NTT DATA BUSINESS SOLUTIONS LIMITED

NTT DATA Business Solutions - SAP Business One Hosting

The SAP Business One application offers an affordable way to manage your entire business – including accounting/financials, purchasing, inventory, sales, customer relationships, project management and operations and HR. SAP Business One streamlines processes, gains greater insight into your business, allowing you to act fast/make decisions based on real-time information.

Features

Real-time Insights and build-in analytics
Intelligent automation for SAP Business One with 6-automation best-practice templates
Service layer and open API for integration
Multi-currency and Multi-language - Supports 28 languages and 50 countries
Scalable and Flexible, the system effortlessly adapts to evolving needs
Complete set of tools to manage/streamline your entire business processes
Available on Premise or on Cloud
Mobile app and Web client available

Benefits

Affordable: low total cost of ownership
Comprehensive: all your departments needs from one solution
Quick and easy to implement, up and running in weeks/months
Designed for small/midsized companies to grow with you
Flexible, modular, yet powerful and user-friendly interface
Industry solutions and extensions tailored to your needs
850 and more local partners implementing in 170 countries
SAP’s Best-Selling ERP Solution by 75,000 customers worldwide

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Info-solutions-uk@bs.nttdata.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

Contact

NTT DATA BUSINESS SOLUTIONS LIMITED Philip Newman
Telephone: 07554555951
Email: Info-solutions-uk@bs.nttdata.com

About your service

Service categories

IaaS

IaaS Compute

Virtualised x86

Memory optimised

Service scope

Service constraints: Application upgrades are organised at the customer discretion, rather than automatically. This is to allow the customer to customise the solution to fit the business needs with a wide range of functionality extensions.
System requirements: Citrix Workspace receiver for thick client

AN install is not required if consuming SAP via browser
Cloud deployment model: Private cloud

User support

Email or online ticketing support: Yes
Support response times: Response times based on priority of the incident raised. Initial response times based on priorities outlined below.

P1 – IRT: within 1 hour of case submission

P2 – IRT: within 4 hours of case submission

P3 – IRT: within 1 business day of case submission

Acknowledgement of a newly logged ticket is immediate, with SLA defined by the priority of the ticket.

Response times are 24 hours, 5 days a week.

Users can manage, view, update tickets via the online portal.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.2 AA
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: Yes
Web chat support availability: 9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard: WCAG 2.2 AA
Web chat accessibility testing: No testing undertaken with assistive technology users.
Onsite support: Yes, at extra cost
Support levels: SAP Software Enterprise Support is included in the subscription fees outlined for this cloud service.

Additional support levels can be provided at additional cost.

SAP Preferred Success is an enhanced support offering provided by SAP over and above Enterprise Support. See separate Lot Listing for details.

NDBS can provide a fully tailored application and technical management support service having been providing support services to the SAP community since 1989, unique in the market. A global SAP certified partner, we offer the benefit of global capabilities with local presence.

Global SAP PCoE Certification which ensures adherence to standards set by SAP. NDBS are ISO9001 and ISO27001 certified providing assurance of quality for our flexible support models that are flexible to demands from the customer.

See separate Lot 3 Listing ‘NTT DATA – SAP Cloud Support Services’ for pricing details.

Governance of the service is provided by an assigned NDBS UK Service Delivery Manager, providing governance across all areas of the service including service management, incident and change management, continual service improvement and customer satisfaction.
Support available to third parties: Yes
AI chatbot: No

Onboarding and offboarding

Getting started: For new customers to SAP, onboarding to the service is generally undertaken as an activity during an implementation project, where the SAP application is personalised to the customer. 

 

Skills transfer is provided through a combination of  

in-project coaching,  

structured self-learning,  

on-line help within the application 

SAP Best Practice set-up and test scripts 

Other application specific learning tools. 

 

Full documentation for the service is available on-line to customers.

 

Additional training can be provided through the implementation process, such as classroom training, at additional cost.
Service documentation: Yes
Documentation formats: PDF
End-of-contract data extraction: During the subscription term, the customer can access its Customer Data at any time. The customer may export and retrieve its customer data in a standard format.

Data can be exported as csv file or the customer can have a copy of the database, the data format depends on the database engine used: Microsoft SQL or HANA.

A full database backup including any related flat files can also be provided.
End-of-contract process: End of contract process: the contract is renewed automatically at the end of each term, unless cancelled (90 days before).
Documentation accessibility standard: WCAG 2.2 AA

Using the service

Web browser interface: Yes
Using the web interface: SAP Business One, Web client is based on SAP Fiori design principles and encapsulating SAP Business One core processes and business logic.

The Web client reads and writes from and to the same company database you use with SAP Business One.

It is available for both MS SQL and SAP HANA version. With the Web client, you can:

Create, process, and update marketing documents and master data.

Create and track activities.

Create and manage document drafts including approval process.

