fujitsu secure cloud hosting & sdn services · fujitsu secure cloud services provides both...

FUJITSU G-Cloud Services { Insert Service Name }

of 29 ©Copyright FUJITSU 2020

Service Definition

Fujitsu Secure Cloud

Hosting & SDN Services

G-Cloud 11


Table of Contents

Fujitsu Secure Cloud Overview ......................................................................................... 3

Scope of Services .............................................................................................................. 7

Fujitsu Secure Cloud (Hosting) Deliverables ............................................................... 7

Portal and APIs .................................................................................................................. 7

Availability Zones ............................................................................................................ 8

IaaS Service Features .................................................................................................... 8

Operating Systems and Blueprints ............................................................................... 8

Cloud based Software Defined Networking (SDN) or SD-WAN capabilities .......... 10

Service Delivery .............................................................................................................. 13

Service Delivery ............................................................................................................... 13

Service Management ....................................................................................................... 13

Security and Information Assurance ................................................................................ 14

Business Continuity ......................................................................................................... 15

Training and Consultancy ................................................................................................ 15

Additional Service Options .............................................................................................. 15

Secure Cloud Services On-boarding and Off-Boarding Processes ................................... 17

On-boarding .................................................................................................................... 17

Off-Boarding .................................................................................................................... 17

Data migration ................................................................................................................ 17

Secure Cloud Services Service Levels .............................................................................. 18

Availability ....................................................................................................................... 18

Planned Maintenance...................................................................................................... 18

Service Levels .................................................................................................................. 18

Pricing ............................................................................................................................. 20

Commercial ..................................................................................................................... 23

Ordering and invoicing Process ........................................................................................ 23

Minimum and Maximum Terms ...................................................................................... 23

Service Credits ................................................................................................................. 23

Customer Termination..................................................................................................... 24

Supplier Termination ....................................................................................................... 24

Consumer Responsibilities ............................................................................................... 24

Service Constraints .......................................................................................................... 24

Service Exclusions ............................................................................................................ 25

Definitions ...................................................................................................................... 26

FUJITSU G-Cloud11 Service – Secure Cloud Services


Fujitsu Secure Cloud Overview

Fujitsu Secure Cloud Services is the platform used to deliver our next generation digital business capabilities and Software Defined Network (SDN) solutions that draws on Fujitsu’s Global experience of delivering cloud technologies. Fujitsu Secure Cloud is a service designed to meet UK Sovereign data requirements providing a private cloud solution hosted in the UK within its own tier III accredited datacentres that is capable of running workloads and or software network applications supporting Security Classifications OFFICIAL (Sensitive), SECRET or above SECRET. All staff associated with the Services are at a minimum SC or DV cleared. Some services described herein due to accreditation requirements may not be available at all classification levels or may require additional end user bespoke developments to comply with Customer Information Assurance policies. This usually affects services operating at above Secret and would be advised by Fujitsu upon identification of user requirement.

Fujitsu recognises that cloud platforms (without vendor lock in) are now the de facto standard or strategy for Public Sector users who wish to take advantage of digital transformation and rapidly develop and deploy applications or network overlay services for end users. The challenge comes, when this approach is required in a secure environment that meets the stringent requirements of Government Security Classifications above OFFICIAL, with the corresponding alignment to NCSC standards and or Departmental Information Assurance requirements. The success of any Cloud strategy is dependent on how users can access those secure services and how to handle transition from current legacy platforms and network infrastructure.

Fujitsu’s updated Secure Cloud Services reflect customer demand for access to a range of secure cloud and connectivity based services. Designed to meet that challenge by providing a feature rich secure cloud environment with a low cost of entry. Our updated solution description falls into two categories;

Industry leading cloud technology from VMware with special focus on reducing the entry footprint of the private cloud service, for cloud hosting. This service utilises VMware’s Software Defined Data Centre (SDDC) solutions and has been designed with support from VMware consultants following patterns known to be accreditable at either SECRET or TOP SECRET.

Cloud based Software Defined Networking (SDN) or SD-WAN capabilities. Using deployed and developed interchangeable service offerings based on COTS products with key vendors including Silver Peak, Juniper Networks and Cisco. Our solution meets stringent NCSC standards and new emerging security and availability principles for critical national infrastructure. Fujitsu’s SDN solutions are suitable for Customer operating at OFFICIAL (Sensitive) and above and can include managing or using Customer disaggregated network supplier arrangements.

All services can be delivered using a pay-as-you-use pricing model with a range of physical capacities allowing customers to auto-scale, as demand requires. The service design has been aligned to include features that are commonly found in public cloud environments and published Cloud Security Principles.

Fujitsu Secure Cloud services provides both Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) capabilities. For Secure Cloud offering this includes:

A secure digital business platform based on utility (pay-as-you-use) charging



A flexible range of computer resources made up of different quantities of virtual CPUs and memory (RAM)

A range of storage options including block storage, image storage and replicated storage

The ability to configure virtual networks for each individual customer application or project resources

A range of virtual networking components including virtual switches, load balancers and firewalls

A choice of pre-existing operating systems templates with the ability to introduce more

Self-service Portal that vastly simplifies governance and operations of the cloud allowing authorised administrators, developers and business users to select and approve services that comply with pre-defined business policies

Logical infrastructure and application blueprinting

Visibility and transparency of the types, cost and quality of IT services consumed.

