Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) Backup as a Service (BaaS) Service Specification of the Fujitsu Backup as a Service (BaaS) offering which forms part of the Fujitsu Global Cloud product portfolio. OVERVIEW OF BACKUP AS A SERVICE With an ever-increasing trend towards consuming IT services via a Cloud Service Delivery model, the focus of the IT buyer is to purchase commodity and easy-to-integrate Cloud offerings. Backup as-a-Service (BaaS) is one of these offerings; it replaces traditional on-site, tape-based data protection solutions with one that is disk-based, agile, scalable, simple to use and secure. This is the definition of the ‘Service’ for the purpose of the Agreement. Delivered on-demand and pay-as-you-go, BaaS presents an Internet-accessible, self-service interface. From this interface, a Backup Administrator can perform all of their typical duties including scheduling a backup, setting retention policies, monitoring backup progress, accessing logs and performing restores. Other roles are available, including backup operator and a view-only role. These roles can be allocated to other individuals by the Backup Administrator. All data is de-duplicated and compressed at source before it is sent over the Internet. Data may optionally be encrypted before it is transmitted. Such data remains encrypted when stored in the BaaS Vault and is only accessible by the User with the use of their encryption key. BaaS is not intended to replace MNE Customer’s existing data protection solutions; it is intended to complement these for their expansion into Cloud services and is also intended to be offered to the SMB market as a complete solution. CORE SERVICE Service Management BaaS is intended to satisfy the requirement for a Backup Service for the Fujitsu Global Cloud Platform (FGCP). BaaS is available to use: On the Fujitsu Global Cloud Platform As part of a Fujitsu Managed Service The core component in BaaS is the Seagate EVault product portfolio, which provides a self-service portal with functions to enable a Backup and Restore service to be configured, maintained and managed by the Customer. In summary, the selfservice portal provides the following functionality: Self-service portal enabling Customers to: o Install backup agents o Configure backup schedules and retention policies o Create backup jobs with different levels of encryption, define mailboxes to forward backup results o Monitor the status of backups o Manually initiate ad hoc backups o Perform full and partial restores In addition, the Service provides: Page 1 of 7 Optimised backups using compression, de-duplication and continuous incremental backups © Fujitsu Services Limited, 2013 Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) Option to encrypt backup data during transit and storage On-demand (utility) charging, based on the volume of compressed Giga-bytes of data stored on the primary Vault Backup replication to a remote location (Passive Vault) 24hour support 7days a week 52 weeks a year via telephone Role-based access The ability to configure and generate reports on activity and capacity Pricing The Customer is charged per Giga-byte of compressed data that is stored on the primary vault. Table P1 illustrates the tiered pricing structure. An additional charge is levied if the Customer requests a managed service, charged as a single fee per month. The first column of the table highlights the pricing tiers according to consumed volume of data in Terrabytes. Table P1 Cloud-connected compressed capacity (Terra-byte) Fujitsu compressed and replicated GB price (£)/month Excluding VAT Fujitsu Management Fee (£)/month Excluding VAT 0.000 -0.099 £ 1.20 £ 100.00 0.100- 0.249 £ 1.10 £ 200.00 0.250 -0.499 £ 1.05 £ 300.00 0.500-0.999 £ 1.00 £ 500.00 1 - 2.99 £ 0.90 £ 750.00 3 - 5.99 £ 0.82 £ 900.00 6 – 9.99 £ 0.75 £ 1,300.00 10 – 14.99 £ 0.73 £ 1,500.00 15 – 24.99 £ 0.72 £ 2,000.00 25 – 49.99 £ 0.71 £ 3,000.00 50+ £ 0.70 £ 4,000.00 Information Assurance Backup as a Service is hosted by the Fujitsu Global Cloud platform. The full-end-to-end FGCP service has yet to be audited under ISO 27001 standards. However, elements of the Service have attained this standard, such as the Service Desk component (including 1st-line support), which has been independently audited as achieving the following Industry standards: ISO 9001:2008 ISO 27001:2005 The UK instance of FGCP is hosted in a Fujitsu-owned and managed data centre which meets the Tier 3 criteria of The Uptime Institute. It is certified “Gold” in terms of both its Build and its Operational Sustainability by The Uptime Institute. This data centre is secure and ensures the availability of the technical infrastructure, such as air-conditioning, power supply and network connection. This data centre has numerous security certificates, qualifications and awards including the following: Accreditations: Management Standards: Page 2 of 7 © Fujitsu Services Limited, 2013 Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) BS EN ISO 9001:2000 - the International standard for Quality Management Systems ITIL (IT Infrastructure Library) - the standard for Service Delivery Management