Benefit from sophisticated analytical charting capabilities and predefined analytics content.

Utilize user-defined fields, tables and objects.

Choose your preferred deployment option: on-premise & on the cloud, can be used side-by-side the SAP Business One client.

Accessing the SAP Business One in a Web Browser.

Prerequisites:

You have ensured that you can log in to the SAP Business One client installed on the Browser Access server.

You are using one of the following Web browsers:

Mozilla Firefox.

Google Chrome.

Microsoft Edge (Ensure that you have enabled Automatically Detect Intranet Network).

Apple Safari (Mac and iPad) (Ensure that you have enabled Adobe Flash Player. This is a prerequisite for Crystal dashboards.
Web interface accessibility standard: WCAG 2.2 AA
Web interface accessibility testing: No testing undertaken with assistive technology users.
API: Yes
What users can and can't do using the API: The SAP Business One Service Layer is a modern, RESTful API built on OData, providing developers with a secure way to connect external applications to SAP Business One.

Key Capabilities:

Users can perform full CRUD (Create, Retrieve, Update, Delete) operations on core business objects, UDFs, UDTs, and UDOs. This allows for rich integrations, including web and mobile applications. It supports advanced querying (filtering, sorting) using OData syntax and is configurable for security (HTTPS/OAuth) and performance (session settings, distributed deployment). Furthermore, it enables batch operations for efficiency.

Key Limitations:

The Service Layer enforces data integrity by strictly limiting direct database access. Users cannot execute ad-hoc SQL DML or stored procedures; all data modifications must pass through the validated API endpoints. Complex, non-standard queries must first be saved in the SAP B1 Query Manager. It also requires managing session timeouts and adhering to data packet limits (pagination). It serves as the essential, secured integration layer for modern SAP B1 development.
API automation tools: Other
Other API automation tools: SAP Business One Service Layer
API documentation: Yes
API documentation formats: HTML
Command line interface: Yes
Command line interface compatibility: Linux or Unix

Windows
Using the command line interface: SAP Business One runs on Windows 2022 and SUSE Linux Enterprise Edition. SAP Business Once cannot be customised from the command line interface. additional data specific to your business. These UDFs can be added to master data, documents, or transactional screens, providing flexibility in tracking and analyzing information relevant to your business processes.

Scaling

Independence of resources: Our SAP B1 deployment is based on a single-tenant architecture. Each client sits within their own AWS Account. Multi-VPC architecture allows client workloads to be isolated from different parts of our client's infrastructure, simplifies and improves security due to less error-prone and more precise access control. User workloads are not affected by other users placing a demand on the service.
Usage notifications: Yes
Usage reporting: Email
Optimising consumption: Yes
Automatic scaling: Yes

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

Other
Other metrics: RAM

Platform uptime
Reporting types: Reports on request
Resource tagging: No
FOCUS resource tagging: No

Resellers

Supplier type: Reseller (no extras)
Organisation whose services are being resold: SAP

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: No
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v4.0

Physical access control, complying with SSAE-18 / ISAE 3402
Data sanitisation process: Yes
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Backup and recovery

Backup controls: Amazon EBS provides the ability to create snapshots (backups) of any Amazon EBS volume. It takes a copy of the volume and places it in Amazon S3, where it is stored redundantly in multiple Availability Zones.

EBS volumes for EC2 Instances (virtual machines), SAP-HANA Instances backed up once every 24-hours.

Each volume attached to the EC2-instance is backed up using a 7-day Retention period. Each EC2 instance thereby will have 7 snapshots of their EBS volumes at any given time going back 7-days. Apart from the above, there are scheduled SAP-HANA Schema backups used for SAP-HANA Application-level recovery on demand.
Datacentre setup: Multiple datacentres with disaster recovery
Scheduling backups: Supplier controls the whole backup schedule
Backup recovery: Users contact the support team
Backup and recovery: Yes
RPO/RTO: Yes

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability: 99.9%

If service availability is breached service credits are issued.
Approach to resilience: Additional information available upon request.
Outage reporting: Service outages are reported via email, which includes a RCA (Root Cause Analysis)

Identity and authentication

User authentication needed: Yes
User authentication: Multi-Factor Authentication (MFA)
Access restrictions in management interfaces and support channels: At least once a year via specific protocols embedded.
Access restriction testing frequency: At least once a year
Management access authentication: Multi-Factor Authentication (MFA)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password
Devices users manage the service through: Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: User-defined

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: CSA CSM version 4.0
Information security policies and processes: ISO 27001 and SOC 2 Type 1.