Figure 1 - Fujitsu Secure Cloud Hosting Service delivers IaaS and PaaS services built on industry leading technology and solutions

For Secure network applications, Fujitsu provides Software Defined Networking (SDN) or SD-WAN capabilities and our solution supports:

A Orchestration Platform (per user) enabling the Customer to self-manage aspects of its SDN service or for Fujitsu to operate the service on behalf of the Customer

A fully featured SD-WAN solution (from our key partners) based on any bearer of opportunity creating a virtual WAN over any IP connection

Choices of edge devices appliance or NFV based supporting from 1Mbpsto 30Gbps at a site



Edge Devices are NFV based supporting in addition to SDN functionality next generation firewalls and other customer applications

Security overlay capability providing NCSC PRIME Encryption Standard with the ability to separate security management and policies from SDN network functionality

Encrypted data in transit inspection tools for Customer SOC (without decrypting data)

Standard API’s for customer tooling and service management platforms

Connections feeding AI for auto inspection of emerging threat vectors

Provision of network connectivity or provided as an overlay capability on Customer provided connectivity supporting customer disaggregated network supplier arrangements

Access as an optional service to Fujitsu’s private and dedicated secure core network and PoPs to support regional network requirements across the UK

Design, Deployment and Project Management services

Evergreen solution with latest functionality provided for duration of service

Customer Management portals

Alignment to Customer Information Assurance policies operated out of the UK by Fujitsu own staff SC minimum clearance.

Use of Sandbox test system for application testing

Fujitsu Secure Cloud services offer a dedicated private cloud capability hosted in one or more Fujitsu or customer datacentres or a mixture of Fujitsu and customer datacentres if appropriate. SECRET variants (for some services) can also be provided as a multi-tenant (UK Government only) platform hosted in UK based Fujitsu data centres.

The Fujitsu’s UK tier III data centres are well served with Public Sector Network (PSN) connectivity and our own secure private Fibre Network with PoPs across the UK interconnected connected with internet peering points for connectivity choices. Operating secure infrastructure across the Public Sector Fujitsu can offer many references for example as the provider of the Global Connectivity Service to the Ministry of Defence, Fujitsu is ideally placed to provide high speed secure network connectivity. Fujitsu operates its own national and global network Fujitsu is able to provide secure high speed network connections to sites up to the speed of 100 Gbps.

The pricing and terms published in the Digital Marketplace for G-Cloud apply to Fujitsu Secure Cloud services. Alternative configurations for the SDN service and other services such as Fujitsu secure core network and UK PoPs can be provided and prices associated with those services are available on request.

All delivery methods of Fujitsu Secure Cloud Service use a common infrastructure design. G-Cloud customers can use both our Public and Private Cloud variants to create a truly hybrid service and can consume services as an IaaS service that also provides PaaS capabilities.

Fujitsu’s Secure Cloud Service enables Buyers to:

Deploy new digital business services faster and cheaper than traditional methods

Remover Accreditation Risk and deploys proven technology using COTS solutions



Optimises cloud platforms across public and private clouds to deliver Hybrid IT

Achieve business operational efficiencies

Modernise and exploit the value of their existing IT investments

Leverage enterprise mobility, big data analytics and the Internet of Things (IoT)

Provide a platform for application development and solution experimentation or provide Model Office Capabilities

Drive fiscal and operational benefits when combined with a disaggregation strategy could deliver up to 30% savings over traditional network solutions.

Figure 2 - Fujitsu Secure SDN IaaS and PaaS service built on industry leading technology and solutions over any IP network



Scope of Services

Fujitsu Secure Cloud (Hosting) Deliverables

The primary deliverable of the Secure Cloud service is the provision of a dedicated set of cloud infrastructure and software. Hosted within nominated UK Fujitsu data centre /s with an option to host on crown premises. When using Fujitsu Datacentres, the service will be located within an area of the data centre that has already been accredited. The data centre and specific area has appropriate access controls to ensure only appropriately security cleared personnel have access.

The infrastructure will be built to the initial agreed specification, which can aligned to the specific customer requirements. The infrastructure can also be expanded during the contract period, subject to the constraints detailed below.

The solution has been designed to scale from a small entry level cloud up to a large enterprise cloud. The entry level configuration provides the customer the following capacity:

60 CPU Cores

15 Terabytes of Storage

1024 Gb of RAM

Allocated over 3 physical hosts.

In addition, a resilient trio of management hosts will also be provided. These nodes host the management services required to provide the VMware Software Defined Data Centre Services including the User Portal, hypervisor management, automation services, operations management and reporting.

Portal and APIs

Fujitsu’s Secure Cloud provides a User Portal and APIs that enable customers to consume, configure and manage their service. The use of unique user accounts and role based security allows organisations to delegate permissions appropriately. Separate roles can be created with different profiles for design, provisioning and request approval within the service. API access is based on VMware’s standard API interface, which is capable of being used for custom deployment scripts, continuous integration / deployment tools and automated deployment tools such as Terraform, Cloudify or Cloud Foundry.



Availability Zones

Fujitsu Secure Cloud can be provisioned into multiple data centres in order to provide multiple Availability Zones. Availability Zones are physically and logically isolated from each other and allow for systems to be configured for high availability and load balancing in the event of a failure at a single location. Irrespective of whether operated in one or more UK locations, Fujitsu shall ensure any data stored within the service is not stored or processed outside of UK jurisdiction. As detailed above the solution is able to be operated from Fujitsu datacentres or customer datacentres (which can include crown premises) or a mixture of the two. The exact locations will depend on the customer’s security requirements.

IaaS Service Features

Fujitsu’s Secure Cloud offering provides enterprise grade virtual server, storage, and networking capabilities. The infrastructure is highly available with redundant paths to the compute, storage and network elements.

Fujitsu will manage the capacity of the platform, enabling the customer to initiate new workloads and applications on demand (within the bounds of the agreed physical capacity).

The consumable elements of Fujitsu’s Secure Cloud components comprise:

Virtual Machines

Storage

Backups and Snapshots

Operating Systems

Network

Firewalls and Security Groups

Monitoring and Security.

