Cybersecure Hybrid Cloud Services
Hybrid cloud hosting solution offering Platform as a Service (PaaS), high availability, enterprise class compute and storage. METCLOUD's managed services include: Next Generation Firewalls (NGFW), Security Information and Event Management (SIEM), Endpoint Protection, Network Access Control, Automated Patch Management & Backup, Disaster Recovery and Proactive Monitoring & Surveillance 24/7.
Features
- Next Generation Firewalls
- Enterprise Class Compute and Storage
- Managed Vulnerability Scanning and Remediation
- Advanced Reporting
- Security Information & Event Management
- Endpoint Protection
- Network Access Control
- Monitoring & Surveillance
- Secure Remote Management
- Ongoing account management
Benefits
- Consumption Billing Model
- Rapid onboarding
- Flexible and Scalable Compute and Storage
- Accredited to ISO 27001 and Cyber Essentials
- Assists compliance with, ISO, NIS, GDPR, SOX, PCI & HIPPA
- High Availability
- Reduces management costs with hybrid cloud solutions
- Uses real time threat intelligence to protect systems and information
- Secure your Cloud Adoption projects and strategies
- Pay as you Grow Service Delivery
Pricing
£0.02 to £0.27 a gigabyte a month
- Education pricing available
Service documents
Request an accessible format
Framework
G-Cloud 13
Service ID
7 9 1 0 0 2 6 8 5 3 0 2 7 1 8
Contact
Managed Enterprise Technologies Ltd
Ian Vickers
Telephone: 0121 227 0730
Email: ian.vickers@metcloud.com
Service scope
- Service constraints
- Legacy systems that do not support virtualisation are unsupported.
- System requirements
-
- Buyer must provide access to systems for migration
- Secure VPN link
- Access to the Internet to make use of the service
- MPLS Circuit optional
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
-
P1/Urgent 20min response
P2/High 90min response
P3/Medium 5hrs response
P4/Low 10hrs response - User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- WCAG 2.1 AA or EN 301 549
- Phone support
- Yes
- Phone support availability
- 24 hours, 7 days a week
- Web chat support
- Web chat
- Web chat support availability
- 24 hours, 7 days a week
- Web chat support accessibility standard
- WCAG 2.1 AA or EN 301 549
- Web chat accessibility testing
- Using Google Accessibility Tool Kit
- Onsite support
- No
- Support levels
-
P1/Urgent 20min response
P2/High 90min response
P3/Medium 5hrs response
P4/Low 10hrs response
Cloud support engineers are provided for fault resolution and pre-sales technical review. - Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
-
User Training
End-user training (online) for the platform and full documentation provided. Additional training (including onsite) is available with pricing made available upon request.
Migrations
We support the following scenarios for both private cloud and Microsoft Azure:
• New environments, including building, testing and commissioning of VM’s
• Tool driven physical to virtual or virtual to virtual migrations
• Managed migrations
New Environments
We are able to design, specify and build VM’s to individual customer requirements. Instances are fully tested before handover with full documentation provided.
Tool Driven Migrations
Typically customer led, this option provides flexibility for a buyer to choose how existing systems are migrated. Vendor supplied tools are used to make the data available to us via either physical media or secure data transfer.
Managed Migrations
Our fully managed service can seamlessly migrate your services into our platform using our bespoke methodology. There is no need for downtime as live systems can be migrated with minimal impact.
Additional Services
We are also able to assist buyers with:
• Cloud design
• Cloud readiness assessments
• Technology optimisation
• Operating system upgrades
• Networking & infrastructure support
• Security assessments & compliance reviews. - Service documentation
- Yes
- Documentation formats
-
- Other
- Other documentation formats
- MS Office including Visio Drawings
- End-of-contract data extraction
-
Customers are able to extract data from the service using their preferred tools and methods. We are able to provide support for customers to extract data from the service which is chargeable. Our charges are listed in the accompanying pricing document and follow our standard consultancy rate.
For support with data extraction we require 60 days notice before the end of the contract. Notice should be in writing to ian.vickers@metcloud.com.
Customer Data is retained for a maximum of 90 days following the end of a contract. After this time all data is deleted. - End-of-contract process
- This a chargeable service, as detailed in the pricing document.
Using the service
- Web browser interface
- Yes
- Using the web interface
-
Users can manage the services provided via a web portal secured by a username and password. 2FA is also used for authentication to portal.
Users are able to start and stop VM's, view statistics and usage such as CPU, RAM & Disk Space.
Users are unable to provision new server instances or allocate resources to existing instances such as additional vCPU's or Memory through the web interface - this process is fully managed by our cloud engineers. - Web interface accessibility standard
- None or don’t know
- How the web interface is accessible
- Our web interface is accessible to users of assistive technologies, such as screen readers by providing clear text descriptions for user input fields.
