Fujitsu Services Limited

Oracle Exadata to Cloud

Fujitsu will help you move your existing Exadata solution to either Oracle Exadata Cloud Service or Oracle Database Exadata Cloud at Customer, delivering the world’s most advanced database cloud. Our Oracle-based private cloud service is designed for the UK Public Sector, is GDPR compliant and suitable for OFFICIAL workloads.

Features

• Exadata Engineered Systems
• Host Oracle systems within Cloud Infrastructure inside own datacentre/Fujitsu’s
• Connect Oracle Cloud to non-Oracle workloads in the cloud
• Connectivity to government networks; PSN, Janet, HSCN, N3, RLI
• Opt to receive managed service for your Private Oracle Cloud

Benefits

• Retain your investment in Oracle technology
• Condense your on premise infrastructure footprint
• Improve data locality by putting Oracle in Cloud
• Host Exadata applications in the cloud
• Remove commercial overhead of hosting Oracle infrastructure in different location
• Have confidence in who has access to your data
• Solutions on a cloud that aligns with NCSC best practice
• Use known technologies to de-risk your cloud transition - Consistency
• Make compelling citizen facing services, whilst ensuring data remains safe
• Evergreen your infrastructure strategy with no need to refresh

£300 a unit

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at government.frameworks@fujitsu.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

721035970442694

Contact

Sam Skinner
07867829234
government.frameworks@fujitsu.com

Service scope

• Service constraints: Not Applicable
• System requirements:
  • A definitive IT asset view of their current IT estate
  • A high level design of how future state would look
  • Transformation plan to move from current state into future state
  • And a detailed cost

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: It will depend on the contract agreement as to what Fujitsu response times will be.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 AAA
• Web chat accessibility testing: Not Applicable
• Onsite support: Onsite support
• Support levels: Not applicable
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Fujitsu will provide initial onsite experts to help get the Customer up and running. Then onwards Expert support will be provide at pre-determined level.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: Not Applicable
• End-of-contract process: Exit from the service is part of the agreement. Users will need to move their solutions to new infrastructure at end of contract if they wish.

Using the service

• Web browser interface: Yes
• Using the web interface: Contact Service Desk Experts
• Web interface accessibility standard: WCAG 2.1 AAA
• Web interface accessibility testing: Not Applicable
• API: No
• Command line interface: Yes
• Command line interface compatibility:
  • Linux or Unix
  • Windows
• Using the command line interface: Users can spin up environments and access other services available for the relevant licenses they have acquired

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Each VM Cluster is independent from the other clusters; Grid Infrastructure, Listener, ASM disks, and InfiniBand partition; Each VM Cluster has its own isolated client and backup networks; VM Cluster networks are isolated from each other at layer 2 (Ethernet)
• Usage notifications: Yes
• Usage reporting:
  • API
  • Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
• Other metrics:
  • Customers control and manage software that directly affects their application
  • Authentication to access customer VMs
  • Customer’s have root access to customer VMs
  • Database, Grid Infrastructure, agents, operating system, etc.
  • Customers configure and run databases as they like.
  • Invoke Cloud Automation to perform administrative tasks
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Oracle

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Security of data at rest is achieved through encryption of data stored in database data files and backups.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up: This will all depend on how the solution is architected
• Backup controls: Architecture will drive this
• Datacentre setup:
  • Multiple datacentres with disaster recovery
  • Single datacentre with multiple copies
  • Single datacentre
• Scheduling backups: Users contact the support team to schedule backups
• Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection between networks: Connections secured by Oracle Net Encryption; Database files encrypted by TDE; Protection from privileged users through Database Vault; Sensitive data secured by Label Security, Data Masking and Subsetting
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection within supplier network: Connections secured by Oracle Net Encryption; Database files encrypted by TDE; Protection from privileged users through Database Vault; Sensitive data secured by Label Security, Data Masking and Subsetting

Availability and resilience

• Guaranteed availability: Exadata in an MAA configuration is recognized by the analyst firm IDC as a system that delivers at least 99.999% availability and is categorized in the IDC AL4 fault-tolerant market segment.
• Approach to resilience: All outages will be reported via the Service Status page and the notifications service within the portal. Outages are identified as Planned maintenance, Emergency maintenance, and platform issues. In addition, the designated Technical Account Manager will proactively contact customers as appropriate.
• Outage reporting: No

