EMC OnDemand Services Brief

EMC MSOD - Services Brief

EMC DOCUMENTUM AS A SERVICE Services Capabilities Overview

SERVICES CAPABILITIES OVERVIEW

TABLE OF CONTENTS THE NECESSITY AND CHALLENGE OF ENTERPRISE CONTENT MANAGEMENT ...................................................... 3 WHAT IS EMC DOCUMENTUM AS A SERVICE? ................................................................................................ 4 EMC DOCUMENTUM AS A SERVICE CATALOG ................................................................................................ 9 APPLICATION MANAGED SERVICES ........................................................................................................... 14 UPGRADE, UPDATE, & PATCH MANAGEMENT .............................................................................................. 16 SOFTWARE UPDATE PROCESS .................................................................................................................. 18 TRANSITIONING TO EMC DOCUMENTUM AS A SERVICE ................................................................................. 23 NETWORK CONNECTIVITY REQUIREMENTS ................................................................................................. 25 EMC DOCUMENTUM AS A SERVICE ROLES AND RESPONSIBILITIES ................................................................. 26 EMC DOCUMENTUM AS A SERVICE SECURITY ............................................................................................. 30

2

EMC Documentum As A Service – Services Capabilities Overview

The Necessity and Challenge of Enterprise Content Management Every business is now in the information business. No matter what its product or service, an organization that learns to manage and capitalize on the ever-increasing flow of chat, images, video, voice, posts, blogs, email, documents and scans in today’s Digital Enterprise will prosper. An organization that fails to capture, manage, analyze, communicate, and properly govern their information, will fall behind.

“Effective Enterprise Content Management can transform IT from a cost center to a growth engine.”

Successful transformation to a digital enterprise means the role of the IT professional—as we know it today—has changed, and changed dramatically. Every IT department must now go beyond merely enabling and protecting information, to harvesting and leveraging it for business advantage.

For larger organizations, the crucial transformation comes with the deployment of true Enterprise Content Management (ECM). Only an enterprise-class ECM solution can capture, locate, govern, create and leverage content for the global digital enterprise. The business challenges of supporting enterprise-scale, mission critical ECM applications can be daunting, including how to: •

Make systems rapidly available to decrease the time to value of ECM solutions

•

Reduce costs to manage systems and combat increasingly high IT chargeback costs associated with enterprise applications

•

Increase competitiveness and improve speed to market of new business processes

•

Improve performance to increase user satisfaction and customer responsiveness

•

Use operating expense (OPEX) funds for both the licensing and running of the ECM system versus hard to come by capital expense (CAPEX) funds

Enter Managed Services For most companies, the answer will eventually lie in outsourcing the management of the ECM environment along with the critical ECM applications and solutions. As we move forward, it has become clear that only an “as-a-Service” model will adequately and costeffectively cope with the challenge of managing enterprise-scale ECM systems, let alone the added value of managing in the cloud to capitalize on the data explosion experienced by the digital enterprise. Only this software deployment model provides an optimal ROI that’s both manageable and predictable. Think of it as historic symmetry: The Internet created the situation, and the Internet must solve it. “As-a-Service” in the cloud refers to any IT service provided over the Internet and available to any computer, any time. Specifically, EMC® Documentum® as a Service delivers an entire platform and set of applications and solutions that can be offered as a service for public, private or hybrid clouds or can solely focus on the management of onpremise ECM applications.

3

Enterprise-Class Content Management in the Cloud Many vendors offer simple file storage in the cloud or provide portals and platforms for customers to develop their own content solutions. While many cloudbased content management solutions provide useful services to their users, it’s important to understand the difference between these products and Enterprise Content Management systems built to support mission critical business processes. Enterprise class ECM provides governance, security, and (most importantly), context for all forms of information: not just documents, but blogs, chat, email, audio, video, and rich media. Silos, in which information is typically stored by legacy applications (e.g. ERP) or cloud-based filing systems (e.g. DropBox), disappear providing a central repository for all content, including federated search, and enforces information policies automatically as content is created. If major organizations fail to provide this level of content management in the cloud, users are likely to create their own ungoverned accounts with public services, further scattering corporate information.


