Whitespider

WhiteSpider Managed Data Protection and Recovery

The managed data protection and recovery service from WhiteSpider provides an agile, scalable and secure Backup and Replication Service solution that is fully customisable to meet a customers requirements. Consumable as a fully provided service, or as a target site for a customers existing solution.

Features

• 24x7 Proactive NOC
• Granular Restore capability across multiple application technologies
• Scalable Solutions for branch, datacentre and cloud use cases
• Industry leading Hardware and Software Vendor Solutions
• Visibility and Management from the Customer Portal
• Multiple tiers of service available
• Office 365 Backup Capabilities
• Reporting

Benefits

• Turnkey solution that is easily consumable
• Built in visibility to understand data asset protection coverage
• Automation and simplification of IT operations
• Continual access to industry leading expertise
• On Premise, Hybrid or Completely Cloud based solution
• OPEX Model with no capital cost to the customer

£25 to £60 an instance a month

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jonny.malcolm@whitespider.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

892242903045934

Contact

Jonny Malcolm
02037732380
jonny.malcolm@whitespider.com

Service scope

• Service constraints: No known constraints
• System requirements: None

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Priority 1: 4 working hours ; Priority 2: 12 working hours; Priority 3: 2 working days; Priority 4: 5 working days; Working hours are 9am-5pm. Tickets raised outside of these hours are responded to within hours unless agreed with the customer.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Customers have different support options. These include:; 1. 'In Hours' support. 8*5 Weekday support which is the base level, 9am-5pm on week days (excludes Public Holidays); 2. 'Extended' support. 15*5 Weekday support, 7pm-10pm on week days. This is additional cost, priced per customer; 2. 'OOH' Support. This 24*7 support, again additional cost priced per customer.; All of these will have a Support Engineer
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding customers is critical.; 1. We will support customers by uploading all data we can directly, then giving them online demonstrations using their data (where possible); 2. We provide online video and documentation for customer training and support; 3. We provide web support for customers
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Users have full, unrestricted access to their data so can extract it whenever they need.
• End-of-contract process: Each customer contract is defined individually so will include all the services that the customer requires. There is no additional cost

Using the service

• Web browser interface: Yes
• Using the web interface: User Setup is configured as part of onboarding, with options for Multifactor authentication and role based access control.; ; Users can raise service requests, view service reports and analytics.
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: Web interface is accessible from any HTML5 compatible web browser.
• Web interface accessibility testing: No Testing for assistive technology users has been undertaken.
• API: No
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type: Manual
• Independence of resources: All hosted services are load balanced across all tiers in a multi-tenanted environment.
• Usage notifications: No

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • Memory
  • Number of active instances
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Hardware containing data is completely destroyed
• Equipment disposal approach: A third-party destruction service

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • User data and files
  • Virtual Machines
  • Physical Machines
  • Cloud Data (Office 365 )
  • Endpoint Protection (workstation backup)
• Backup controls: The backups are defined on the service level that the customer purchases. This can include a different schedule for each service, but the customer cannot change this themselves. Any changes have to be performed by WhiteSpider
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Users contact the support team to schedule backups
• Backup recovery:
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Services are hosted in a Tier 3 Data centre for hardware and environmental resilience. ; From a service perspective all tiers are redundant and load balanced.
• Approach to resilience: Available on request
• Outage reporting: Any failures or outages are reported on a public dashboard.; Email alerts will be issued to users

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: The service utilised standard Role Based Access Control
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Username or password
• Devices users manage the service through: Dedicated device over multiple services or networks

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: 04/12/2023
• What the ISO/IEC 27001 doesn’t cover: There is nothing in this service that is not covered
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: The approach to security for the service includes:; - Defining appropriate Role Based Access controls to the system; - Continually monitoring for potential cyber threats and implementing safeguards; - Maintaining secure environment and processes for handling customer data; - Ensuring software development follows appropriate standards and testing; ; Currently undertaking ISO27001 certification
• Information security policies and processes: The following processes are in place to ensure appropriate security is maintained: ; Documentation and Software; - Document control: Managing storage and revision of all documentation; - Approvals: Defined approval process for all documentation and software revisions; - Code Development: Processes for managing the development and release of software code; Customer Data; - Access control: Ensure that users have appropriate access for their role to customer data; - Physical Security: Employees are appropriately checked prior to being given access. The Premises are secured, with full CCTV and visitors escorted in the premises

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The process ensures changes are undertaken by an expert with appropriate level of expertise and experience who understands the impact. The change board consists of:; a. At least one WhiteSpider individual ; b. At least) one customer individual. ; 2. The CAB will have a weekly approval meeting; 3. Change requests include:; a. Summary and Priority of change; b. Expected impact, including risk assessment and security impact ; c. Time required; d. Devices and people involved; e. Details of changes to production environment.; f. Escalation process; g. Testing details; Change details are stored on a shared environment for access by customer and WhiteSpider
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We determine potential threats through subscribing to relevant organisations to receive vulnerability alerts and information. Examples include Cisco's PSIRTs and VMWare Knowledge Base; ; Any potential threats are assessed to determine criticallity and likely impact; ; Customer alerts are then created, along with appropriate corrective action ; ; Relevant patches are then applied, following any necessary change process.; ; Updates are issued when the corrective action is completed.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The services is supported by IDS and IPS at a network level with advanced firewall capabilities at the perimeter, and process monitoring at a compute level.; Incidents are responded to according to the customer specific SLAs for the service.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are detected and reported either by WhiteSpider's monitoring service (alerts issued automatically) or by end-users who report by phone, email or web portal.; Alerts are issued to the service desk, allocated a priority and impact and passed onto the relevant support teams.; Depending on SLAs, allocated priority and complexity, the incident may be passed to 3rd line support. Escalation process are followed if the issue is not resolved as SLA thresholds are reached.; Once resolved, tickets are closed, customer informed and - if required - detailed incident reports creat-d and either emailed to customer or presented in person.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: VMware
• How shared infrastructure is kept separate: Customers are logically segregated into individual networks, storage containers (datastores) and resource groups within the WhiteSpider Cloud. Where public cloud is used a similar model is utilised to facilitate segregation using cloud native methods

Energy efficiency

• Energy-efficient datacentres: No

Social Value

• Social Value:

  Social Value

  • Tackling economic inequality
  • Wellbeing

  Tackling economic inequality

  WhiteSpider is a rapidly growing SME. As our business grows, we continue to recruit staff from all social and economic backgrounds. Our focus is always to recruit based on attitude, work ethic and how they will fit into our business culture. We then train them to give them a wide range of technical skills. This helps to improve their future employability.; We also work with apprentice schemes giving opportunities to school leavers and other young people.

  Wellbeing

  We strongly focus on employee wellbeing. We ensure employees have the flexibility to work in the office, as well as from home, however we do insist on regular monthly face-to-face work time to vary their working location.; We provide employees with an external, confidential wellbeing service that they can contact for concern whether this is personal, family, financial, or work related.; We run a voluntary scheme focused on getting staff out into the mountains, giving them time outdoors in the mountains and teaching them new skills.

Pricing

• Price: £25 to £60 an instance a month
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Users have full access to all services for a limited time period (typically 30 days)

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jonny.malcolm@whitespider.com. Tell them what format you need. It will help if you say what assistive technology you use.