CM SECURITY LTD

Cloud Backup

Cloud backup for on-premise servers and Microsoft 365

Features

• Automated backups
• Incremental and differential backup
• Military-grade encryption
• Centralised backup management
• Versioning and retention policies

Benefits

• Data protection
• Business continuity
• Peace of mind

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ronald.hulme@cmsecurity.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

770864241287470

Contact

Ronald Hulme
02033070370
ronald.hulme@cmsecurity.co.uk

About the service

• Service categories:
  • Systems Infrastructure Software
    • Storage
      • Data replication and protection
        • Backup and Recovery Reporting Software
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements: No System Requirements - Cloud-to-cloud backup solution

User support

• Email or online ticketing support: Yes
• Support response times: We aim to respond to all questions within 24 hours, Monday to Friday, from 09:00 to 17:00
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Email Only Support - Free of Charge; Telephone and Remote Support - 10% of Contract Price; Onsite Support - £1500 per day, plus expenses.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We offer a comprehensive onboarding service to help users get started with; our service. This includes remote setup, configuration, and training sessions. For those who prefer onsite assistance, we offer onsite onboarding at an additional cost.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AAA
• End-of-contract data extraction: Users can log in to their Acronis account and navigate to the storage section to download their backup date before the end of the contract period.
• End-of-contract process: At the conclusion of the contract period, assets that were previously; protected will cease to be backed up. Any data remaining in our service will; be permanently deleted. 60 days written notice is required to terminate; services.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: The service interface is a web-based graphical user interface (GUI) used for configuring backup schedules, restoring files and generating reports.
• Accessibility standards: WCAG 2.2 AAA
• Accessibility testing: As of now, we haven't conducted any interface testing specifically with users of assistive technology.
• User support accessibility: WCAG 2.2 AAA
• API: No
• Customisation available: No

Scaling

• Independence of resources: The platform offers true multi-tenancy with an isolated schema for each; tenant.

Analytics

• Service usage metrics: Yes
• Metrics types: Backup status report after every job, a restore statistics report following each job, and an audit log detailing administrator activity.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Acronis

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: All data is protected at source with customer-only held encryption Keys (AES 256)
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Backup data can be exported from the "storage" section on the web based; portal.
• Data export formats: Other
• Other data export formats: .zip
• Data import formats: Other
• Other data import formats: Data import is not available

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Acronis SLAs are 99.99% uptime.
• Approach to resilience: Acronis has meticulously crafted its high-availability and redundant; infrastructure to mitigate potential risks and eradicate single points of failure.; Adhering to the "need plus one" (N+1) principle, Acronis enhances; redundancy across all hardware layers within its infrastructure. This strategic; approach guarantees that any hardware-layer component failure does not; compromise Acronis' critical infrastructure or its customers' operations. By leveraging this redundant infrastructure, Acronis can seamlessly conduct various preventive maintenance tasks without interrupting its services.
• Outage reporting: Service outages are reported via a private dashboard.; https://partners.acronis.com/#datacenter

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: We employ RBAC mechanisms to restrict access to specific functionalities; within our management interfaces and support channels. This ensures that users only have access to the resources and features necessary for their roles and responsibilities. We enforce MFA for all users accessing; management interfaces and support channels. This adds an extra layer of; security beyond traditional password-based authentication.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Acronis information security policies and processes are based on broadly; accepted international security standards such as ISO 27001 or the National Institute of Standards and Technology (NIST), and take into account the; requirements of related local regulation frameworks such as European; Union’s General Data Protection Regulation (GDPR) and the United States’ Health Insurance Portability and Accountability Act (HIPAA).

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Redundant infrastructure enables Acronis to conduct various preventive; maintenance tasks without disrupting services. Scheduled maintenance and infrastructure changes are executed in compliance with manufacturers' specifications and internal documented procedures. All infrastructure is covered by the respective vendor's service level agreements (SLAs). The team adheres to a standardised maintenance approach aimed at enhancing infrastructure availability while reducing operating and maintenance expenses. Security and critical updates receive top priority and are promptly installed. Each update undergoes thorough testing before implementation.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Acronis diligently monitors all official repositories and bulletins for the latest information. Security and critical updates are given top priority and promptly applied. Each update undergoes rigorous testing before implementation. Acronis leverages the expertise of skilled technology professionals at every level of its infrastructure and actively engages with third-party vendors to address any issues.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Acronis' Network Operations Centre (NOC) assumes responsibility for; incident identification and response, pinpointing the root cause of issues and promptly alerting the appropriate internal incident response team to address the technology incident. Response times adhere to internal SLAs aimed at achieving 99.99 percent availability. The Acronis network employs a multi-layered, zone-based architecture. Managed network equipment effectively segregates and isolates internal, external, and customer environments, while also facilitating routing and filtering of network protocols and packets.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: Identification: Acronis assesses whether an event qualifies as an incident.; (Information regarding incidents may originate from Acronis' monitoring; system or through communication channels from various teams and; customers.) Containment: The team evaluates the impact, scope, and affected systems and customers. Eradication: The team conducts an investigation to identify the incident's origin and root cause. Recovery: The team diligently monitors every environment. Notification: Communications ensure all teams and customers comprehend the impact and resolution steps and receive status updates during an incident.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Full, unrestricted access is available upon request for 14 days

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
  • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ronald.hulme@cmsecurity.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.