What is EMC Documentum as a Service? When EMC set out to offer their flagship EMC® Documentum®, EMC® Captiva®, EMC® InfoArchive® and EMC® Document Sciences xPression® products as services delivered from the cloud, the EMC Enterprise Content Division (ECD) teamed up with Storage and RSA® Security divisions and with VMware® to create a revolutionary “Purpose-Built” cloud offering unlike anything else available in the market. This “Purpose Built” cloud offering encompasses the following characteristics often deficient in the cloud marketplace: • Minimizes Installation of EMC Technology: Virtualize the server side of our products as well as the desktop side • Provides the Highest Level of Security: Must be as solid as the most hardened on-premise data centers • Ensures that Everything is Pre-installed and Optimally Configured for Rapid Startup: You no longer have to wait months for access to a fully functional baseline EMC deployment • Integrates with Existing Filing and Collaboration products: Allows you to leverage your existing investments • Offers Freedom of Use: Provides you the flexibility to configure application like a traditional on-premise installation The last point is crucial. Cloud-as-a-Service typically force-fits organizations into a standard way of building applications, leaving little room for the kind of flexibility required in enterprise-class deployments. We created a balance that enables enterprises and partners to build fully customized solutions while ensuring a solid, pre-built backend infrastructure managed by EMC experts.

Advantages of the ‘As A Service M odel’ The “As a Service” model, offered by EMC, is remotely managed by product and operational EMC experts and may be hosted in the cloud or deployed on premise. It offers you the best opportunity to cut business risk and accelerate the benefits of Enterprise Content Management. A fully managed stack offers quicker start-up, expert administration, a lower Total Cost of Ownership (TCO), dynamic scalability, and Service Level Agreements (SLAs) for disaster recovery and high availability. In the end, it’s all about leverage. Only EMC Documentum as a Service allows you to fully leverage a common infrastructure for ECM, leverage pre-tested configurations, and leverage outside expertise. You don’t have to worry about the mechanics of server farms and product configurations. Your own best people are freed from patching, monitoring, and routine maintenance so they can turn their attention to more productive work—like building specific solutions for business users and seeking innovative strategies to continually move business forward.

W hy EMC Documentum as a Service? The cost and complexity of implementing and maintaining a mission critical enterprise ECM system can be overwhelming. Factors include not just a enterprise content management solution, operating systems, database servers, and virtualization infrastructures, but also security administration, scalability, upgrades, disaster planning, third-party application purchases, application integration, support, recruiting, and retaining expertise. EMC Documentum as a Service brings Documentum, Captiva, InfoArchive and Document Sciences xPression to the cloud, leveraging the strengths of EMC, RSA® and VMware® in cloud information management, storage, security, and virtualization. You can now capitalize on the benefits of cloud, backed by EMC experts who eliminated the hassle of deploying, upgrading and managing an optimized ECM environment.

4


Some key business benefits of EMC Documentum as a Service include: • Single Point Accountability – EMC who built the software provides expertise for the partial or entire stack including applications and solutions • Simplicity – Fully optimized, pre-configured system, fully managed by EMC experts alleviates the hassles of inhouse management and operation • Agility – Rapid realization of business value and ability to easily scale to meet your business demands • Security – Highly secure environments employing latest security technologies with the necessary data center certifications and compliance • Cost – Eliminate hefty upfront capital outlays to a manageable and predictable operating expense and lowers your overall TCO • Flexibility – Choice of cloud deployment and service models to meet your IT requirements allow you to focus on providing additional value add for your business EMC Documentum as a Service solves the following challenges faced by any IT organization: • Upfront capital costs required to implement new or upgrade in-house systems • High operating costs (labor, infrastructure and overhead) required to develop, manage and maintain in-house systems • Mandates to increase ROI and business value from existing technology investments • End-user dissatisfaction with the timeliness or performance of ECM deployments • Hard to find skills and expertise to develop and manage ECM solutions • Need to deliver the highest level of security and reliability for ECM applications and improve availability and disaster recovery preparedness

Leverage as M uch Technology and Service as Needed EMC Documentum as a Service provides the flexibility to manage any or all components of the stack, from Infrastructure through ECD software to the application. You can choose services using hardware owned by EMC in both an on-premise and off premise data center model, or the service can run on customer-owned hardware in an on-premise data center model. This allows EMC to work with you to tailor solutions that best fit your IT and business requirements.