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
• Access restrictions in management interfaces and support channels: Customers have the option to raise a support request via telephone or email. Fujitsu will always authenticate the identity of the user by validating known phone numbers and asking them for specific characters within their pre-agreed memorable word
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Bureau Veritas
• ISO/IEC 27001 accreditation date: 06/01/2022
• What the ISO/IEC 27001 doesn’t cover: ISO 27017 has been included within scope of our ISO/IEC 27001:2013 certification.
• ISO 28000:2007 certification: Yes
• Who accredited the ISO 28000:2007: NA
• ISO 28000:2007 accreditation date: NA
• What the ISO 28000:2007 doesn’t cover: NA
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: CSA STAR, ISO27001, ISO27017, ISO27018 and ISO20000
• Information security policies and processes: The Company is governed by an integrated suite of information security policies. Under the top level Information Security Policy itself are second-level documents with specific focus on Acceptable Use, Antivirus Protection, Asset Management, Business Continuity Management, Data Protection, Password Management, Personnel Management, Supply Chain Management and many others.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: In accordance with the guidance from ITIL v.3 and the current ISO20000 and ISO27001 standards. Where technically possible, real-time updates and status reports are identified and sourced from credible vendor sources.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Following best practice from the National Cyber Security Centre, protects both its Assured and Elevated platforms with 24x7 enhanced protective monitoring services, vulnerability scanning and assessment.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Following best practice from the National Cyber Security Centre, protects both its Assured and Elevated platforms with 24x7 enhanced protective monitoring services, vulnerability scanning and assessment.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Documented incident management policy and process, which have been implemented, maintained and assessed in accordance with the guidance from ITIL v.3 and the current ISO20000 and ISO27001 standards

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: Oracle VM
• How shared infrastructure is kept separate: User defined cloud networking (VCN) provides security and isolation.; An additional layer of at-rest data protection is provided by ensuring that all databases; created on the Exadata Cloud Service are encrypted with Tablespace Encryption,; using the Transparent Data Encryption (TDE) capability of the Oracle Database.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: The Strategic Fujitsu Datacentres are registered “participants” in the EU Code of Conduct for datacentres, complying with their energy efficiency guidelines conforming to ISO50001 Energy Management. The Supplier’s infrastructure planners have used optimal layouts, as determined by the EU Code of Conduct to build the service within these datacentres.

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Our Responsible Business Programme, developed on the principles of the Public Sector (SV Act 2013) delivers our corporate employee and community programme. Running parallel to the corporate programme, we deliver bespoke client-facing SV programmes within each call off contract. Programmes are fully aligned to the requirements of PPN06/20. Using our co-creation process, we undertake local initiatives, jointly developed with clients and partners, that ensure Economic, Social and Environmental benefit to communities.

  Covid-19 recovery

  Our Responsible Business Programme, developed on the principles of the Public Sector (SV Act 2013) delivers our corporate employee and community programme. Running parallel to the corporate programme, we deliver bespoke client-facing SV programmes within each call off contract. Programmes are fully aligned to the requirements of PPN06/20. Using our co-creation process, we undertake local initiatives, jointly developed with clients and partners, that ensure Economic, Social and Environmental benefit to communities.

  Tackling economic inequality

  Our Responsible Business Programme, developed on the principles of the Public Sector (SV Act 2013) delivers our corporate employee and community programme. Running parallel to the corporate programme, we deliver bespoke client-facing SV programmes within each call off contract. Programmes are fully aligned to the requirements of PPN06/20. Using our co-creation process, we undertake local initiatives, jointly developed with clients and partners, that ensure Economic, Social and Environmental benefit to communities.

  Equal opportunity

  Our Responsible Business Programme, developed on the principles of the Public Sector (SV Act 2013) delivers our corporate employee and community programme. Running parallel to the corporate programme, we deliver bespoke client-facing SV programmes within each call off contract. Programmes are fully aligned to the requirements of PPN06/20. Using our co-creation process, we undertake local initiatives, jointly developed with clients and partners, that ensure Economic, Social and Environmental benefit to communities.

  Wellbeing

  Our Responsible Business Programme, developed on the principles of the Public Sector (SV Act 2013) delivers our corporate employee and community programme. Running parallel to the corporate programme, we deliver bespoke client-facing SV programmes within each call off contract. Programmes are fully aligned to the requirements of PPN06/20. Using our co-creation process, we undertake local initiatives, jointly developed with clients and partners, that ensure Economic, Social and Environmental benefit to communities.

Pricing

• Price: £300 a unit
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Oracle Credits are available
• Link to free trial: Oracle.com

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at government.frameworks@fujitsu.com. Tell them what format you need. It will help if you say what assistive technology you use.