Each of the individual consumable elements will support user and project level security access controls. This combined with the network virtualisation allows the customer to implement granular object level security.

These individual services are priced on a pay-as-you-use basis that is aligned to common public cloud services. For example, Virtual Machines are priced on a per hour basis.

Operating Systems and Blueprints

Fujitsu shall provide a selection of operating system template images, which can be enhanced by the customer or Fujitsu using the Blueprinting capability. A blueprint is used to define the components of a service, which are the input parameters, submission and read-only forms, sequence of actions, and provisioning. Using industry leading software, service blueprints can be created to support the provision of custom resources in a repeatable manner.

The operating system images that can be provided as standard within the offering are:

Windows 2008 R2



Windows 2012 R2

Windows 2016

Redhat Enterprise Linux 6

Redhat Enterprise Linux 7

CentOS.

Some operating systems will incur an additional usage charge. In addition, legacy operating systems and virtual desktop infrastructure can also be provided at an additional charge. Where legacy operating systems are no longer in support by either the vendor or VMware, they can be operated by the customer on the understanding no support or warranty can be provided.

Fujitsu’s Secure Cloud service will also allow individual VMs to encrypt data at rest using the AES256 algorithm. Different secure data enclaves can be provided through the use of Data Encryption Keys, allowing data at rest enclaves to be cryptographically separated, albeit encrypted using the same AES256 algorithm. The system is KMIP 1.1 compliant, which would allow the customer to provide appropriate data encryption keys, if required.

Fujitsu Secure Cloud can be connected to the customer network via a resilient pair of outbound connection ports from 1 Gbps up to 100 Gbps).

Fujitsu is also able to provide public and private cloud services based on OpenStack and other vendor products; customers should contact Fujitsu for details of these and any other services.



Cloud based Software Defined Networking (SDN) or SD-WAN capabilities

Fujitsu offers a cloud based SDN and SD-WAN managed service is a utility-based model based on the number of sites and bandwidth managed. It provides a Customer with an alternative to capital investment to the purchase of hardware and software.

The service alternative enables all elements of the SDN service to be hosted cost-effectively and provides an evergreen environment, while meeting complex information assurance requirements.

Fujitsu’s SDN facilities are hosted in its own UK tier III accredited datacentres and supported from dedicated Operational Management Centres. Our Service Boundary options include:

Management and provision of SDN & SD-WAN solution

Management and provision of SDN & SD-WAN solution with Authority-provided connectivity

Service Management of connecting services

Services and solutions supporting security designations from OFFICIAL Sensitive to SECRET and above

Commercial flexibility, as it is possible for the Customer to own the hardware and software of the solution managed by Fujitsu.

Optional services such as use of secure Fujitsu UK core network and PoPs

The demarcation points of the service is flexible though usually is the central equipment hosting and edge solution.

All services are managed via Fujitsu’s orchestration platform, with tooling provided by Fujitsu and or use of Customer tooling to monitor or make additions, changes and deletions.

Fujitsu offers as an option public (and private) connectivity peering points for Customer provided WAN connectivity. Fujitsu’s Public Peering Points include:

London, LINX and LONAP

Leeds, IX Leeds

Manchester, MCIX.

Note peering location request will be subject to confirmation with Fujitsu. We also peer at a growing range of other locations to ensure full support to our Customer Information Assurance requirements. In the UK, we have deployed over 6,000KMkmprivate fibre and operate in over 20 additional peering points to support our customer requirements and internet connectivity.

When implementing a network disaggregation strategy, this wide range of options enables the Customer to source connectivity locally or regionally, with common peering points, creating an SDN solution across the UK without backhauling to datacenters.

Fujitsu’s managed service offering has been designed with customisation and flexibility in mind. This means the Customer can choose the roles and responsibilities it wishes to perform for itself.



Access to the SDN services will be enabled via the Orchestration platform and managed using a Customer agreed RBAC process. Once defined, Fujitsu will create access user profiles, against which access rights and permissions will be allocated to users.

The full administration levels offered in the solution will match Fujitsu own equivalent customer service desk facility. Customers with agreed RBAC rights may access the following elements via a portal:

Offering historical real-time monitoring for usage patterns and service characteristics

Ability to make application based Adds/Changes/Deletions.

Fujitsu has around 1000 SC cleared, SDN trained engineers and has substantial experience in delivering secure overlay services. This includes providing connectivity and infrastructure at scale for the UK Public Sector. Our engineers are trained in the deployment and data collection requirements of an SDN environment. We have invested in our operations capability, providing SDN services in dedicated, secure Accredited UK infrastructure for customers operating at Official (Sensitive) and above. The mobilisation period required is minimal, with existing collateral available for re-use, covering design, build and service.

For SDN services, Fujitsu operates a continuous testing regime, using a dedicated sandbox system for both Fujitsu’s and client testing and accreditation activities. The sandbox system can be extended to the Customer for functional tests and solution approval. This capability could be used to pilot the SDN solution from Fujitsu for deployment at the Customer sites. Our sandbox solution can support up to 50 sites per customer. Our SDN solution can support up to 10,000 sites per customer.

Fujitsu’s solution is modular and based on tested and approved COTS products. Components, such as the SD-WAN application, may be replaced with other vendor products. Each component is tested and submitted both for interworking and to meet Accreditation requirements.

