Contents

Executive Summary	3

Service Introduction	3

Services Summary	3

Management Platform	5

Additional/Optional Services	5

Mandatory Services	5

Optional Services	6

Managed Services	6

Bronze Service	6

Silver Service	7

Gold Service	7

Optional Services	7

Bespoke IAAS Managed Cloud Requirements	7

Executive Summary

The following document outlines the additional “Trust Cloud Managed Services” that can be

consumed by a customer of the Trust Cloud platform. The platform is provided with a base and

mandatory service (defined as a ‘Bronze Service Level’) but Trust recognises that not all customers have the same requirements, and endeavour to provide flexible options for customers in a consumable, catalogue format.

The Infrastructure as a Service offers customers the options to utilise one of three catalogue hyper-converged platforms, and a base service, with a top up of the following (described) catalogue items.

The Trust Cloud Managed Services are available to provide:

Professional Services for Planning, Set-up and Migration, Security Services as professional services

Packaged Enhanced Silver and Gold Managed Services which include (for example) bundle of Virtual Machine (VM) Operating System (OS) management, or Antivirus provision and management

Additional Managed service options, where Trust will manage the elements of that service, including the technology and the operation of it, for example Managed Antivirus or Operating System

Service Introduction

The holistic service is comprised of the following key elements:

Platform = The productised offering, including all sub-elements/components required for delivery

Managed Services = The specific managed service element of the platform, sized based on a single theoretical workload

Technical Solution = The technical elements of the platform that directly comprise the customer systems access:

Hyper-Converged infrastructure – Dedicated Hyper-Converged, with customers choosing from one of three base levels

Secure Datacentre Hosting - all managed in Crown Hosting facilities

Network Infrastructure – Shared switch Platform (VRF/VXLAN)

Firewall infrastructure – Virtual, single firewall, Edge based landing (flexible for MPLS, SD-WAN, IPsec VPN or DCI connectivity from customer) on shared hardware solution

Management Platform = The Management platform that supports the service for Trust to be able to operate

Management Compute and Platform

Management Network and Firewall

Management Network and Firewall

Services Summary

The managed services build on top of existing “Trust Cloud” Infrastructure as a Service (IAAS) offering to clients, and the Bronze (base Managed and included with it). See “Trust Cloud Hosting Service definition”.

Silver or Gold levels, each with options delivered by either Trust of trusted third-party providers. These include the optional services such as Backup as a Service (BaaS).

Features included in the Service	Bronze (Included in Trust Cloud)	Silver	Gold
IaaS platform Hosting, WAN Management	ü	ü	ü
IAAS platform Reporting	ü	ü	ü
IAAS platform Monitoring	ü	ü	ü
IAAS platform Service Mgmt	ü	ü	ü
IAAS platform Service Desk	ü	ü	ü
IAAS platform Back end infra Mgmt	ü	ü	ü
IAAS platform Firmware Mgmt	ü	ü	ü
IAAS platform Break Fix Mgmt	ü	ü	ü
Virtual Firewall Mgmt	ü	ü	ü
VM OS Mgmt & AV	û	ü For 25 VMs	ü For 50 VMs
Backup - On box Snapshot	ü	ü	ü
SIEM MDR (Managed Detect and response)	û	û	O
Vulnerability Scan	û	û	ü
Encryption (Software)	ü	ü	ü
BAAS - Backup – Off host (HYCU)	û	O	O
DRAAS – DR as a Service	û	û	O
Web site publishing and load balancing	û	O	O
Web Application Firewalls - Security	û	O	O

O=Option

Management Platform

The Management Platform is comprised of the following elements/services, which although largely are transparent to the end customer, are key for platform operations.

Design Element	Consideration/Design Detail	Additional notes
Separate Platform for Hyper-Converged	Based on Nutanix AHV with secure FortiGate firewall and Mellanox switch implementation
Management Active Directory	Secured by GPO to NIST/DoD selected standards, based on Windows 2022. Domain controllers have no internet access except for items like NTP, and firewall policy managed	Will undergo Cyber Essentials + and accredited third-party penetration testing (bi-annual) using NESSA or similar ISA toolsets
Windows Update services	Dedicated and allowed internet access for updates	All systems will be Windows based except for specific functions such as Load Balancer, updates occur automatically with approval by managed services team
Native PKI platform based on Windows	No internet access, providing internal PKI SSL requirements
External PKI provider for web services	Provided by TBC, for customer facing SSP provision
Windows NPS Servers	Provide RADIUS for LDAP based authentication of management platform
Load Balancer for SSP	Kemp based virtual load balancer	Publishes SSP portal
Auditing and security	Managed Defence Response (MDR)and SIEM provided by Alert Logic for management platform	Additional penetration testing scheduled bi-annually
Windows RDS platform for service desk management	Provided with Duo 2FA integrating into management AD	Audited via MDR service

Additional/Optional Services

As with all service providers, the product does offer additional subset of services to assist customers in their operations.