Accreditations: Security Standards: ISO 27001 (BS7799) - the British Standard for Information Security Management ISO 17799 - the International standard for Information Security Management Certifications: Tier III Design certification from The Uptime Institute Tier III Build certification from The Uptime Institute The Uptime Institute Operational Sustainability GOLD standard. These certifications include amongst others: Computer rooms in separate fire sections Split up into low-level security and high-level security areas Manned and monitored operation, 7 days a week, 24 hours a day Redundant design of infrastructure components, guaranteeing highest fail-safety Redundant power supply, which is safeguarded for an unlimited period of time by a UPS system and emergency generators Redundant WAN network connections linked via 2 carriers Redundant air conditioning with specific airflow and high energy efficiency Access-controlled data centre rooms with individual admission systems. Service Constraints Scheduled Maintenance Windows Fujitsu will operate a standard scheduled maintenance window which will be communicated 4 working weeks in advance to the Customer. This window will be used to perform standard maintenance and changes required to the Service by Fujitsu, as well as any agreed standard Customer specific changes to the Service. On using this Service the Customer is required to acknowledge that Fujitsu may conduct additional maintenance activities from time-to-time, in order to ensure the smooth operation of the Service and that those maintenance activities may temporarily interrupt the provision of the Service. Fujitsu shall use reasonable endeavours to provide the Customer with at least 10 working days advance notice, by email and/or via the Service Website, prior to conducting maintenance activities as described in this paragraph. Any change required to the BaaS Service is also subject to operational change management. Maintenance Releases: Customers who are covered by an active support contract at the time of a maintenance release will be notified when major or minor maintenance releases and incremental releases become available. Maintenance releases fall into three types: Page 3 of 7 a. Major Releases: Major releases occur approximately on a yearly basis, and include bug fixes, additional functionality and new features. Major releases are provided free-of-charge to Customers with active support contracts. b. Minor Releases: Minor releases occur approximately every 4-6 months, and include cumulative bug fixes from incremental releases and minor enhancements. Minor releases are provided free-of-charge to Customers with active support contracts. c. Incremental Releases: Incremental releases occur as necessary to correct major defects, and are shipped upon request. There is no charge for these releases for Customers with active support contracts and Partner. © Fujitsu Services Limited, 2013 Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) Third-Party Service Monitoring Tools Access The Service is proactively monitored and managed by Fujitsu, including comprehensive Service reporting. Non-invasive third-party tools may monitor the Service (for example monitoring HTTP response), but for security, performance and resilience reasons, invasive third-party service monitoring tools are not permitted. ITMaaS is configured to monitor the health of the BaaS system, alerting the Service Desk where appropriate through automated alerts that in turn raise Incident Tickets which can be routed to the 2nd/3rd line Cloud Support team, based in the UK. BaaS 1st Line support is provided by Fujitsu’s Manila service desk in the Philippines which provides 24hour , 7 days per week , 52 week per year Incident Management. (Note: 2nd & 3rd line support is only provided 09.00-18.00 UK Hours Mon-Fri, excluding UK public holidays). Fair Use All Customers must agree to the principles of fair usage. These principles are not designed to be restrictive, and are as follows: Any weakness discovered in the system’s configuration should be reported to Fujitsu. Users should not attempt to access any data or programs contained within the environment that they know they do not have permission or authority to access. Users should not attempt to upload file types that they know, or subsequently discover, should not be allowed in the environment. Use of My Sites should be covered by a Customer policy document and must not promote illegal, abusive or irresponsible behaviour. Users must not attempt penetration testing (or similar invasive work) unless specifically authorised to do so by Fujitsu. Users must not knowingly use a disproportionate share of the resources of the Service and must cease from doing so immediately if shown to be that this is the case. BaaS Limits of Functionality As a shared Cloud Service, BaaS does not provide disaster recovery, nor does it offer any guaranteed Recovery Point Objective (RPO) or Recovery Time Objective (RTO) or any guarantee on performance, unless agreed on a case by case basis with the customer. Service Support Levels and Fault Logging Priority The Fault Logging Priority levels for the Service are