5


The different components within the stack that may be managed by EMC Documentum as a Service are: • Data Center: Facility where hardware infrastructure resides • Hardware Infrastructure: All physical hardware used for the service • Platform Software: Software required to run and administer the service • ECD Software: ECD software products • Application: All components associated with your specific solution The service operations that can be provided by EMC Documentum as a Service are: • Request Fulfillment: Provides a mechanism for users to request and receive administrative assistance • Incident & problem Management: Focuses on restoring service that has been disrupted by an adverse event (Incident Management) and determines the root cause of major incidents, with the aim of taking preventive action to avoid future occurrences (Problem Management) • Change, Release & Configuration Management: Manages the approval and deployment of Change Requests, while maintaining site documentation and configuration information • Event Monitoring & alert response: Provides a “finger on the pulse” of key system performance and health indicators to enable the early detection of issues and enable system administrators to take preventive measures to avoid incidents • Provisioning, Upgrading & Patching; Provisioning of new environments and the installation, upgrade and patching of solution components • Capacity, Performance & Availability Management: Delivers a regular review of capacity and performance metrics to maintain optimal system stability and performance • Access & Security Management: Manage access to the Customer Systems and/or EMC ECD Cloud Services in accordance to the Customer Policies and Customer Service Management Processes • Backup, Recovery & Disaster Recovery: Technology and processes to protect Customer systems and data against system failures or disasters

Cloud Deployment Options EMC offers you choice when it comes to deploying ECD content management applications and solutions. You can deploy and rollout ECM environments in the cloud through one of the following four cloud deployment models: 1.

Off Premise Cloud

2.

On-premise Cloud - EMC owned infrastructure platform

3.

On-premise Cloud - Customer owned infrastructure platform

4.

Hybrid Cloud

Off Premise Cloud In this cloud deployment mode, the Off Premise data centers are managed by EMC via a third-party colocation agreement. These agreements are for dedicated physical (caged) space, network, and power. The contracted third-party data center providers guarantee 100% uptime for network connectivity, power, and relevant environmental controls. EMC owns all hardware components within this dedicated space. Our data center providers have SSAE 16 certification reports that can be shared with you under a Non-Disclosure Agreement (NDA). EMC owns and manages the infrastructure platform within the data centers. Note: EMC Documentum as a Service has separation of duties in the form of data center operations, information security and networking, and application support. Permissions to specific administrative functions are only provided to personnel in charge of the systems and networks they support.

On-Premise Cloud – EMC-Owned Infrastructure Platform On-premise data center facilities are owned and managed by you or a third-party facility that is contracted by you. EMC does not own the facility or contract with the third-party data center provider. The party responsible for the data center is responsible for providing EMC with dedicated 6


physical space, appropriate environmental controls, network, and power in order for EMC to install, configure, and manage the EMC-owned hardware and platform software. Note: EMC recommends that on-premise data centers have a Tier 3+ rating holding a current SSAE 16 SOC I Type II certification that is renewed annually.

On-Premise Cloud – Customer-Owned Infrastructure Platform On-premise data center facilities and infrastructure platforms are owned and managed by you or a third-party facility that is contracted by you. EMC does not own the facility or infrastructure platform. The parties responsible for the data center and infrastructure platform are responsible for providing EMC with hardware and platform software in order for EMC to install and configure the ECD software products. EMC works with you to refine the requirements of the infrastructure platform based on the ECD software and overall system volumes. Note: EMC recommends that on-premise data centers have a Tier 3+ rating holding a current SSAE 16 SOC I Type II certification that is renewed annually.

