Oracle Cloud Infrastructure - IaaS, PaaS, DBaaS, SaaS

Service scope

Service constraints: Logicalis will work with clients to understand requirements and provide advice and guidance on OCI requirements. Both Pre-Sales and Consulting services.
System requirements: Standard and updated Web Browser.

See https://docs.oracle.com/en/learn/oci-basics-tutorial/index.html

User support

Email or online ticketing support: Yes, at extra cost
Support response times: Oracle's response times are determined by the severity level of the service request. Oracle will use reasonable efforts to respond to Severity 1 service requests within fifteen (15) minutes. However, for other severity levels (2-4) no response time is defined. The severity level of a service request is selected by both the customer and Oracle, and must be based on defined severity definitions.

OCI allows service requests to be raised directly via the cloud portal and allows priorities for ticket
https://docs.oracle.com/en/learn/oci-basics-tutorial/index.html
Logicalis work with clients and Oracle to understand the service requirements to map appropriate contracts.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: Within the OCI user portal
Web chat accessibility testing: N/A
Onsite support: Yes, at extra cost
Support levels: Online support is built into the price of the service for the license-included CPU SKU and provided through standard Support payments for the BYOL CPU SKU. This provides access to Oracle's extensive Cloud Support network for issues and questions. Customer sets the initial severity of reported issues and Oracle support responds according to the same guidelines provided for on-premises support.

https://www.oracle.com/support/
Support available to third parties: No

Onboarding and offboarding

Getting started: Oracle provide a number of online getting started and training resources. Logicalis provide both pre-sales guidance and consulting services around initial choice of solutions, design, deployment, migration, security and on going operational assessment services at additional cost.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: For a period of no less than 60 days after the termination or expiration of the services, Oracle will make available your production data via secured protocols, or keep the service system accessible, for the purpose of data retrieval by you. During this period, the service system should not be used for production activities. Oracle has no obligation to retain your content after this 60 day period.
End-of-contract process: For a period of 60 days upon termination of the Oracle Cloud Services, Oracle will make available via secure protocols, your content residing in the production environment, or keep the service system accessible, for the purpose of data retrieval by you. During this retrieval period, Oracle’s Cloud Service Level Objective Policy does not apply and the service system may not be used for any production activities. Oracle has no obligation to retain your content after this retrieval period.

Logicalis - at an additional cost can assist in the End of contract process as there may be more detailed integration & Exit requirements when exiting a cloud and Logicalis Cloud Exit service available via G-Cloud Support Services can further assist in this process.

Using the service

Web browser interface: Yes
Using the web interface: Manage and deploy services via the Azure Portal.
See https://azure.microsoft.com/en-gb/
Web interface accessibility standard: WCAG 2.1 AA or EN 301 549
Web interface accessibility testing: See https://www.microsoft.com/en-us/accessibility/
API: Yes
What users can and can't do using the API: Users are able to utilise the Azure API Managament service to create their own API's for the solutions they deploy on to the platform. Additionally we have the Azure Service Management API which provides programmatic access to much of the functionality available through the Management Portal. Available here https://msdn.microsoft.com/en-us/library/azure/ee460799.aspx
API automation tools: Ansible

Chef

SaltStack

Terraform

Puppet
API documentation: Yes
API documentation formats: HTML

PDF
Command line interface: Yes
Command line interface compatibility: Linux or Unix

Windows

MacOS
Using the command line interface: Azure CLI 2.0 is optimized for managing and administering Azure resources from the command line, and for building automation scripts that work against the Azure Resource Manager. See https://docs.microsoft.com/en-us/cli/azure/install-azure-cli

Scaling

Scaling available: Yes
Scaling type: Automatic

Manual
Independence of resources: For a number of Core Infrastructure Services (Block Volume Disk Performance, NVMe and Network Performance for Compute), Oracle provides the Performance SLA to guarantee performance, so you can rely on your infrastructure for enterprise applications. Oracle will use commercially reasonable efforts to deliver the performance of these Services utilised in each such Cloud Service at a Monthly Performance Rate during any calendar month . In the event an applicable Cloud Service does not meet its Service Commitment for the Performance Service Level Agreement , You will be eligible to receive Service Credits.
Usage notifications: Yes
Usage reporting: Email