- Web interface accessibility testing
- None
- API
- No
- Command line interface
- No
Scaling
- Scaling available
- Yes
- Scaling type
-
- Automatic
- Manual
- Independence of resources
- Our platform is designed with enough overhead for customers to run their systems @ 100% utilisation without affecting others. When designing/building a solution on the platform, consideration is given to this overhead and any expansion through normal operation of the hosted systems.
- Usage notifications
- Yes
- Usage reporting
-
- SMS
Analytics
- Infrastructure or application metrics
- Yes
- Metrics types
-
- CPU
- Disk
- HTTP request and response status
- Memory
- Network
- Number of active instances
- Other
- Other metrics
-
- Application Performance
- Uptime
- Reporting types
-
- Real-time dashboards
- Regular reports
- Reports on request
Resellers
- Supplier type
- Reseller providing extra features and support
- Organisation whose services are being resold
- Microsoft CSP, Microsoft SPLA, Webroot, Securenvoy MFA, Barracuda, SonicWall, Veeam
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- Up to Developed Vetting (DV)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
-
- United Kingdom
- European Economic Area (EEA)
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Supplier-defined controls
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
- Protecting data at rest
- Physical access control, complying with another standard
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Deleted data can’t be directly accessed
- Hardware containing data is completely destroyed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Backup and recovery
- Backup and recovery
- Yes
- What’s backed up
-
- Files & Folders
- Virtual Machines
- Whole Disks & Volumes
- SQL Databases
- Application Servers (MS Exchange, Sharepoint etc)
- Backup controls
- Access to a management portal can be setup to allow users to setup and control their own backups. Multiple schedules can be setup as required.
- Datacentre setup
-
- Multiple datacentres with disaster recovery
- Multiple datacentres
- Single datacentre with multiple copies
- Scheduling backups
- Users schedule backups through a web interface
- Backup recovery
-
- Users can recover backups themselves, for example through a web interface
- Users contact the support team
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Legacy SSL and TLS (under version 1.2)
- Other
- Other protection within supplier network
- Customer networks and systems are segmented from each other using VLAN and PBR (Policy Based Routing).
Availability and resilience
- Guaranteed availability
-
Network SLA: 100% availability in a 30-day period. Should availability be less than 97.5% during any 30-day period the Customer may terminate the Agreement giving 60 days written notice.
METCloud Platform SLA: 99.9% uptime. Only a systems failure of the hardware and hypervisor layers delivering the service will constitute a failure and be covered by this SLA.
Service Credits are offered for breaching SLA's.
>99.5% <99.9% 1 Day
Between 99% & <99.5% 7 Days
Between 97.5% <99% 12 Days
Less than 97.5% 30 days. - Approach to resilience
- Available upon request.
- Outage reporting
- Email Alerts are generated immediately. These are configurable to individual customer requirement.
Identity and authentication
- User authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Dedicated link (for example VPN)
- Username or password
- Access restrictions in management interfaces and support channels
-
Named user accounts are supplied with appropriate rights and permissions. Administrator access is restricted to authenticated users providing a valid set of credentials including username and password. Two Factor Authentication (2FA) is utilised wherever possible.
Our support is provided to customers only. Third parties may engage with our support under prior arrangement and agreement with us.
Access to support can be restricted to named users if necessary with requests validated by a senior manager or other named contact. - Access restriction testing frequency
- At least once a year
- Management access authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Username or password
- Devices users manage the service through
-
- Dedicated device on a segregated network (providers own provision)
- Dedicated device on a government network (for example PSN)
- Dedicated device over multiple services or networks
- Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
- Directly from any device which may also be used for normal business (for example web browsing or viewing external email)
Audit information for users
- Access to user activity audit information
- Users contact the support team to get audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- Users contact the support team to get audit information
- How long supplier audit data is stored for
- User-defined
- How long system logs are stored for
- User-defined
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- ACM Limited
- ISO/IEC 27001 accreditation date
- 01/07/2019
- What the ISO/IEC 27001 doesn’t cover
- Software Development
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Cyber essentials plus
- No
- Other security certifications
- No
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- ISO/IEC 27001
- Information security policies and processes
-
ISMS in place with defined roles for SIRO, TISO, ISO and IRO's. Documented incident response and recovery plans reviewed annually. ISMS accredited to ISO 27001 by UKAS approved auditors. Overarching Policy Statement with supporting policies for:
BYOD, Acceptable Use Policy (Internet, Email & Equipment), Incident Handling & Reporting, Passwords, Physical & Environmental Security, Anti-Virus/Malware, Information Classification, Protective Marking, Asset Handling, Clean Desk/Screen, Application Source Code.
Operational security
- Configuration and change management standard
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Configuration and change management approach
-
Our change management process follows best practice as detailed in the ITIL framework.
Specifically changes are discussed and approved by a Change Advisory Board (CAB) at weekly operational meetings.
Emergency changes are handled in accordance with ISO 27001, with risk assessments and impact analysis considered before changes can be approved.