Hybrid Cloud Model This flexible deployment option allows you to use an on-premise data center for a primary environment and an off premise data center for a secondary environment.

Documentum as a Service Options EMC Documentum as a Service offers you flexible managed service options when it comes to leveraging EMC expertise to manage ECD software and applications. There are three service models below giving you choice on which service best meets your business and IT requirements. The first two service models must be combined with any one of the four cloud deployment models above while EMC Application Managed Services is provided as a standalone service, separate from any of the EMC cloud deployment models.

Management of ECD Software and Applications In this service management model, EMC manages the ECD software stack and the applications developed on ECD software products. This service, when coupled with a cloud deployment model in which EMC owns the infrastructure platform, provides you the most comprehensive set of enterprise class services. EMC manages the complete stack, either in an EMC or customer-controlled data center, from infrastructure platform and ECD software to the administration of applications. You do not need to staff full-time experts to deploy, manage, update, or administer ECD software allowing you to focus resources on critical business needs such as the design and development of new solutions to drive incremental business value.

7


Management of ECD Software EMC manages, patches, upgrades and optimizes the ECD software products. You do not need to staff full-time experts to deploy, manage, or update/upgrade ECD software. However, you are responsible for the design and development of all application-specific configurations and customizations. EMC will deploy the application-specific customizations as part of the service. Additionally, you are responsible for user management and the operation of the administrative tools for your applications.

EMC Application Managed Service EMC Application Managed Services is a standalone offering that can be combined with any of the EMC cloud deployment options. It provides operational support and administrative assistance for the ECD software, your application layer and business users for existing in-house implemented ECD products and solutions. Refer to the section on Application Managed Services to learn more about what is included. .

8


EMC Documentum as a Service Catalog EMC offers a comprehensive set of enterprise class options that allow you to uniquely tailor the services to best fit your business and IT requirements. This service catalog highlights standard features included in EMC Documentum as a Service and the various services options in addition to opportunities for customization.

Table Legend • EMC Documentum as a Service: EMC is responsible for and manages the complete solution from the infrastructure through to the ECD software platform and business specific application configurations. This is available both on premise and off-premise. • EMC Application Managed Services: EMC is responsible for and manages the application and platform on customer provided infrastructure. For both of these service offerings we also support customers taking on the responsibility for management of their applications. In this model, EMC management expertise is focused on maintaining the integrity of the Documentum platform and associated components, while customer resources focus on managing the application specific configurations and customizations.

Service Level Objectives The Service Level Objectives (SLOs) only cover EMC Documentum as a Service running in EMC On-Premise or EMC Off-Premise data centers as indicated in the tables below. If customer provides the infrastructure, SLAs/SLOs relating to the infrastructure will need to be incorporated into the EMC service agreement before EMC SLOs can apply. These SLOs do not replace or augment your existing EMC Software warranty and/or maintenance agreement in any way.

DOCUMENTUM AS A SERVICE STANDARD SERVICE LEVEL OBJECTIVES (SLOS)

AVAILABILITY EXCLUDING MAINTENANCE

*99.90%

AVAILABILITY INCLUDING MAINTENANCE

*98.0%

RECOVERY POINT OBJECTIVE (RPO)

*24 hours (customizable to 4 hours)

RECOVERY TIME OBJECTIVE (RTO)

* -3 days (customizable to 4 hours)

ENCRYPTED ONSITE BACKUP: PRIMARY DATA CENTER

Environment and Data

ENCRYPTED OFFSITE BACKUP: SECONDARY DATA CENTER

Environment and Data

BACKUP RETENTION CONNECTION TYPE NUMBER OF ENVIRONMENTS

*1 Month (customizable to 12+ months) *Private DEV, TEST, & PROD *

* Customized to customer requirements

Service Definitions Each item in the above Service Level Objectives table is defined as follows: • “Availability” is measured as the number of minutes a resource is available within a given month divided by the number of total minutes within the same calendar month. For example,