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

HTTP request and response status

Memory

Network

Number of active instances

Other
Other metrics: More metrics are available. See the user guide for details.
Reporting types: API access

Real-time dashboards

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: Microsoft Azure

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: Less than once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Oracle Cloud Infrastructure (OCI) has policies, procedures, and mechanisms established for effective key management to support encryption of data in storage and in transmission for the key components of the OCI service. OCI supports strong cryptography using standards and validated formats including AES-256, IPSec, and FIPS-140-2. Oracle uses Transparent data encryption (TDE) on database table-spaces to encrypt.
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery: Yes
What’s backed up: Virtual machine images

Block storage volumes

Boot Volume Backups

Under user control, using Oracle or non Oracle technologies
Backup controls: Users perform backups and recovery via Oracle Cloud Infrastructure Block Volumes service, which provides highly available, persistent, network-attached storage volumes optimised to deliver low latency and high IOPS. Volumes can be backed up to highly durable, highly available object storage, and can even be restored to new volumes. Users can also take advantage of fault isolation, deploying applications in multi-region, multi- Availability Domain (AD), or multi-fault domain configurations. ADs are are built with independent infrastructure such as buildings, power generators, cooling equipment, network, and servers, while fault domains partition the compute resources within an AD for further protection.
Datacentre setup: Multiple datacentres with disaster recovery
Scheduling backups: Users schedule backups through a web interface
Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection between networks: Oracle Cloud Infrastructure provides the customer with multiple forms of encryption for data in transit. All Oracle Cloud Infrastructure Application Programming Interface (API) requests must support HTTPS and SSL protocol TLS 1.2. Oracle Cloud Infrastructure supports tunnel mode for IPSec Virtual Private Networks (VPNs). Oracle Cloud Infrastructure FastConnect offers a dedicated, private connection between the customer’s data centre and Oracle Cloud Infrastructure.
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection within supplier network: For data in transit, customers can enable encryption for traffic between their own VMs and end users. Oracle Cloud Infrastructure (OCI) protects data in transit, such as between two virtual networks. Oracle Cloud Infrastructure uses industry standard transport protocols such as TLS between devices and OCI data centres, and within data centres themselves.

Availability and resilience

Guaranteed availability: Commencing at Oracle’s activation of your production Oracle Cloud Service, Oracle works to meet the Target Service Availability Level, or Target Service Uptime, of 99.5%. Oracle will provide you with access to a customer notifications portal. This portal will provide metrics on the Service Availability Level for Oracle Cloud Services that you purchased under your order. For those Oracle Cloud Services for which such metrics are not available via the customer notifications portal, Oracle will provide metrics on the Service Availability Level upon receipt of a Service Request submitted by you to Oracle requesting the metrics.

Oracle provide a number of service levels based on client requirements and service.
https://www.oracle.com/cloud/sla/
Approach to resilience: Oracle Cloud Infrastructure is hosted in regions and availability domains. A region is a localised geographic area, an availability domain is one or more data centres located within a region. A region is composed of several availability domains. Most Oracle Cloud Infrastructure resources are either region-specific, such as a VCN, or availability domain-specific, such as a compute instance. Availability domains are isolated from each other, fault tolerant, and designed against failing simultaneously. Because availability domains do not share infrastructure such as power or cooling or the internal availability domain network, a failure at one availability domain is designed to not impact the availability of the others. All the availability domains in a region are connected to each other by a low-latency, high-bandwidth network, which makes it possible for the customer to provide high-availability connectivity to the Internet and customer premises, and to build replicated systems in multiple availability domains for both high availability and disaster recovery. Regions are completely independent of other regions and can be separated by vast distances across countries or even continents.