The policies are enforced by the infosec team and IT controls are in place to ensure these are followed. Regular online training sessions are enforced and tracked for all employees throughout the employment term. All new starters go through a security induction program.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: A change control process is in place to control changes to all critical company information resources (i.e., hardware, software, system documentation and operating procedures). This includes management responsibilities/procedures.  Wherever practicable, operational and application change control procedures should be integrated. The change control process should include the following phases:

Logged Change Requests;

Identification, prioritization and initiation of change;

Proper authorization of change;

Requirements analysis;

Inter-dependency and compliance analysis;

Impact Assessment;

Change approach;

Change testing;

User acceptance testing and approval;

Implementation and release planning;

Documentation;

Change monitoring;

Defined responsibilities and authorities of all users and IT personnel;

Emergency change classification parameters.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Vulnerabilities identified on a regular basis via scanning, and must be remediated in accordance CVSS score.

The scope of scans is regularly reviewed, to ensure new or changed systems are discovered and added to the regular scanning cycle

Security risks must be reviewed before the next patching cycle.

o CRITICAL – Will be considered a security incident and managed through the incident management process

o HIGH – Within 30 days of the patch being released

o MEDIUM – Within 180 days of the patch being released

o LOW/NONE – Patching not required but should be patched along with MEDIUM risks
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: There is a Global Incident Management Policy in place at NDBS

Please be aware we are not permitted to share copies of our internal policies. Security Policies meet ISO27001 requirements. If required, after signing an NTT DATA Business Solutions Non-Disclosure Agreement the Title and Contents pages may be shared.
Incident management type: Supplier-defined controls
Incident management approach: NDBS provide clearance checks as part of any staff onboarding, however specific clearance checks can be organised on request, for example for customers working in government sectors or industries with certain compliance regulations. If a cost is associated with the clearance checks, this would be reviewed with the commercial team.
Post-quantum cryptography secure: No

Secure development

Approach to secure software development best practice: Supplier-defined process

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
Who implements virtualisation: Third-party
Third-party virtualisation provider: AWS
How shared infrastructure is kept separate: We use virtual machines from AWS. We separate information from different orgs by creating a separate AWS account for each customer. This makes that the whole environment of a customer can´t see other customer environment.

Energy efficiency

Energy-efficient datacentres: No

Pricing

Discount for educational organisations: No
Free trial available: No

Discount

Provide your minimum discount applicable to your baseline prices: 0%

Formula for calculating price of your services

Which of the core deployment models you intend to offer

Private Cloud

Private Cloud - Formula for calculating price of your services

Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
=
Baseline Pricing: The baseline pricing is calculated based on the core components required to design, build, and operationally hand over a secure and supported environment.

These services cover hosting build coordination and the creation of a dedicated AWS account, followed by server build and configuration activities. Security and access controls are established through multifactor authentication (MFA) and user creation, alongside configuration of file server services.

The baseline also includes publishing external URLs, application publishing via Citrix and/or RDWeb, and associated server troubleshooting to ensure the environment is stable and ready for use. Final activities include support transition and customer handover, supported by the production of a Hosting Design Document that captures the agreed architecture and configuration.

Together, these elements ensure a production-ready hosting environment.

The pricing is calculated using variable such as the software to be installed, the selected AWS data centre location, and the anticipated number of users, all of which influence infrastructure sizing, performance, and regional hosting costs.
-
Minimum Discounting: 0%
+
Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
+
Additional sources of cost: Costs associated with this deployment model may increase depending on the scale, security, and connectivity requirements of the service. Infrastructure costs are influenced by server size and performance requirements, including compute, storage, and resilience levels needed to support the solution. Where integration with external or on-premise systems is required, additional integration servers may be needed, increasing hosting and support costs.

Secure connectivity requirements can also increase cost. For example, the use of VPNs or private network connections to buyer environments introduces additional configuration, licensing, and ongoing management overheads.

User-based costs may apply where pricing is linked to the number of named or concurrent users, as this impacts capacity planning, access management, and support effort. An increase in user numbers may require larger server instances or additional application servers to maintain performance and availability.

Other potential cost sources include environment build and configuration activities, security controls such as authentication services, and ongoing operational support and monitoring.

Together, these factors ensure the solution is appropriately sized, secure, and aligned to the buyer’s operational requirements.
-
Additional sources of cost reduction: One source of cost reduction is the ability to lower availability or resilience options for noncritical environments, reducing infrastructure and hosting costs where high availability is not required.

Longer contract terms may also enable improved commercial arrangements, providing greater cost efficiency and budget predictability over the duration of the contract. Additional savings can be achieved through the use of savings plans and reserved instances, which offer discounted pricing in exchange for committed levels of usage when compared to on-demand consumption.

Storage lifecycle management provides further opportunities for cost optimisation by automatically transitioning data to lower-cost storage tiers based on usage and access patterns, ensuring buyers only pay premium storage costs where necessary.

These approaches allow buyers to reduce overall service costs while maintaining appropriate levels of performance, security, and operational support, ensuring value for money throughout the contract term.

Mandatory certifications

Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

Reseller

Cloud service suppliers you intend to resell with evidence

Organisation 1

Organisation name

AWS