9

o

44,640 minutes in July – 10 minutes of resource downtime = 44,630 minutes of availability

o

44,630 / 44,460 = 0.9998


o

The availability for the resource in the month of July is 99.98%

• “Availability Excluding Maintenance” is measured as the number of minutes a resource is available outside of scheduled maintenance within a given month divided by the number of total minutes within the same calendar month. For example, o

The resource was unavailable for 60 minutes in July due to scheduled maintenance activities

o

The resource did not have any unscheduled downtime in July

o

The resource availability, excluding maintenance, for July is 100%

• “Availability Including Maintenance” is measured as the total number of minutes a resource is available, including scheduled maintenance, within a given month divided by the number of total minutes within the same calendar month. For example, o

The resource was unavailable for 60 minutes in July due to scheduled maintenance activities

o

The resource had 10 minutes of unscheduled downtime in July

o

44,640 minutes in July – 70 minutes of resource downtime = 44,570 minutes of availability

o

44,360 / 44,460 = 0.9998

o

The availability for the resource in the month of July is 99.84%

Availability calculations inside of Scheduled Maintenance Windows are exclusive of downtime due to any customer requested Category 4 event and regularly scheduled Category 5 events as defined in the Update Categories table in the Upgrade, Update, & Patch Management section of this document. • “Recovery Point Objective (RPO)” is the maximum period in which data might be lost due to a targeted event • “Recovery Time Objective (RTO)” is the duration of time for full system restore of the Production environment in off-site (recovery/secondary) data center post the declaration of a catastrophic failure of a primary data center

Robust Data Center Infrastructure In order to avoid disasters, it is important to have robust data centers that offer infrastructure with built-in physical protection and redundancy. EMC requires that all data centers used for EMC Documentum as a Service be rated as minimally Tier 3 data centers with current SSAE 16 compliance.

DOCUMENTUM AS A SERVICE STANDARD SERVICE

ACCESS CONTROL & PHYSICAL SECURITY

ü

ENVIRONMENTAL CONTROLS & FIRE SUPPRESSION

ü

POWER & NETWORK

ü

COMPUTER INFRASTRUCTURE & REDUNDANCY

ü

TIER 3+ DATA CENTERS

ü

HIPAA

ü

SSAE 16 REPORTS

ü

LOCATIONS

10

USA – Eastern, USA – Western Netherlands – Amsterdam, Germany – Nuremberg Customer Premise


The data center infrastructure for EMC Documentum as a Service includes, but is not limited to:

Access Control and Physical Security • 24-hour manned security, including foot patrols and perimeter inspections • Dedicated concrete-walled data center rooms • Documentum as a Service equipment in access-controlled steel cages • Video surveillance throughout the facility and perimeter • Building engineered to withstand local environmental risks, such as strong winds, flooding, seismic events, etc.

Environmental Controls • Humidity and temperature control • Redundant (N+1) cooling system

Power • Underground utility power feed • Redundant (N+1) CPS/UPS systems • Redundant (N+1) diesel generators with on-site diesel fuel storage • Fully redundant power distribution units (PDUs)

Network • Fully redundant internal networks • Carrier neutral; connects to all major carriers and located near major Internet hubs • High bandwidth capacity

Fire Detection and Suppression • Very early smoke detection apparatus and fire suppression

Multi-Vendor Data Center Approach • Primary and secondary data centers are provided by different vendors to prevent propagation of procedural failures

Computer Infrastructure Quality and Redundancy • Scalable compute resources • At least N+1 redundancy • Enterprise-class EMC Storage • Multipath fiber connectivity • Enterprise-class networking components • Multipath switch connectivity • Hardware failures are repaired or replaced within 4 hours • Cold spares for critical components