Oracle provide a number of tools to help clients build a resilient infrastructure on top of oracles resilient cloud

https://docs.oracle.com/en-us/iaas/Content/cloud-adoption-framework/era-resiliency.htm
Outage reporting: Oracle will provide you with access to a customer notifications portal. This portal will provide metrics on the Service Availability Level for Oracle Cloud Services that you purchased under your order. For those Oracle Cloud Services for which such metrics are not available via the customer notifications portal, Oracle will provide metrics on the Service Availability Level upon receipt of a Service Request submitted by you to Oracle requesting the metrics.

https://ocloudinfra.statuspage.io/
https://support.oracle.com/knowledge/Oracle%20Cloud/2377379_1.html

Identity and authentication

User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google apps)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: Access can be restricted to whitelisted IP addresses and MFA can be applied
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password
Devices users manage the service through: Dedicated device on a segregated network (providers own provision)

Dedicated device on a government network (for example PSN)

Dedicated device over multiple services or networks

Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information: You control when users can access audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users receive audit information on a regular basis
How long supplier audit data is stored for: Between 6 months and 12 months
How long system logs are stored for: Between 6 months and 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Undisclosed
ISO/IEC 27001 accreditation date: 2022/10
What the ISO/IEC 27001 doesn’t cover: OCI is covered by iso27001
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 2022/10
CSA STAR certification level: Level 2: CSA STAR Attestation
What the CSA STAR doesn’t cover: Undisclosed
PCI certification: Yes
Who accredited the PCI DSS certification: Schellman & Company, LLC
PCI DSS accreditation date: 2021/05
What the PCI DSS doesn’t cover: See https://blogs.oracle.com/integration/post/oracle-announces-pci-dss-attestation-of-compliance-for-oracle-integration
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: SOC1, 2 and 3

CSA STAR

GSMA SAS-SM

ISO 27017

ISO 27018

ISO27701

https://www.oracle.com/uk/corporate/cloud-compliance/

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Oracle security policies cover the management of security for both Oracle’s internal operations as well as the services Oracle provides to its customers. The policies apply to all Oracle employees. These policies, which are aligned with the ISO/IEC 27001:2013, govern all areas of security applicable to Oracle Cloud Infrastructure. Standards may exceed requirements mandated by the Oracle security policies, thus enforcing further controls within Oracle Cloud Infrastructure operations and systems. Oracle's Global Information Security (GIS) organisation conducts security reviews, assessments, and audits periodically to confirm compliance with the Oracle information security policies, procedures, and practices. Where non-compliance is found, GIS works with the relevant lines of business to resolve those issues in a timely a manner. GIS reserves the right to intervene as deemed necessary and to isolate environments in non-compliance that put infrastructure or other environments at serious risk. Oracle employees who fail to comply with Oracle information security policies, procedures, and practices may be subject to disciplinary action, up to and including termination.

Oracle follow a number of security policies to ensure their service and client data are protected.

https://www.oracle.com/corporate/cloud-compliance/

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Oracle Cloud Infrastructure has a comprehensive change management process, including both prevent and detect controls, as a core requirement of its commitment to security, availability, and confidentiality. The change management process is reviewed annually, at minimum, and outlines the processes and procedures to be followed for each change. The process incorporates segregation of duties (SoD) and requires changes to be approved and tested prior to implementation. All change requests are documented in an electronic, access-controlled ticketing system. The workflow prevents the ticket from being moved into the 'scheduled for implementation' phase without the required review and approvals
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Penetration tests of the system are conducted at least annually. A commercial vulnerability scanning tool is configured to scan all external IP addresses and internal nodes at least quarterly. The results of vulnerability scans and penetration tests are reviewed by management. Vulnerabilities and threats are assessed, documented and tracked through resolution. Oracle Cloud Infrastructure has deployed security information and event monitoring (SIEM) solution which ingests and stores security-related logs and alerts from networking devices, hosts and other components within the infrastructure. SIEM is monitored 24x7x365 basis designed to defend and protect against unauthorised intrusions and activity in the production environment.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: (OCI's deployed SIEM ingests logs and alerts from networking devices, and hosts. SIEM is monitored 24x7x365 basis designed to defend and protect against unauthorised intrusions and activity in the production environment. In the event of a security incident, Oracle Cloud Infrastructure activates an agreed protocol which includes GIS, Global Product Security, and Privacy & Security Legal, as applicable, to provide specialist subject matter expertise to respond to the incident. In the event that Oracle determines that it is required to report an incident involving the breach of personal information to a customer, Oracle will promptly notify the affected customer.