Fujitsu’s service provides a number of benefits and USPs:

1. Designed and deployed in UK, with secure infrastructure for Public Sector

2. Network agnostic SDN Solution, flexible to accommodate supplier and/or customer provided connectivity

3. Modular Virtualised option supports additional customer applications

4. Experience in achieving accreditation/assurance, and complying with complex IA requirements

5. Highly scalable operations to accommodate additional Public Sector customers

6. Tooling and Service Management options, conforming to ISO/IEC20000:1 and aligned to ITILv3(2011)

7. NCSC aligned for Cloud security principles and Network encryption at PRIME; delivering a zero-trust network design

8. 1000 trained, experienced engineers

9. Active-Active service, supporting high availability targets

10. Transparent Operational Management; sharing tooling and information in real-time

11. Sandbox system deployed and able to support Authority POCs or pilots

12. A subscription model supporting reduction or increases of the bandwidth in use; with the charges reflecting usage. Sites may be removed from service with 30 days’ notice.

Fujitsu has invested in deploying its own platforms and capability, providing SDN/SD-WAN technology in dedicated and secure Accredited UK infrastructure, targeting UK Public Sector clients operating at Official (Sensitive) and above.



Aspects of the solution could also be hosted in the Customers own environment, depending on the Information Assurance requirements, following appropriate adoption of NCSC 16 cloud security principles and NCSC connectivity guidelines.



Service Delivery

Service Delivery

Fujitsu will deliver the hosted services from its UK data centres. Fujitsu operates its UK data centres to an Uptime Institute Tier III capability. Our data centres hold either the Uptime Institute Tier III Gold Certification for Operational Sustainability, Tier III Certification of Constructed Facility and Tier III Certification of Design Documents or are an Uptime Institute Management and Operations approved site. As an option, services can also be hosted on Crown Premises or a combination of Fujitsu Datacentres and Crown Premises.

Fujitsu will restrict access to the infrastructure to those required to perform management and maintenance of the service. This will include physical security restrictions within the data centre and also any remote access. The service shall be managed from Fujitsu List X facilities located within the UK using appropriately secured network connections. All personnel that are enabled to access the service will be appropriately security cleared in line with the requirements agreed with the relevant accreditor and security aspects letter. As an option, the solution can also be managed by Fujitsu staff located on Crown Premises, which is likely to occur additional charges.

Service Management

Fujitsu will deliver the services in accordance with its standard processes. These processes are designed to comply with, or are certified to the internationally recognised ISO 27001, an independent international information security management standard. Authorised business users of the Cloud Service are able to access Monthly Utilisation Reports and billing information from the user portal.

In order to ensure the Cloud services are provided effectively; Fujitsu shall appoint a lead Service Delivery Manager to work directly with the customer. Fujitsu’s Service Delivery Manager will have responsibility for ensuring that Fujitsu delivers the services in accordance with the call off contract. In addition, they shall work collaboratively with the customer’s representatives to ensure the service meets the needs of the organisation.

As part of the overall managed service, Fujitsu shall manage and monitor the underlying platform and as an option, any customer virtual servers (managed virtual servers are subject to an additional management charge). The underlying cloud platform software and firmware will be regularly updated to ensure the service remains current, secure and able to operate without unplanned interruptions. Monitoring of this service shall be performed 24 x 7 x 365 using advanced system and security monitoring tools provided as part of the VMware suite of software. If required any system or security logs gathered by this service can be forwarded in their entirety or in part to the customer’s own security and system management service.

Management of the Service will be performed on Fujitsu premises however can be performed on customer (crown) premises if required.

Fujitsu may conduct maintenance activities in order to ensure the smooth operation of the Service and such maintenance activities may temporarily interrupt the provision of the Service. Fujitsu will use reasonable endeavours to provide the Customer with at least 30 days advance notice prior to conducting any maintenance activities.



Fujitsu may temporarily interrupt the provision of the Service in order to conduct urgent maintenance activities. In such cases, Fujitsu will inform the Customer that urgent maintenance activities need to be undertaken and seek to agree a suitable maintenance window where possible.

Fujitsu shall ensure any changes made to the environment have been appropriately tested prior to implementation and in doing so will ensure they do not cause any unexpected change to the security properties of the service.

With the exception of system and security monitoring and responding to Severity Level 1 Incidents that have been detected by the system and security monitoring solution, all Service Management activities will be performed during standard working hours Monday to Friday 08:00Hrs – 17:00Hrs (excluding Public and Bank Holidays). The option for additional support hours can be requested and shall be subject to an additional charge.

Security and Information Assurance

Fujitsu is certified to ISO 27001, an independent international information security management standard. The technical and procedural security measures have been selected through an appropriate risk assessment, and the cloud security is under regular review to identify new risks and further improvements to continually improve the overall security of the services. In addition, Fujitsu has extensive experience in designing and managing government services that operate at SECRET and above.

Fujitsu’s Cloud service is designed to be appropriate for processing workloads and information categorised at the Official (Sensitive), SECRET and Above government security classification. Fujitsu in the UK is certified for Cyber Essentials Plus and has designed the Cloud service to meet the goals defined in NCSC Cloud Security Principles 1-14. Fujitsu will work with customers to ensure Fujitsu’s information security standards meet the customer’s own security and risk management requirements. In addition, Fujitsu shall adhere to all the requirements of the Defence Cyber Protection Partnership, HMG Security Policy Framework and supporting Security Policies (e.g. Government Security Classification Policy).

Fujitsu will monitor for and respond to any Security Incidents, which can be triggered by various sources, by following our defined Security Incident Management Plan which includes workflows to support a range of different scenarios. Fujitsu will assist the customer with security investigations that relate to the service, when requested to do so. In all cases, these incidents will be managed by a member of Fujitsu’s Security Operations Centre (SOC).