11


Infrastructure Services 1

DOCUMENTUM AS A SERVICE STANDARD SERVICE COMPUTER HARDWARE MAINTENANCE & UPGRADES

ü

NETWORK HARDWARE MAINTENANCE & UPGRADES

ü

INFRASTRUCTURE SOFTWARE MAINTENANCE & UPGRADES •

QUARTERLY SCHEDULED MAINTENANCE WINDOW

ü

EMC SOFTWARE MAINTENANCE & UPGRADES •

UPDATES: PATCHES & HOTFIXES

•

UPGRADES: NEW SOFTWARE VERSIONS

ü

MONITORING: STORAGE & NETWORK HEALTH

2

•

HOST AVAILABILITY

•

CPU CONSUMPTION

•

MEMORY CONSUMPTION

•

DISK CONSUMPTION

ü

MONITORING: TRAFFIC, UTILIZATION, & BANDWIDTH

ü

MONITORING: APPLICATION HEALTH

ü

MONITORING: SECURITY HEALTH

ü

VIRUS & MALWARE DETECTION

ü

Monitoring includes both point in time (e.g., exceeding threshold, status) and trending over time (changes in normal behavior)

MONTHLY REPORTS 3 AVAILABILITY

ü

CAPACITY TRENDING

ü

Ongoing Environment Monitoring Extensive, ongoing monitoring of data center resources is provided to proactively identify any issues with the Documentum as a Service environment.

Comprehensive Backup Procedures The EMC Administration team follows rigid backup procedures to protect content, metadata and search indexes, as well as any special code or configurations within your Documentum as a Service environment.

Availability Report EMC Documentum as a Service offers a standard monthly “Availability Report” that contains server name, number of hours of available time in month, number of total hours in month, number of hours of scheduled maintenance activities in month, Availability exclusive of scheduled maintenance, and Availability inclusive of scheduled maintenance.

12


Resource Name

Downtime Including Maintenance (minutes)

Uptime Including Maintenance

Downtime Excluding Maintenance (minutes)

Uptime Excluding Maintenance

CTSTD-CUSTX

60

99.87%

0

100%

CTSTP-CUSTX

70

99.84%

10

99.98%

Service Governance The Service Governance Controls for EMC Documentum as a Service include, but are not limited to:

DOCUMENTUM AS A SERVICE STANDARD SERVICE

SECURITY & RISK MANAGEMENT •

SECURITY-HARDENED CONFIGURATIONS

•

ANTI-MALWARE OPTIMIZED FOR VIRTUAL ENVIRONMENTS

•

GRANULAR ACCESS CONTROL AND AUDITING CAPABILITIES

•

CHANGE CONTROL FOR ANY ALTERATIONS BY EMC STAFF

•

KEY PROCESSES ENABLED FOR CENTRAL MONITORING

•

RESOURCE CONSUMPTION MONITORING (CPU/RAM/DISK)

•

PATCHED ACCORDING TO RISK

ü

POLICY & COMPLIANCE MANAGEMENT

ü

INCIDENT & PROBLEM MANAGEMENT

ü

CHANGE MANAGEMENT

ü

IQ/OQ DOCUMENTATION FOR LIFE SCIENCES

ü

ACTIVE DIRECTORY (LDAP/LDAPS) SYNC

ü

SAML 2.0 SUPPORT

ü

DOCUMENTUM INLINE USERS

ü

SSAE SOC I TYPE II CERTIFICATION

ü

SSAE SOC II TYPE II CERTIFICATION

*

HIPAA/HITECH

ü

* Planned but not yet available.

13


Application Managed Services Application Managed Services provides operational support and administrative assistance for your application layer and its users.