https://www.oracle.com/security/cloud-security/vulnerability-scanning-service/
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: Incidents, including incidents reported directly to a customer’s Oracle account manager, are recorded via an internal access-controlled electronic ticketing system. Routing, communication, and escalation of incidents vary depending on several factors including urgency and impact to customers. Incidents reported via My Oracle Support (MOS) or through the external user incident reporting process are routed to Oracle Cloud Infrastructure personnel and tracked in the electronic ticketing system in the same manner as an internally identified incident.

Oracle’s incident management approach combines resilient architecture, proactive security practices, and formalized support to maintain a reliable and secure cloud environment for its customers.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
Who implements virtualisation: Supplier
Virtualisation technologies used: KVM hypervisor
How shared infrastructure is kept separate: Each customer has one or many software defined networks that are isolated from other customers. Isolation occurs at the hypervisor layer or on a bare metal host depending on the shape that is chosen during instance initiation. Your Content is logically or physically segregated from the content of other customers hosted in the Oracle Cloud Services environments. OCI responsibility includes hypervisor security and the configuration of the permissions and network access controls required to ensure that hosts can communicate correctly and that devices are able to attach or mount the correct storage devices.
https://docs.oracle.com/en-us/iaas/Content/Security/Concepts/security_guide.htm#:~:text=Customer%20isolation%20that%20allows%20you%20to%20deploy%20your,protects%20customer%20data%20at-rest%20and%20HTTPS-only%20public%20APIs.

Energy efficiency

Energy-efficient datacentres: Yes
Description of energy efficient datacentres: 100% of OCI datacentres in Europe are powered by Renewable Energy
99.7% of retired hardware was recycled and re-used

Further information - https://www.oracle.com/sustainability/green-cloud/

Social Value

Fighting climate change
Equal opportunity
Wellbeing

Fighting climate change

Take a look at our latest developments:

Carbon neutral on scope 1&2 by 2025 - Announced intent to be carbon neutral on scope 1 and 2 by 2025.

Engaged EcoVadis – Partnered with EcoVadis to provide a holistic understanding of our ESG performance.

Carbon Disclosure Project – Deepened our scope with the CDP.

SBTi – Committed to Science Based Targets initiative, joining the largest group of companies actively driving the reduction in global emissions.

Launched customer sustainability score – Developed scoring mechanisms that enable customers to understand their IT emissions with recommendations, all available as a managed service.

Equal opportunity

Diversity, equity and inclusion activities
From our global inclusion council to unconscious bias training for all employees, we empower our employees to create an inclusive environment.

Wellbeing

Innovation drives creativity and when people from diverse backgrounds work together, the more innovative and creative that team is likely to be.

Our people are critical to our ongoing success and together we can create an environment where everyone can belong, grow and thrive. We are committed to making Logicalis the best it can be through our people and in FY23 we were recognised as being a 'Great Place to Work' in 12 countries.

Pricing

Price: £0.00 a unit an hour
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: The free trial allows for up to US$300 usage, and expires after 30 days. The free trial is limited to a total of 5TB of block, object and archive storage capacity.
Link to free trial: https://www.oracle.com/uk/cloud/free/

Oracle Cloud Infrastructure - IaaS, PaaS, DBaaS, SaaS

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Backup and recovery

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Separation between users

Energy efficiency

Pricing

Service documents

Cookies on Digital Marketplace

Oracle Cloud Infrastructure - IaaS, PaaS, DBaaS, SaaS

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Backup and recovery

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Separation between users

Energy efficiency

Social Value

Pricing

Service documents