defined in the table below. Priority 1 2 3 4 Description Failure to perform a successful backup on 3 consecutive occasions or failure to restore from a backup. Incident affecting an application or service that is not operational or not available at a specific location, resulting in disruption to the Customer’s business. Incident affecting part of an application or service that is not operational, or not available to an individual, and all other incidents. Any other problem which does not directly impact the Customer’s operations and/or has a limited financial consequence. Minor faults or investigation required. Target Response Time 2 business hours 4 business hours 8 business hours 5 business days Service Availability Service availability can be affected by hardware and software failures, natural disasters and human error. To address this, BaaS has been designed to be highly available and resilient so that it is able to quickly recover from such unexpected events. As a result, Fujitsu is able to provide a standard service level for availability of 99.9%, 24 hours a day, 365 days per year. This is calculated monthly on the basis that 100% availability equals the number of days in the month x 24 hours, minus any scheduled maintenance periods. Non-availability of the Service is subject to an applicable Priority 1 incident being active during the period of non-availability. For the purposes of measuring availability for BaaS, the boundary of the environment is the Fujitsu Global Cloud Platform (FGCP). Therefore, network connections from Customers to the BaaS infrastructure will be considered out of scope. Page 4 of 7 © Fujitsu Services Limited, 2013 Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) The Customer is required to acknowledge that availability does not include the time during which the Service cannot be used as a result of any of the following reasons: maintenance activities as described in paragraph titled ‘Scheduled Maintenance Windows’, above; a Force Majeure event; orders from government or judicial institutions to halt business activities; defects with the Customer’s facilities or the Customer not having/providing facilities to the quality and extent required for the Service; defects with the access line for connecting to the Service or the Customer not having an access line to the quality and extent required for connecting to the Service; illegal operations by the Customer in breach of this Agreement; attacks or illegal acts by third parties; The termination of the Service and of the Agreement by either party, in accordance with the terms of this Agreement. System Requirements The FGCP BaaS Service provides Backup services for, but not limited-to, the following environments which can run on the FGCP platform or independently utilise the BaaS Service: Microsoft Windows Server and the following component variants: o o o o o Windows SQL Server, Exchange, SharePoint, Oracle Agents (2003 / 2008R2) (2005 / 2008 / 2012) (2003 / 2008 / 2010) (2003 /2008 WSS 2003 /2008) (9i, 10g , 11g) Linux (UNIX) Variants: o o o CentOS 4 (up to 4.8)*, CentOS 5 (up to 5.5)* and CentOS 6* Red Hat Linux Enterprise, Advanced Server/Platform 4 / 5 / 6 SUSE Linux Enterprise Server/Desktop 10 /11 The full list of supported EVault agents is contained in support.evault/supportedplatforms/Shipping_Products_Chart.pdf Training Fujitsu provides EVault configuration guides, which will enable technical users to set up and configure backups. Trial Service Both Backup as a Service and the Fujitsu Global Cloud Platform portal comes with a set of training materials and “HowTo” guides which will enable Users to design and deploy systems that meet their business requirements. It is possible to configure and deploy test environments in a short period of time – perhaps less than an hour from the beginning of the system design through to live production. In certain cases, Customers may wish to undertake a Proof of Concept (PoC) exercise, and Fujitsu by agreement with the Customer will support this with a reduced subscription rate. Term This Agreement and the Service may be terminated at any time by either party giving the other not less than thirty 30 days notice in writing to the other party. Once the Customer has entered into this Agreement and has been provided with access to the Service, Fujitsu will carry out a credit check on the Customer. If the results of the credit check are unsatisfactory, Fujitsu will have no obligation to continue to provide the Customer with access to the Service and will be entitled to terminate the Service and the Agreement immediately. On termination of the Services and of the Agreement, for whatever reason, Fujitsu will invoice the Customer for all Charges incurred up to and including the date of termination. Page 5 of 7 © Fujitsu Services Limited, 2013 Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) On-Boarding Customers will be required to be pre-vetted before being given access to the Service. This vetting will ensure that: The Customer is able to operate the Service The Customer is using FGCP The Customer passes financial credit checks. Once pre-checks have been completed then