CCS Media Limited

Veeam Cloud Connect Backup

Veeam Cloud Connect offers simple, straight forward incremental backup and disaster recovery (DR) with minimal fuss. Without the need for expensive infrastructure, it provides a cost effective way to protect your data.

Features

• Secure Veeam Backup, Replication, and Office365 protection
• ISO 27001 accredited, Tier 3 + data centre locations
• Self-service or fully managed service options available
• UK Based 24x7 monitoring and support, 365 days a year
• Resilient connectivity
• Self service data recovery
• Full site failover for enhanced Disaster Recovery
• Hyper-V and VMware fully supported
• Veeam Platinum Partner, Microsoft Tier 1 CSP
• VMware by Broadcom Advantage Partner and VCSP

Benefits

• Protect your data from RansomWare and other malware
• Retire your expensive Tape backup solutions
• Simplify your environment
• Protect and archive your Office 365 Email, Onedrive, and Sharepoint
• Self service setup and trials
• Full DRaaS continuous replication
• Affordable and efficient image-based VM replication

£0.01 to £0.05 a gigabyte

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contractsandtenders@ccsmedia.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

456016984418566

Contact

Mike Lovett
01246 200200
contractsandtenders@ccsmedia.com

Service scope

• Service constraints: None
• System requirements:
  • VMware vSphere supported
  • Microsoft Hyper-V supported
  • Physical Servers supported
  • Desktop workstations and laptops supported

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Level 1 - Critical—(Severe Business Disruption) Business unit is unable to operate; critical system component failed or severely impaired (Response Immediate); Level 2 - High—(Major Business Disruption) Critical user or user group unable to operate, or the business unit is experiencing a significant reduction in system performance (Response 2 Hours) Level 3 - Medium—(Minor Business Disruption) A single user is unable to operate with no available work around (Response 8 Hours) Level 4 - Low—(Minor Disruption) A single user or user group is experiencing incidents, but work around is available. (Response 24 hours) Level 5 - Planning (Response 48 Hours)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 A
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The virtualDCS support service covers a vast range of options so that you receive the right level of service for your organisation. This also ensures that you do not pay for more than you need and that you have the freedom to run your systems with the in-house skill sets that you have available. Some of these options include proactive support, where we monitor and address issues as they occur; reactive support where we are on call to help you when you need it; and managed support, where we do it all for you. The cost of these solutions is dependant on the resources being supported. For large contracts, a named Service Manager is allocated to provide a consistent support service to your organisation.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Our engineers will liaise with your in-house staff to determine a suitable handover and/or plan for user training. We scope all of this early in the pre-sales process to ensure expectations are met, and services are delivered in a timely manner. For those already familiar with Veeam Backup & Replication, documentation is available from within the customer's own product installation.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: No extraction is generally required as this is not the primary source of data. Contact us for specific requirements.
• End-of-contract process: At the end of the contract, once the client confirms they have alternate access to any data still required, the remaining data is securely removed from our platform. No additional costs are incurred for this removal.

Using the service

• Web browser interface: Yes
• Using the web interface: Management of hosted resources is performed using our custom Web Portal. Users can also sign up for Office 365 backup with no software or agents to download.
• Web interface accessibility standard: WCAG 2.1 A
• Web interface accessibility testing: None
• API: Yes
• What users can and can't do using the API: API access is available using the Veeam's own REST API are detailed here:; https://helpcenter.veeam.com/docs/vac/rest/about_rest.html?ver=80
• API automation tools:
  • Ansible
  • Chef
  • Puppet
• API documentation: Yes
• API documentation formats: HTML
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Contention for resources is managed at the disk, network, and computer layers. Guarantees and limits are configurable depending on SLA agreed.
• Usage notifications: Yes
• Usage reporting: Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
• Reporting types:
  • Real-time dashboards
  • Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: VMware, Microsoft

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Files
  • Virtual Machines
  • Databases
  • Applications
  • Configurations
  • Mailboxes
  • Sharepoint Sites
  • Onedrive
  • Datacentres
• Backup controls: Users are in complete control of what items they protect, and also the frequency of that protection.
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Network availability - 99.99% Infrastructure availability - 99.99% Availability is based on the total number of operating hours of a given calendar month and excludes planned and emergency maintenance. Service credits of up to 10% of the standard monthly support fee are available for any month where the availability SLA is not met.
• Approach to resilience: Our platform has been designed to be incredibly resilient and self-healing. This means that in the unlikely event of a failure, you will be up and running again within minutes. Our enterprise platform has been designed to provide 99.999% up-time and is monitored 24 x 7 x 365 by our team of highly skilled support team. Our datacentres have: 24 Hour Manned Security 3 x N+1 Generators Resilient UPS N+1 Air Conditioning Systems Fire Suppression Systems CCTV & Intruder Alarms Diverse Fibre Entry from all major carriers Multiple T1 Carriers for Internet Transit
• Outage reporting: VirtualDCS operate a separate status website, with automated email updates to inform customers of potential issues with the environment. Email alerts are also delivered via the service desk to registered users.

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: System level management access is restricted to virtualDCS operations networks only. Per customer management access to services can optionally be restricted to specific IP addresses or networks as required.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: NQA
• ISO/IEC 27001 accreditation date: 03/12/2018
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an ISO27001-compliant information security management system. These policies and processes are audited annually by an independent audit assessment body

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We operate a change management process in accordance with our ISO 27001 certification. As part of this process, assessments are made of the risk and impact associated with any change, along with conditions required to mitigate the risks of any approved changes. Full details of our change management process are available on request.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: VirtualDCS uses an automated audit and alerting solution continuously monitors our services for irregular activity. We invoke our standard response process in the event of a suspected compromise; the response time target for such an incident is 1 hour.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: VirtualDCS uses an automated audit and alerting solution continuously monitors our services for irregular activity. We invoke our standard response process in the event of a suspected compromise; the response time target for such an incident is 1 hour.
• Incident management type: Supplier-defined controls
• Incident management approach: Our incident management process is administered through the service desk as a 'ticket'. This allows customers to log incidents (with an associated priority according to severity) with our specialists. Customers are kept updated through the service desk on the incident and are advised when progress is updated or when it is resolved. The 'ticket' is recorded and archived in the service desk and this 'ticket' forms the incident report. For severe incidents (Priority 1) a separate incident report is published and delivered to the customer on request.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: Other
• Other virtualisation technology used: Both VMware and Hyper-V environments are available.
• How shared infrastructure is kept separate: We provide secure multi-tenancy using VMware vSphere infrastructure technologies. Individual customer data is isolated to their own VMs and constraints within the hypervisor technology. VLAN tagging technology is used to isolate customer networks. Internet access is secured using dedicated virtual or physical firewalls.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: By applying good practice, and continually improving efficiency and operations to reduce energy consumption. Improving energy performance is factored into all processes. Our datacentres are certified as being compliant with ISO 50001: 2018 Energy Management

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  virtualDCS CloudCover services combat climate change by consolidating servers and reducing energy usage. They also reduce the demand for physical hardware, leading to decreased energy consumption and lower carbon emissions associated with manufacturing, operating, and disposing of such equipment. Supporting remote working initiatives through highly available data helps to reduce commuting and further lowers carbon emissions.

Pricing

• Price: £0.01 to £0.05 a gigabyte
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We offer a full, free 30-day trial, with no minimum server count.
• Link to free trial: Link to free trial https://www.virtualdcs.co.uk/veeam-cloud-connect-backup#trial

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contractsandtenders@ccsmedia.com. Tell them what format you need. It will help if you say what assistive technology you use.