ISO 27001, SOC 1 / SOC 2, NIST 800-53, and others.; ; Microsoft also uses Operational Security Assurance (OSA), a framework that incorporates the knowledge gained through a variety of capabilities that are unique to Microsoft including the Microsoft Security Development Lifecycle (SDL), the Microsoft Security Response Center program, and deep awareness of the cybersecurity threat landscape. ; Please see https://www.microsoft.com/en-us/SDL/OperationalSecurityAssurance and https://www.microsoft.com/en-us/sdl
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: When providing the Antimalware solution for Virtual Machines, Azure is responsible for ensuring the service is highly available, definitions are updated regularly, that configuration through the Azure Management Portal is effective and that the software detects and protects against known types of malicious software. MCIO-managed hosts in the scope boundary are scanned to validate anti-virus clients are installed and current signature-definition files exist.; ; Vulnerability scans are performed on a quarterly basis at a minimum. Microsoft Azure contracts with independent assessors to perform penetration testing of the Microsoft Azure boundary.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Microsoft Azure employs sophisticated software-defined service instrumentation and monitoring that integrates at the component or server level, the datacentre edge, our network backbone, Internet exchange sites, and at the real or simulated user level, providing visibility when a service disruption is occurring and pinpointing its cause.; ; Proactive monitoring continuously measures the performance of key subsystems of the Microsoft Azure services platform against the established boundaries for acceptable service performance and availability. When a threshold is reached or an irregular event occurs, the monitoring system generates warnings so that operations staff can address the threshold or event.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Microsoft has developed robust processes to facilitate a coordinated response to incidents. ; • Identification – System and security alerts may be harvested, correlated, and analysed. ; • Containment – The escalation team evaluates the scope and impact of an incident. ; • Eradication – The escalation team eradicates any damage caused by the security breach, identifies root cause for why the security issue occurred. ; • Recovery – During recovery, software or configuration updates are applied to the system and services are returned to a full working capacity.; • Lessons Learned – Each security incident is analysed to protect against future reoccurrence.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: Hyper-V
• How shared infrastructure is kept separate: Please see https://www.microsoft.com/en-us/TrustCenter/Security/default.aspx

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Please see https://www.microsoft.com/en-us/environment/energy

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  We have an established environmental committee that is specifically focussed on ensuring that we apply an approach of continuous improvement in relation to environmental compliance and good practice. As part of our environmental commitments, we are aligned to ISO 14001(Environmental Management) and have a published Carbon Reduction Plan on our website, which was measured and recorded in accordance with GHG Protocols and Procurement Policy Note 06/21. ; ; We will be reviewing our footprint on an annual basis and carrying out actions identified to reduce our footprint. We are committed to achieving Net Zero by 2050 at the latest. During this time, targets will be set for the remaining period to ensure Net Zero will be achieved by our target date. We are aiming to reduce our absolute carbon emissions by at least 90% from our baseline year or achieve (and maintain) a carbon intensity metric of <1 tonne CO2e per employee, whichever comes soonest. This is in line with science-based Net Zero targets. ; ; Our largest environmental burden is the use of power in our datacentres. We use technology designed specifically to manage power consumption. We are very proud to have switched our data centres fully to use green and renewable energy. ; ; Our focus on environmental performance as a supplier under this framework will benefit you as you strive to achieve your own Net Zero targets. ; ; As a leading Microsoft partner, we can work with Microsoft to help you understand the carbon footprint for your existing estates, and how a transition to hybrid/public cloud could help reduce it. As part of any agreement under this framework we can also engage with your local communities to promote environmental awareness or engage in projects that benefit the environment.