Customers can join the Service at any time, unless they have been subsequently excluded due to operational, security or financial reasons. Initial provisioning of the Service, once initiated with Fujitsu, will be completed within one working week. A future development of the Service will allow Self-service provisioning of the BaaS Service. Fujitsu will carry out the BaaS service provisioning as per the on-boarding procedure, this procedure will be provided to the enquirer once the interested party has submitted their request to the following e-mail address GCloud@uk.fujitsu.com. The enquirer should put BaaS in the subject header. This enquiry goes to the government frameworks desk who will log and forward to the BaaS service line team. Fujitsu will provide each customer with a specific point of contact for the following types of enquiry; Where further information is required about additional or related services (including by additional users of the existing service) Related to change requests to the existing service Related to incident management, escalations or complaints Related to billing enquiries Ordering, Invoicing and Charges Customers will be invoiced on a monthly basis and issued with a report that provides a breakdown of consumed capacity. The charges of storage will be in line with the commercial terms as set out in the supporting commercial documents and billing procedure, these documents will be provided on request. Service Exit If the Agreement is terminated for any reason Customers will at the date of termination be de-registered from the qualified list of Customers entitled to receive the Service. Data and Services that are currently being operated by the Customer will then be required to be migrated off the Fujitsu platform prior to the end date of that notice period. Once a Customer has exited the Service there will be no further access provided to the data. Off-Boarding: Data Extraction and Removal On the date of any termination of the Agreement, the Service will be disconnected, the User accounts disabled, and the content stored in BaaS will be purged and data deleted to secure standards ensuring no other party, nor Fujitsu will have access to this data, or from re-used disk resources, thereon . It is the User’s responsibility to remove and secure any data prior to the date of termination. Dependencies and Responsibilities This section describes technical dependencies and obligations for the Customer on agreeing to use the Fujitsu BaaS Service. Client Technical Dependencies BaaS has been designed to deliver services for Customers that are customers on the Fujitsu Global Cloud Platform (FGCP). Customer Responsibilities This section details the Customer’s responsibilities that are required to be adopted when using the Fujitsu BaaS Service: Page 6 of 7 © Fujitsu Services Limited, 2013 Fujitsu Global Cloud Platform Service Specification: Backup as a Service (BaaS) Ensure appropriate contacts for escalations who can provide timely intervention Establish a nominated contact point for day-to-day Service queries Provide appropriate User briefing and education to enable them to use the service desk effectively Adherence to the Fair Usage Policy Fujitsu will not be liable for any delay or deficiency in providing the Service if such delay or deficiency results from the Customer’s failure to fulfil these dependencies or comply with these responsibilities. Should a delay to the Service result from the Customer’s failure in relation to the above dependencies, for example, if there is no access to relevant information, Fujitsu shall be entitled to amend the Service, this Schedule and/or the Charges with no liability and shall be entitled to charge the Customer for any cost incurred as a result. Service Exclusions The following elements are not included or applicable as part of the offered Service and are therefore not included within this Service Definition: Information assurance - Impact Level (IL) at which the G-Cloud Service is accredited to hold and process information BaaS holds the same impact level as FGCP – IL0 Financial recompense model for not meeting service levels There is no standard financial recompense model. This service does not include a first line service desk function. Customers will need to provide their own IT service desk to manage all first line calls from users. Fujitsu will provide customers with details of 2nd line support provision and who to contact in an onboarding pack. This will be provided following placement of an order. Definitions Any terms used in this Service Specification have the meaning assigned to it by the Fujitsu Cloud Service Agreement Terms and Conditions. Additional terms used have the meaning assigned by this paragraph. In the event of any conflict between the terms of this Service Specification and the other documents that comprise this Agreement, the provisions of this Service Specification shall prevail. Table: DEFINITIONS Term/ Abbreviation Definition BaaS Backup as-a-Service Fujitsu Global Cloud Platform (FGCP) The global cloud platform service provided by Fujitsu. User The end user of the Service. Page 7 of 7 © Fujitsu Services Limited, 2013