Mandatory Services

Platform Technical overview - Technical documentation pack, welcome pack, and 3 hour familiarisation training (remote) – Provided in Bronze service

Optional Services

Migration Service = This service is to provide planning, migration, and deployment of VM’s in the customers tenancy agreement – Provided as 2 days planning, 1 days SOW creation, 5 days Consultancy (additional days may be needed, and added as required depending on customer complexity)

Security Service = Secure security in depth service based on Trusts trusted partner, Alert Logic offerings (MDR/SIEM Service) – Gold only

VM OS Service = Managed service for VM and up in operational stack, delivered by Trusts trusted third party, CommsCare – Silver and Gold

Anti-Virus Service = Trust provided Anti-Virus software and management per VM, delivered by Trusted third party (CommsCare delivered) – Required VM OS Management, included in Gold

Base Backup = Using Nutanix Snapshots for 30 day “on cluster” retention

Backup as a Service = Backup using HYCU service designed, scoped and sized to customers custom needs, off cluster to a separate physical device in the same datacentre, 30 day retention with 1 year retention

Disaster Recovery as a Service = Asynchronous replication to another Datacentre in the UK, custom runbook design with RPO/RTO and failover mechanisms designed as needed

Resilient Edge Landing Service = for customers requiring direct connect in the datacentre (i.e. DCI) then a resilient single data centre provision for multiple Point of Presence (POP) for customer

Website Publishing and Load Balancing = Supplied via HA VM Kemp Load Balancer

Web Application Firewalls (Security) = Provided by Alert Logic for up to 5 websites

Change Bundles = Where customers require additional changes, pre-configured bundles for base service (Bronze, Silver and Gold) are available, as is VM OS change packs where support is taken out by a customer (cannot be purchased in isolation of supporting service)

Managed Services

The following describes the managed service provision for the platform.

Bronze Service

Base provision with all service levels (Mandatory service – all others built on this template):

Managed Infrastructure platform, including:

All patching - minor and major upgrades for all elements

Software upgrades – major version changes

Management platform – secure management of platform and Self Service Portal (SSP) Provision

Support of infrastructure components (configuration, hardware and software upgrades and management)

Any third-party management (such as hosting datacentre, Internet circuit provider

Hardware Break-Fix management of all components

Customer focussed configuration changes – i.e. perimeter firewall policy changes

Managed Firewall and network configuration, with changes made based on quantity required and default change package included with service, and incrementing with catalogue service level

Trust Service Delivery Management with customer reports and inclusive performance management and reviews

Default Customer specific IAAS component change management package (5 per month) for firewall and LAN configuration

Trust UK based Service Desk available 24/7/365 with access to support technicians via email, phone and live chat

Trust Service Desk portal for raising incidents and change requests, and reviewing in flight requests

Silver Service

Offering built on Bronze, offering in addition management of up to 25 VM’s at an operating system level, on box comprehensive backup and restore, and additional changes:

Management of customers VMs, with patching of operating system, guest tool management and base operating system AV management (where provided by vendor)

Base Backup and restore service via Nutanix Snapshots (on box)

BAAS Service as additional service (if taken out) with Consultancy to design (off cluster, in same datacentre)

Additional (top-up) change management package (2 * 5 per month) for firewall and LAN configuration and VM’s in managed service at double bronze service*

Gold Service

Inclusive of Bronze and Silver with:

Penetration testing, twice annual, with vulnerability assessments and reports

Enhanced VM OS Anti-Virus (provisioned and managed) service

Backup as a Service Included and management of VM’s with backup and restore operations (on cluster Nutanix Snapshot based)

Additional (top-up) change management package (2 * 5 per month) for firewall and LAN configuration and VM’s in managed service at double bronze service*

*Purchase of separate additional change packs is needed once the base are exhausted. Change packs roll over when not used.

Service Notes

The following notes should be made for the services:

Trust Cloud Managed Services are only for Trust Cloud Hosting LOT1

Patching VM OS (Silver and Gold levels) excludes major patches or OS upgrades (i.e. Windows 2109 to 2022 upgrade is a Consultancy engagement)

VM OS must be “in” vendor support lifecycle and have valid vendor contract, either current contract provided by customer or a new contract supplied at time of onboarding as separate engagement by Trust Cloud Sales team

OS support excludes supporting installed apps; Advise provided to customer on ‘how do I’ query basis (P3 SLA) on reasonable endeavours only

VM OS management/support included per service:

0 in Bronze

25 VM’s in Silver

50 VM’s in Gold

Any BYOL licenses will need current vendor support contracts and software updates, and these must be provided to Trust for accessing updates where needed for Gold/Silver support services. OS and respective license must be for a version supported by Trust.

Remote support via Trust Networks Service Desk team only

Bronze service - customer manages Virtual Machine OS/apps, including Nutanix guest tools

VM Health-check performed with Silver and gold with consultancy engagement required to remediate any issues identified, if not to be fixed by customer

Backup Definitions:

Base Snapshot – on box (Point in time) PIT snapshots, 1 per day

BAAS – Backup to separate physical platform (off box) using HYCU

DRAAS – DR to a separate physical datacentre and separate infrastructure

Bespoke IaaS Managed Cloud Requirements

To ensure Trust Cloud meets base requirements for varied customer service requirements outside G-Cloud specific services, a tailored and bespoke solution design and provision can be included in addition the above default, templated offerings.