ARC-IT Business Solutions Ltd

Microsoft 365

Microsoft 365 is a cloud-based subscription service that brings together the best tools for the way people work today. By combining best-in-class apps like Excel and Outlook with powerful cloud services like OneDrive and Microsoft Teams, Microsoft 365 lets anyone create and share anywhere on any device.

Features

• Email hosting with 50 GB mailbox
• Desktop versions of Office applications on PC or Mac
• One license covers fully-installed Office apps on 5 devices
• File storage and sharing with 1 TB of OneDrive storage
• OneNote: Access to additional OneNote features

Benefits

• Work from anywhere in the world
• Share content with teams
• Access documents from any device
• Encrypted cloud security

£0.15 a user a month

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at alex.pomorski@aibs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

969750820277809

Contact

Alex Pomorski
01444817506
alex.pomorski@aibs.co.uk

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Exchange Online Protection ; Extra cloud storage
• Cloud deployment model: Private cloud
• Service constraints: No
• System requirements: None

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: No response at the weekend
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Bronze-8 hours; Silver-4 hours ; Gold-1 hour
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Online training; phone support; user documentation
• Service documentation: No
• End-of-contract data extraction: Users shouldn't need to end the contract however there are wizards available within the admin center to extract the relevant data.
• End-of-contract process: Microsoft 365 subscription is included in the price per user/month, support is an extra cost.; ; The contract rolls over on a yearly basis.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
  • Windows Phone
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Different view and limited features on mobile device.
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: No

Scaling

• Independence of resources: This is guaranteed by Microsoft.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage.; Security and Compliance.
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with SSAE-16 / ISAE 3402
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Via a wizard in admin centre.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Pst
  • PDF
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Microsoft provides enterprise class cloud-based solutions with appropriate levels of built in redundancy and resilience. Where they fail to maintain agreed service levels you may be eligible for a credit towards a portion of your monthly service fees. Cloud based services include: - Exchange online, Exchange online archiving, Exchange online protection, OneDrive for Business, Office online, Office365 activation, Microsoft Stream, Microsoft Teams, SharePoint online, Project online, Skype for business online, and Yammer Enterprise. All of these services will provide 25% credit if monthly uptime percentage falls below 99.9%; 50% credit below 99%; and, 100% credit below 95%.
• Approach to resilience: Microsoft 365 spreads your information across several geographically-dispersed datacentres. Should one (or more) of these hubs go offline, your data remains available at all times.
• Outage reporting: Microsoft provide dashboards that describe the health of their cloud-based solutions. Administrators can configure email alerts for messages posted to the dashboard, including planned changes to services.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Staff within individual tenants that have elevated privileges can be mandated to use multi-factor authentication.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Schellman Compliance LLC
• ISO/IEC 27001 accreditation date: 26/02/2024
• What the ISO/IEC 27001 doesn’t cover: Excludes on-premise Microsoft infrastructure and infrastructure delivering the public Internet.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Coalfire Systems, Inc.
• PCI DSS accreditation date: 28/07/2023
• What the PCI DSS doesn’t cover: Office365 solution does not knowingly contain payment card data. This PCI compliance accreditation focuses on those systems, such as Dynamics 365, that are designed to maintain payment card data.
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • ISO 22301
  • ISO27018

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Microsoft are a recognised global leader in security management and have the necessary compliance certifications.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Microsoft follow an established configuration and change management process for the Microsoft 365 environment, which is subject to annual audit by an external approved body.; ; Proposed changes to the Microsoft 365 environment follow the standard Microsoft Security Development Lifecycle process, which includes risk assessment, testing , approval , documentation, and are required to meet specific security development requirements aimed at reducing security-related bugs.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Microsoft uses advanced analytics to provide unparalleled threat protection and detection. In addition, Microsoft 365 includes built in functionality to protect against external threats.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Microsoft employs some 3,500 cyber security experts in their operational centre to constantly monitor and remediate potential threat. Informed by trillions of data points across an extensive network of sensors, devices, authentications, and communications, the Centre employs automated software, machine learning, behavioural analysis, and forensics to create an intelligent security graph.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Microsoft’s approach to managing a security incident conforms to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61, and Microsoft has several dedicated teams that work together to prevent, monitor, detect, and respond to security incidents.; If customer determines that a security incident is underway, they may open a support case with Microsoft, which can be tracked through their Office365 dashboard.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Covid-19 recovery

  Covid-19 recovery

  Microsoft 365 provides the flexibility to maintain powerful business collaboration tools from anywhere on any device. Thereby, giving business users the ability to work remotely and in doing so improve work/life cycle balance, reduce travel costs and maintain physical social distancing.

Pricing

• Price: £0.15 a user a month
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Full functionality of license,; 1 month free trial; Maximum 25 users
• Link to free trial: https://portal.office.com/partner/partnersignup.aspx?type=Trial&id=e85beec1-e086-486d-98fa-75c70665ae08&msppid=4703630

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at alex.pomorski@aibs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.