Fujitsu shall monitor the service for potential threats and vulnerabilities. When new security patches are made available from a vendor, these shall be applied following the vendor prescribed deployment approach. Patches are deployed based on the threat level and existing mitigation approaches that are in place. As a minimum, all appropriate security patches will be applied within 30 days of release from the vendor. In certain cases, where the security risk profile is deemed to require it, and based on agreement from the customer, critical unmitigated security patches will be deployed within 48 hours of release by the vendor.

Due to the nature of the Cloud service, it should be noted that the customer is responsible for the security and accreditation of their virtual server workloads and any solutions built upon them. Fujitsu is able to provide additional Information Assurance services for customer workloads where required at an additional charge.



Business Continuity

Fujitsu takes steps to backup and enable the recovery of its core infrastructure and services, taking appropriate steps to enable the Cloud service to remain accessible and consumable. Should a business continuity event occur that impacts an element of the service that Fujitsu is responsible for, it will implement its Business Service Continuity processes and take the necessary steps to return the service to normal operation. Where the service is operating from two or more locations, depending on the continuity event, this may result in all services being operated out of the other locations.

Elements of the Cloud service (excluding SDN services) not include within its scope backup, data restoration and business continuity for customer content. However, Fujitsu provides mechanisms to allow the customer to take such steps. These backup services shall be charged on a per usage basis (i.e. backup storage is charged per GB per hour).

Additional services are available from Fujitsu, which can be layered on top of the Cloud services to provide business continuity if needed, and purchased as an additional service.

Training and Consultancy

Customers will be provided with user guides that allow users to get the most out of the service. Formal training however is not included as part of the basic service, but can be provided on request at an additional charge.

If required additional consultancy can also be provided subject to an additional charge.

Additional Service Options

Fujitsu Secure Cloud services is intended to provide a flexible and cost effective solution for customers wish to obtain the benefits of the cloud with a privately hosted cloud platform. Fujitsu intends to extend the range of services delivered by their cloud service over time and therefore it is always advisable to discuss with Fujitsu the current service options that are available as part of this service.

The current range of options available for this service includes:

Alternative Government Security Classifications including TOP SECRET

Varying physical hardware sizes

Resilient data centers (Fujitsu and / or Customer provided)

Additional Managed Operating Systems

Additional Managed Database Services

Additional Platform as a Service Capabilities

Blueprinting Services

Managed Backup and Data Protection Services

Different Hosting locations (Fujitsu Sites and Customer Sites)

Shared Government Cloud Services

Security Enforcing Services (anti-virus, two factor authentications etc.)



Security Analytics Service

Additional Service Management services and hours of operation

Cloud Service Consultancy

Enhance Firewall Capabilities

Network Connectivity and Virtual Private Network Services

Application Development

Application and Data Migration

Application Hosting

Application Modernisation

Legacy Server On-boarding and migration

IT Service Management Tooling and integration

Hosted Directory and DNS Services

VMware Integrated Containers

Content Delivery Network and local caching

API Management

Developer Support and Consultancy

Managed Enterprise Service Bus Services

Big Data and Data Analytic Services

Machine Learning

IoT Services

Secure Software Defined Connectivity Services

Software Defined Network Management Service

Software Defined Security Overlay service

Connectivity Services

Peering Connectivity Options

Secure Overlay Services (SDN PRIME Based Encryption over other vendors networks)

Use of Customer Provided Connectivity

Walking and Takeover of Customer Provided SDWAN service

Accreditation of Customer SDN service.



Secure Cloud Services On-boarding and Off-Boarding Processes

On-boarding

The on boarding process is dependent on the Secure Cloud service required.

For secure Cloud Hosting as part of the standard service, no specific on-boarding activities have been included. The customer will receive an operational cloud environment, user portal and API interface which they can start consuming. If required, Fujitsu is able to provide a service to migrate existing cloud and physical services to the cloud and provide a set of additional blueprint templates. The exact requirements for this service should be discussed with Fujitsu and will incur an additional charge.

For the SDN Service the on-boarding process is dependent on the configuration options agreed with the Customer (as detailed in this service description). Fujitsu’s on-boarding solution includes use of an experienced SDN team guiding the Customer through any design, connectivity and management requirements, as well as data capture of the Customer site requirements. The standard service is for the Customer to provide all connectivity to our deployed SDN Orchestration service..

Off-Boarding

As part of the standard service, no specific off-boarding activities have been included. The customer should ensure all services have been migrated off the cloud service prior to the end of the contract. Fujitsu is able to provide additional services to support the customer with these migration activities and should confirm the price for these services prior to termination.

For the SDN Service prior to termination of the service or upon request from the Customer, Fujitsu will provide professional services to design and agree the transition requirements and services including any interworking with any replacement service required in accordance with the published man-day rates. All SDN Services during any transition arrangement will continue to be available until expiry of the termination date agreed.

For the Secure Hosting Services at the end of the contract, Fujitsu shall ensure that all dedicated hardware is disposed of securely, environmentally and following a NCSC/CESG assured process.

Data migration

As part of the standard service, no specific data migration activities have been included. Fujitsu is able to provide additional data migration services to support the customer with these migration activities. The price for data migration services is available on request.



Secure Cloud Services Service Levels

Availability

The standard service provides a service availability of 99.9% for each Virtual Server measured on a 24 x 7 basis and calculated monthly.

For SDN Services the standard service provides a service availability of 99.99% measured at the Orchestration platform 24 x 7 basis and calculated monthly.

Planned Maintenance

Fujitsu may conduct maintenance activities in order to ensure the smooth operation of the Service and such maintenance activities may temporarily interrupt the provision of the Service. Fujitsu will use reasonable endeavours to provide the Customer with at least 30 days advance notice prior to conducting any maintenance activities.