  Tackling economic inequality

  Six Degrees supports this theme in several ways. Firstly, by working with local communities to provide mentoring and job opportunities. We take pride in employing local people and offering new opportunities as they arise. We do this through our internal Talent Acquisition (TA) team, who are actively building richer and deeper contacts within the local community to raise aspirations of people from all backgrounds. ; ; We seek to encourage local people to work within the technology sector by removing barriers to entry, for example through behavioural interviewing with objective behaviours that actively seek to remove bias (unconscious or otherwise) in recruitment and individual development discussions. Our TA team partner with local universities, schools and colleges to support careers fairs and our subject matter experts provide talks on IT or cyber security to local students. ; ; We are also very passionate about our ‘Women in Tech’ group, which seeks to encourage women into IT through all sorts of activity, such as webinars, school visits and other events. We are continuously planning new events and initiatives under this scheme, which we could then offer to buyers and their community as part of engagements on this framework. ; ; Secondly, we will tackle economic inequality and the digital skills gap through creation of new skills & jobs in the high-growth cyber security sector. Our cyber apprenticeship programme, sponsored by our People Business Partner & Cyber Consultancy Director, provide skills and accreditations that enable our people to progress in cyber security or transition into that space. ; ; We also run in-person events, known as ‘Cyber University’, as an education scheme for our Buyers based on our extensive knowledge and experience in Cyber Security. Cyber University provides an open forum for customers to create new skills in Cyber Strategy, best practice approaches and the latest in Cyber Security.

  Equal opportunity

  We recognise that people are more likely to be engaged and productive if they are rewarded fairly and offered flexibility to help achieve a positive work life balance. We therefore pay at the Real Living Wage in all of our roles, and remain committed to our ongoing pay review process to ensure all our employees are fairly rewarded. Six Degrees also has a continuous focus on closing the gender pay gap in our company, with our latest report available on our website. ; ; We recognise that females are underrepresented in education, training and employment related to STEM. To combat this, we have introduced several strategies to bring new females into the organisation. These include our engagement with schools, colleges, and universities to raise the aspirations of females toward tech. Our goal of ensuring every recruitment shortlist contains as least one female, and our offer of a guaranteed interview for every shortlisted female. ; ; We have collaborated with the Employers Network for Equality & Inclusion (ENEI), achieving a bronze TIDE Award in our first two years of collaboration. Through our continued devotion to improving, we were awarded a silver status in 2023. Through this partnership we have focused our work around seven critical areas of inclusion – our workforce, our strategy and plan, leadership and accountability, recruitment and attraction, training and development, employment practices, and communication.; ; We have zero tolerance to slavery in any form, but by no means limited to, bonded labour, debt bondage, serfdom, forced labour, child slavery, marital slavery, sexual slavery and/or human trafficking. We expect all those in our supply chains to comply with our values and the Modern Slavery Act 2015, which is governed by our Supplier Management and Sustainable Procurement Policy.

  Wellbeing

  Supporting our workforce’s health and wellbeing is crucial to Six Degrees. We have established an employee network, known as the 360 Degrees Group, which is made up of people who are passionate about making a difference from across all different business units, with an Executive-level sponsor and SLT-level sponsors for each sub-group or initiative. The initiatives include: ; ; - Including Everyone, Everywhere: Our forum which focuses on diversity and inclusion: it’s about creating a Six Degrees where everyone feels able to bring their truest self to work.; ; - Healthy Minds, Healthy Lives: Our forum for mental health and general wellbeing. A healthy mind and body is at the core of being happy and productive at work and at home.; ; - For The Benefit of Others: There’s something that touches, motivates or inspires all of us; this is a forum which focuses on charity fundraising, on making a positive mark on the communities which Six Degrees touches, and on making this a greener place to work.; ; We operate a well-being calendar led by Healthy Minds, Healthy Lives and also have certified Mental Health First Aiders across the business, demonstrating our commitment to providing our workforce with wellbeing support. ; ; We have a significant focus on building awareness and promoting dialogue around health and wellbeing: our Women in Tech committee talks about female health, and for June (Men’s Health Awareness Month) they will be promoting awareness of men’s health, for example testicular and prostate cancers.; ; Under the 3rd initiative we actively encourage community engagement through numerous social value activities. These include collaborative and individual fundraising projects for our partnership with Macmillan as well as promoting events within communities. In 2019 we sponsored the Women in IT awards and have also sponsored a Tough Mudder charity event.

Pricing

• Price: £34.90 to £104.80 a unit a month
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Publicsector.sales@6dg.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.