APPLICATION MANAGED SERVICES STANDARDS

REQUEST FULFILLMENT

ü

INCIDENT MANAGEMENT

ü

END USER ASSISTANCE

ü

APPLICATION SUPPORT

ü

PROBLEM MANAGEMENT

ü

CHANGE AND RELEASE MANAGEMENT

ü

SERVICE MANAGEMENT

ü

PROGRAM OF WORK MEETING

Weekly

SERVICE REVIEW MEETING

Monthly

GOVERNANCE MEETING

Annually

Request Fulfillment This service element enables you to log requests for administrative assistance. Requests are of two types, Standard Requests and Non-Standard Requests. A Standard Request is defined as part of a Standard Request Catalog. The type of request that can be made will depend on the installed products, but example Standard Request Catalogs are available for each product or solution covered by the service. Below is an example of a Standard Request Catalog for a Documentum D2® Life Sciences solution: • Create new User • Modify user Properties or Re-assign or Inactivate existing user in Documentum • Create new group/ new role in Documentum • Modify / Reassign existing group in Documentum • Create new ACL/Permission set in Documentum • Modify or Delete Permission set • Apply existing ACL/permission set to multiple folders or documents • Unlock single “Checked-out” document • Change the owner of documents or folders • Create a new Folder (Single Folder) • Delete an existing folder (Single Folder) • Restore a single document (Prior to DMClean run) • Add user to a Group/Role • Documentum User Access Level Report (Documents or Folders) • Workflow-related (Aborting, Resuming, Delegating, Changing the WF supervisor) • Report generation for preexisting report types

14


Non-Standard Requests are often complex in nature and may require analysis and scoping to determine efforts required to execute them. As a result they are generally deemed out of scope; however, EMC can manage the qualification, approval and execution of Non-Standard Requests with the work being undertaken on a time and materials basis. The list below provides examples of some activities that would be deemed NonStandard Requests: • Ad-hoc Report generation using DQL’s Or Using MyInsight for Documentum (formerly eDRG) from Amplexor (formerly named Euroscript). E.g. o Doc Expire report o Creation and Approval report o Print Report • Audit trail reports (Multiple Documents) • Creation/deletion of multiple Folder structures and ACLs • Bulk creation or deletion of users, groups • Change owner of multiple documents or folders • Apply existing ACL to multiple folders or documents • Bulk updates of metadata for folders or documents • Add document type or folder types • LSSV Bulk upload • Any changes to D2 –Configuration, e.g. Manage Pick list values (Adding/remove/modify Values), etc.

End User Assistance and Application Support End User Assistance and Application Support provides a mechanism for your business users to log assistance requests and issues they encounter in relation to their use of your application. These may range from simple “how to” type questions to issues with customizations or application specific processes. The inclusion of Application Support in a Documentum as a Service engagement enables EMC to capture and manage application specific administration tasks, such as managing jobs or executing application specific administrative tasks, such as procedures for regular data uploads.

Problem Management For major Incidents or recurring incidents that collectively result in significant disruption to business users, Problem Management will conduct a Root Cause Analysis to identify the underlying cause(s) and provide recommendations to eliminate them from the application environment.

Change and Release Management Application Managed Services will: • Participate in your Change Management process to evaluate the impact of any change that may affect in-scope applications • Develop technical release plans for implementing approved changes • Deploy approved changes and perform system testing in pre-production and production environments

Benefits of Application M anaged Services Application Managed Services improves the adoption of new business solutions by improving your user experience. EMC does this through a combination of: • Proactive application management to increasing solution stability • Effective resolution processes combined with a depth of experience to reducing the impact of issues on the business • Efficient execution of administrative tasks to provide a responsive service to business users Experience has shown that such an environment helps drive confidence and innovation in an organization’s use of EMC’s technologies. The result is a platform that evolves with the business and an increased return from the investment made in EMC products and solutions.

15


Upgrade, Update, & Patch Management EMC has a first-class process for ongoing maintenance that keeps all environments in Documentum as a Service highly available, stable, and secure. EMC partners with you to identify and agree upon outage windows and notification procedures to ensure that any necessary downtime for updates does not adversely impact your business. The following items are included in maintenance activities completed as part of Documentum as a Service: • Hardware Updates o Infrastructure Software Updates: o Operating Systems, Application Servers, and RDBMS o Relevant Dependent Vendor Third-Party Software: e.g. Java, ActiveX o Virtualization Software o Security & Monitoring Software o Administration Software for Hardware Components • Documentum as a Service Portal Updates • EMC ECD Product & Solution Updates deployed in Documentum as a Service • EMC Partner Product & Solution Updates deployed in Documentum as a Service