Fujitsu may temporarily interrupt or for SDN based services reduce functionality the provision of the Service in order to conduct urgent maintenance activities. In such cases, Fujitsu will inform the Customer that urgent maintenance activities need to be undertaken and seek to agree a suitable maintenance window where possible.

Service Levels

The following table outlines this service levels that apply. All service levels defined apply during the standard working hours Monday to Friday 08:00Hrs – 17:00Hrs (excluding Public and Bank Holidays).

Service Level Description Measurement Service Level

Incident Management – Severity Level 1 (Response)

Monthly 20 Minutes


Monthly 40 Minutes


Monthly 5 Hours


Monthly 1 Working Day


Monthly 2 Working Days

Incident Management – Severity Level 1 (Resolution)

Monthly 95% within 4 Hours


Monthly 90% within 8 Hours


Monthly 90% within 3 Working Days


Monthly 90% within 5 Working Days



Service Level Description Measurement Service Level


Monthly 80% within 10 Working

Days

Priority/Severity Incident Management Severity Level Definitions

1 Severe business disruption: All existing Virtual Servers are unavailable or unable to be managed.

2 Major business disruption: New Virtual Servers or other cloud services are unable to be provisioned, or one or more Virtual Servers are unavailable or unable to be managed.

3 Minor business disruption: single user unable to manage any virtual resources within the user portal or API.

4 Minor disruption: single user or user group experiencing problems with the user portal or API, but with circumvention available.

5 Enquiry: single user or user group requiring assistance but with no direct impact on business. For example, a request for information. Also used for change requests



Pricing

Fujitsu Secure Cloud is charged based on two elements: a standard monthly service charge and a usage charge that is made up of the costs of each components used. There are multiple deployment options at multiple classifications. The scenario of a small scale private cloud for a single tenant at SECRET is priced below, with pricing for other scenarios available on request.

This monthly virtual server charge assumes the following:

The server is run continuously 24 hours a day 7 days a week

There are 730 hours in the month

Classification: Secret

Tenancy: Private cloud for a single customer

24 month contract term.

Server Size: Small

Description

Memory: 1GB

VCPU: 1

Storage: 50GB

Small virtual server running a webserver operating 24 hours a day 7 days a week. Note: in this scenario we have assumed CentOS as the Linux OS

Price £125.10 per month

In addition, there is a monthly service charge, which shall be based on the exact physical hardware provision for the private cloud. For the following initial capacity:

60 CPU Cores

15 Terabytes of Storage

1024 Gb of RAM

Allocated over 3 physical hosts.

There will be a monthly service charge of £24,995.

The customer must also agree to ensure the private cloud usage meets a minimum utilisation commitment for 50% of the RAM, Storage and Compute that the customer requests that Fujitsu provisions in the service when calculated monthly on an hourly basis.

Fujitsu recognises there are a range of methods of charging for secure private cloud services and therefore is happy to discuss with the customer different methods of charging, including



Upfront Set-up charge

Different monthly service charge

Different usage charge

Utilisation Customer provided software licenses

Customer provided software licenses.

Fujitsu’s SDN Service is charged based on three elements: a standard monthly service charge for the Orchestration Platform (per Customer), edge device and a utility-based service charge based on bandwidth used. Charges include all service management based on Mon to Fri 8:30 to 17:00. There are multiple deployment options at multiple classifications. Pricing for other scenarios available on request.

This monthly charge assumes the following:

Service uplifts available 24 hours a day 7 days a week

Evergreen solution updated to latest certified solution (always current solution)

Professional Services charges excluded

Service Management 9 to 5 mon to Fri unless level 1 fault occurs

Connectivity provided by Customer at site and to Fujitsu Datacentres

No more than 3 network services providers per edge device

Edge device single (dual and Active Active options available)

There are 730 hours in the month

Classification: Official Sensitive

Tenancy: Hosted in Fujitsu Datacentres

1 month minimum contract term.

Service Description Headline SDN Charges

Hardware

Single Edge Device up to 1gb £30.00 Per Month

Single Edge Device 1gb to 5gb £90.00 Per month

Single Edge Device 5gb to 10gb £120.00 Per Month

Installation of Edge Device £750.00

(one off set up fee)



Service Description Headline SDN Charges

Service Costs

Orchestration Platform £1,000 Per Month

Customer Management Portal £200.00 Per Month

Software subscription charge per site including Hosting & SOC Services:

Charge Per month calculated on actual bandwidth reported by Fujitsu Orchestrator

Minimum Site Charge if no traffic reported £65.00 Per month

Up to 20 Mbps average daily bandwidth consumption £105.00 Per Month

> 20 Mbps to 30 Mbps average daily bandwidth consumption £108.00 Per Month





> 500 Mbps to 1Gbps average daily bandwidth consumption £590.00 Per Month

> 1Gbps to 2Gbps average daily bandwidth consumption £905.00 Per Month

> 2Gbps to 5 Gbps average daily bandwidth consumption £1200.00 Per Month

> 5 Gbps to 10Gbps average daily bandwidth consumption £2699.00 Per Month

Fujitsu recognises there are a range of methods of charging for secure private cloud services and therefore is happy to discuss with the customer different methods of charging, including

Upfront Set-up charges reducing monthly costs

Charges for high resilient solutions on site and datacentre builds

Different usage charges

Utilisation Customer provided software licenses

Charges reflecting customer provided software licenses

Connectivity services provided by Fujitsu

Split Service Management Responsibilities.



Commercial

Ordering and invoicing Process

Fujitsu will commence the delivery of the service defined in this document on execution of a call off order under the framework and receipt of a Purchase Order from the Customer. Once this has been received, Fujitsu will confirm initial requirements and commence the cloud implementation.

The Customer will be invoiced for the charges monthly in arrears.