Change logs are maintained and processes are externally audited in accordance with ISO 27001. - Vulnerability management type
- Undisclosed
- Vulnerability management approach
-
Threats are measured using the industry standard CVSS with ratings of Critical, High, Medium and Low. Patches are deployed within thirty days of release.
Our threat feeds include publicly available feeds such as IBM Threat X-Force Exchange, CiSP and Dshield. Commercial threat data is accessed through our SIEM platform (BlackStratus). - Protective monitoring type
- Undisclosed
- Protective monitoring approach
-
The environment is monitored 24/7 by our GPG13 compliant SIEM solution. The output of the SIEM solution is in turn monitored by a dedicated Security Operations Centre (SOC) with analysts providing alerts and remediation for identified threats.
Cases rated as high or above are investigated and processed within 60 minutes. - Incident management type
- Undisclosed
- Incident management approach
-
Our process of handling incidents is aligned with ISO 27001 standards include pre-existing processes for common incidents.
Incidents are investigated and classified according to their severity, either High, Medium or Low. All incidents are logged and reviewed for satisfactory outcome in accordance with our Information Security Management System (ISMS).
Incidents reports are provided via email with full case details (the who, what, where and when), supporting technical information and steps taken/needed for remediation.
Secure development
- Approach to secure software development best practice
- Supplier-defined process
Separation between users
- Virtualisation technology used to keep applications and users sharing the same infrastructure apart
- Yes
- Who implements virtualisation
- Supplier
- Virtualisation technologies used
- Hyper-V
- How shared infrastructure is kept separate
-
Each customer is allocated a portion of the service for it’s own use. This includes dedicated vCPU’s, Memory and networking. MET uses best practice to secure and deploy enterprise class vendor’s solutions within the environment.
Customers are logically separated at both network and hypervisor levels to prevent any cross-contamination.
Storage is also logically separated so customers can only see data that is intended for them.
Energy efficiency
- Energy-efficient datacentres
- Yes
- Description of energy efficient datacentres
- Our datacentres comply with the EU Code of Conduct for Energy Efficient datacentres. The controls and measures in place are managed by a third party supplier (Six Degrees) and are verified by external consultants. See https://www.6dg.co.uk/committed-to-data-centre-efficiency/
Social Value
- Fighting climate change
-
Fighting climate change
In delivery of its services, METCLOUD is committed to;
· Minimising the impact of its activities on the environment.
· Continual improvement in its environmental performance.
· Compliance with all appropriate environmental legislation, regulations and codes of practice relevant to the industry sector in which it operates.
METCLOUD will review its Environmental Policy policy on an annual basis, taking account of any changes within legislation and our organisation, and other factors. - Equal opportunity
-
Equal opportunity
METCLOUD is committed to equal opportunities for all staff and applicants. It is our policy that all employment decisions are based on merit and the legitimate business needs of the organisation. METCLOUD does not discriminate on the basis of race, colour or nationality, ethnic or national origins, sex, gender reassignment, sexual orientation, marital or civil partner status, pregnancy or maternity, disability, religion or belief, age, or any other ground on which it is or becomes unlawful to discriminate under the laws of England and Wales (referred to as Protected Characteristics). Our intention is to enable all our staff to work in an environment which allows them to fulfill their potential without fear of discrimination, harassment, or victimisation. Our commitment to equal opportunities extends to all aspects of the working relationship including: · recruitment and selection procedures; · terms of employment, including pay, conditions, and benefits; · training, appraisals, career development and promotion; · work practices, conduct issues, allocation of tasks, discipline, and grievances; · work-related social events; and · termination of employment and matters after termination, including references. - Wellbeing
-
Wellbeing
METCLOUD is committed to PROMOTING MENTAL WELLBEING (including menopause) AT WORK. Mental wellbeing at work is determined by the interaction between the working environment, the nature of the work and the individual. Work has an important role in promoting mental wellbeing. It is an important determinant of self-esteem and identity. It can provide a sense of fulfilment and opportunities for social interaction. For most people, work provides their main source of income. Work can also have negative effects on mental health, particularly in the form of stress. Work-related stress is defined as the adverse reaction people have to excessive pressure or other types of demand placed upon them. Although pressure can motivate members of staff and encourage enhanced performance, when pressure exceeds the ability of an individual to cope, it becomes a negative force in the form of stress. Working environments that pose risks for mental wellbeing put high demands on a person without giving them sufficient control and support to manage those demands. METCLOUD has a strategic approach to promoting mental wellbeing, this is achieved as follows: · By adopting a company-wide approach to promoting the mental wellbeing of all members of staff. · Ensure that the approach takes account of the nature of the work, the workforce and the characteristics of METCLOUD. · Promoting a culture of participation, equality and fairness that is based on open communication and inclusion. · Creating an awareness and understanding of mental wellbeing and having a zero tolerance towards discrimination
Pricing
- Price
- £0.02 to £0.27 a gigabyte a month
- Discount for educational organisations
- Yes
- Free trial available
- No