Minimum and Maximum Terms

For the Secure Cloud Service the minimum term of this service is 24 months. In some cases it is possible to reduce the minimum term either by agreeing large usage commitment or deploying larger physical nodes. Please discuss these options with us.

For the SDN service, the minimum term of this service is 1 month. By agreeing large usage commitment or term up to 24 months, costs may be reduced accordingly. Please discuss these options with us.

Service Credits

For the Secure Cloud Service Fujitsu provides an availability service level for the performance of virtual servers applying the following service credit if a performance commitment of 99.9% is not met.

Ratio of hours a virtual server is available during the month

Ratio of usage fee not required to be paid

Less than 99.9% 10% of the usage fee due for that virtual server that month

Unavailability of virtual servers is measured by Fujitsu for the period during a month during which any of the virtual servers operated by the customer are not usable.

Fujitsu is able to provide higher levels of service availability to clouds that are operated out of more than one data centre location. Please contact us for more information.

For the SDN Service Fujitsu provides an availability service level for the performance of the Orchestrator applying the following service credit if a performance commitment of 99.99% is not met.

Ratio of hours a virtual server is available during the month

Ratio of usage fee not required to be paid

Less than 99.99% 10% of the usage fee due for sites impacted by performance

Unavailability of service is measured by Fujitsu for the period during a month during which any of the Edge devices operated by the customer at a site are not usable.

Fujitsu is able to provide higher levels of service availability. Please contact us for more information.



Customer Termination

Early termination will require full payment for the outstanding length of the agreement which includes all outstanding monthly service charges and consumption based charged equivalent to the 50% minimum commitment as detailed in the pricing section above.

Supplier Termination

Fujitsu will provide this service for a minimum of 12 months and shall provide a minimum of six months’ notice, should they wish to terminate after this time.

Consumer Responsibilities

It is the customer’s responsibility to ensure that it has implemented, operates and maintains an appropriate level of anti-virus, anti-spyware and network threat protection (for example, firewalls or IPS) in relation to the virtual servers and any applications hosted upon them. Fujitsu will not be liable for any damage or losses caused by the introduction, creation or propagation of any disruptive element (including any virus, worm and/or Trojan horse) howsoever caused.

Customers are responsible for ensuring the integrity, completeness and accuracy of any content or other data they choose to transmit or process in a cloud environment.

Customers are responsible for use and strict management of unique identifiers and passwords supplied or created to enable access and use of the service its components. Customers must take steps to maintain confidentiality and ensure that unique identifiers and passwords and other access information required for authorised access do not become known to third parties (including by selecting strong passwords). Fujitsu excludes all liability for any losses or damage (howsoever caused) arising in any way out of or in connection with inadequate management by Customers of account access information, mistakes in using the unique identifiers or passwords and any use of by third parties arising due to the act or omission of a Customer or its end users.

Customers are responsible for providing a suitable connection to the corporate network. Fujitsu shall make available a resilient pair of network ports (from 1 Gbps or 10 Gbps) which can be used to make this connection. Fujitsu is able to provide secure high speed networks up to the speed of 100 Gbps (subject to additional charges).

Service Constraints

The following Service Constraints relate to the Cloud Service:

Customers can only provision virtual servers, storage and memory up to the limits imposed by the physical cloud hardware that has been agreed. Additional capacity has been included and reserved for system management, which is not available for direct customer use.

The customer must agree to meet the minimum commitment level agreed for this service as described earlier in this service definition. Where that minimum service level is not agreed, an additional minimum commitment charge will be applied to the monthly invoice.

The following Service Constraints relate to the SDN Service:



Fujitsu shall not be liable for customer take-up, non-take up or other discretionary use of the information provided by Fujitsu or of any of the recommendations or options generated from the Service and activities under this Service Definition.

The SDN Service pricing is subject to a minimum network size of 100 managed devices, Fujitsu may agree to offer support on network sizes of less than this minimum size, however Fujitsu may make additional charges. Any requests for such should follow the standard order process.

Fujitsu has no maximum volumes for the SDN Service; however the following factors shall impact Fujitsu’s ability to deliver the service and may incur additional charges:

Fujitsu has a standard service definition which requires the use of SD-WAN costs solutions based on Silver Peak, Juniper and Cisco equipment for the provision of the managed SDN service.

The Service described in this Service Definition and the prices for such are valid for UK on-shore only, A Customer may request none UK Geographical coverage of the SDN Service, however Fujitsu may decline the request and/or reduce the level of the service it offers and/or make additional charges to cover this change of service.

Fujitsu shall not enter into any commitment to provide the SDN Service until the Customer order, Statement of Work or other Customer requirement definition has been verified by Fujitsu as capable of meeting the Customer requirement.

Service Exclusions

The following exclusions apply to the Secure Hosting service

Customers are responsible for any third-party application licenses that are not explicitly provided as part of this service.

Management of the Customer’s payload (Operating System and above) is not included within the standard service (but can be purchased as an option)

Unless purchasing additional Cloud Specialist or other services from Fujitsu, Customers will be responsible for any applications deployed to the K5 Secret and Top Secret Cloud service.

In measuring Fujitsu’s performance, no account will be taken of any measure in respect of any period of time, incident or other measured event arising where Fujitsu has been prevented from or hindered in performing by reason of an act of omission of a customer or its End Users or as a consequence of events or circumstances beyond Fujitsu’s reasonable control.

The following exclusions apply to the SDN service

The following elements are not included as part of the offered Service and are therefore not included within this Service Definition

Fujitsu Service Desk 24-hour service desk is manned 9.00 to 5.00 Monday to Friday accept for level one incidents.



Definitions

Description Description

Additional Port (vNIC)

Each Virtual Machine that a user configures comes with one network port (vNIC) as standard. K5 can provide multiple Ports (vNICs) on a single VM if required. This is charged on the number of additional Virtual Network Cards (vNICs) attached to a VM, metered hourly.

As an example, additional vNICs could be used by Customers who have a tiered networking environment, which require a VM to be attached to multiple networks.

Auto Scaling

Customers can configure platform auto-scaling rules to automatically grow or reduce a system (in terms of number of virtual machines used). For example:

Growing the number of web servers during a known busy time of the year

Growing the system dynamically through triggers from the monitoring components based on VM or network metrics.

Block Storage

K5 provides block storage that can be used when deploying a VM. This storage is similar to the storage provided by a hard disk and is allocated on a block by block basis.

Domain Name Services (DNS) Service

The DNS Service enables a customer to create DNS records and configure options such as weights, failovers, and latency for services that are visible to the customer network, such as web servers.

Firewall

The K5 platform enables customers to create software-defined firewalls and rules in the platform to secure and protect their applications.

Global IP Address

The Customer Network Connection Service will enable a Global IP Address to be associated with a VM. This enables the VM to be accessible from the Customer Network. To encourage careful usage of these IP addresses a charge is made for Global IP addresses, metered hourly.

IaaS Infrastructure as a Service

Load Balancer

The Load Balancer service enables Buyers to balance traffic between multiple VMs. The Load Balancer supports HTTP, HTTPs and TCP connections. There are three different sizes of Load Balancers available depending on the customer’s throughput requirements.




Middleware

Fujitsu provide a catalogue of Middleware applications for customers to consume.

Object Storage

Object Storage allows customers to store large amounts of unstructured data in the storage system.

Operating Systems

Fujitsu provide a catalogue of Operating System Images for customers to consume. Customers can also upload their own images for use on the platform, or create their own blueprint.

PaaS Platform as a Service

Snapshots

Customers can create a snapshot of a K5 VM. Snapshots can be used for:

Regression purposes – rolling back a VM to a snapshot.

Creating a Template – using a snapshot to create a template of a VM to deploy a copy.

Snapshots are stored in Object Storage on the platform.

Support

Customers have the choice of taking additional support for their Cloud Service K5 resources, this is charged monthly. Two tiers of support exist:

Light Support – 9x5, email only

Basic Support – 24x7, email and telephone

Virtual Servers

A virtual server or virtual machine (VM), is an instance of a computer server that runs within hypervisor that allows for multiple servers to be contained within the same physical infrastructure.

Acceptance Means the formal agreement or “sign off” by the Customer to confirm that the System has been installed and conforms to the specification as detailed in this contract schedule.

Acceptance Criteria Means the parameters of service specification has been met.

Acceptance Tests Means such tests as carried out by Fujitsu

Available/Availability Means, for either a Customer network device or a service that depends upon the Customer Network Device this means operating and performing as designed by the approved network design or solution design at the time of Acceptance.

Break-fix Means the service to replace a failed network device on the Customer site Break-fix is not part of the Managed SD-WAN Service, but the management of the process is included.

Business Hours, Business Days Means 08:00 to 18:00, Monday to Friday excluding UK Public Holidays.

Change Assessment, Emergency Change Assessment

Means the review of routine or urgent change to The Service resulting in the issuing of an impact statement that may include an evaluation of cost, disruption and the resources required.




Change Management Procedure Means Fujitsu’s current published change management procedure.

Configuration Means the Firmware, Software, user commands, and physical attributes such as installed physical options that constitute a Network Device.

Customer Means the recipient of the Service.

Customer Network Means the entirety of the Customers network including any elements implemented and/or managed by Fujitsu.

Edge Devices Means the Network Devices to which this Service applies, i.e. Network Devices that are used exclusively by the Customer.

Customer Network Solution Means the entirety of the Customer Network as defined in the Network Design.

Customer Representative Means a person or a role within the Customer organisation who has been nominated by The Customer to be the point of contact for Fujitsu.

SDN Managed Software Defined Network Services provided by Fujitsu which include SD-WAN and Secure Overlay Services

POP Fujitsu Secure Private UK Network offering Points of Presence at specified sites

PRIME NCSC Recommended Encryption Standard to WAN connectivity


About Fujitsu Fujitsu has been working with the public sector for over 40 years and is a global IT company

offering a complete range of products, services and solutions. From looking after applications and

protecting data, to managing supercomputers around the world, we’re helping government and

business everywhere to become more innovative and efficient. Winners of Business in the

Community’s (BITC) Responsible Business of the Year 2015 and with a 5* rating in their Corporate

Responsibility Index, we are also proud to work alongside our charity partner MacMillan Cancer

Support.

FUJITSU E-mail: [email protected]

Website: uk.fujitsu.com

ID-3275/05-2016

uk.fujitsu.com

Subject to contract.

© Copyright FUJITSU 2020. All rights reserved. FUJITSU and FUJITSU logo are trademarks of Fujitsu Limited registered in many jurisdictions worldwide. Other product, service and company names mentioned herein may be trademarks of Fujitsu or other companies. This document is current as of the initial date of publication and subject to be changed by Fujitsu without notice. This material is provided for information purposes only and Fujitsu assumes no liability related to its use. Subject to contract. Fujitsu endeavours to ensure that the information contained in this document is correct but, whilst every effort is made to ensure the accuracy of such information, it accepts no liability for any loss (however caused) sustained as a result of any error or omission in the same. No part of this document may be reproduced, stored or transmitted in any form without prior written permission of Fujitsu Services Ltd. Fujitsu Services Ltd endeavours to ensure that the information in this document is correct and fairly stated, but does not accept liability for any errors or omissions.

mailto:[email protected]