Update Categories The following table describes the categories of updates included in Documentum as a Service: Details Categories Description

Example Updates

Outage Characteristics

Customer Influence

Notice 1

Expected Frequency 2

EMC Documentum as a Service Platform Updates Category 1: Critical EMC Documentum as a Service Platform Updates Category 2: Optimal EMC Documentum as a Service Platform Updates and Upgrades

• Patches required to maintain a highly available and secure software/hardware platform • Emergency hardware maintenance

• Critical Operating system patches • Virus signature and engine updates

• Rare • Rolling outage is planned during customer’s predefined maintenance window

• None • Updates are deployed per schedule in order to ensure continued security and operation of the EMC Documentum as a Service platform

Minimum 3 days

4x per year

• Patches or upgrades required to optimize or harden the software or hardware platform • May provide platform improvements and new features • Upgrades to keep components in a supported state • Hardware replacement/ upgrades/updates

• EMC Documentum as a Service Portal upgrades • vShield firewall upgrade • VMware View remote desktop upgrade

If an outage is required and can be done with a rolling outage, customers will be allowed to reschedule the outage window within a 4 week timeframe during a regular maintenance window

• None • Customer must take the update

Minimum 30 days

4x per year

Solution provider controlled but applied on a rolling basis within the customer’s maintenance window

Minimum 30 days

Maximum 1x per year

EMC Express Solutions Category 3: Optimal EMC Express Solution Updates and Upgrades

16

• Patches or upgrades required to optimize the solution • May provide solution improvements & new features • Upgrades to keep solutions in a supported state

• Capital Express Solution service packs or version upgrades • Life Sciences Solution service packs or version upgrades

One application environment at a time would be taken down to apply the update


EMC Product Category 4: Critical EMC Product Updates Category 5: Optimal EMC Product Updates

• Patches to maintain a highly available and secure product upon which to construct an application

• xPression single package hot fix • Captiva, Documentum, out of cycle hot fix

One environment at a time would be taken down to apply the update

• When resolving critical product issues, upon customer request only • As required by a Category 1 or 2 Update

Minimum 3 days or by customer request

4x per year or by customer request

• Patches and upgrades to optimize the product • May provide product improvements & new features • Upgrades to keep products in a supported state

• xPression 4.5 patch 1 to xPression 4.5 patch 2 • Captiva InputAccel Server 7.0 to Captiva InputAccel 7.1 • Documentum Content Server 7.1 to Documentum Content Server 7.1 SP1

One environment at a time would be taken down to apply the update

Updates may be postponed based on custom class of service, such as what is negotiated and defined by a customized agreement.

Minimum 30 days

Maximum 1x per year

1. Notice via approach defined in the section pertaining to SLOs and will include description of affected servers, services, and components as well as expected downtimes for each. 2. Expected Frequency is a general estimate. Due to the dependencies on third-party products (such as operating systems, application servers, databases, hardware components, etc.) the frequency of updates is very difficult to predict. We will strive to consolidate updates to reduce the overall frequency of scheduled downtimes, but reserve the right to require scheduled activities during our published downtime window as frequently as required to maintain the secure, reliable operation of the EMC Documentum as a Service.

Scheduled Maintenance W indows Each customer contract contains a mutually acceptable Scheduled Maintenance Window that Documentum as a Service may utilize for deployment of planned updates. Maintenance is conducted during the scheduled window and is not expected to use the entire window every week. The standard monthly availability for production environments with scheduled maintenance is 98%. Availability calculations inside of Scheduled Maintenance Windows are exclusive of downtime due to customer-requested Category 4 events and regularly scheduled Category 3 and Category 5 events.

Non-Service Interruption Infrastructure Updates Updates to the supporting infrastructure of the Documentum as a Service environment that do not require service interruption will be completed at the discretion of the EMC administration team without maintenance notification as a standard practice.

17


Software Update Process This following provides an overview of the EMC Documentum as a Service process for upgrading and patching all deployed software:

Research: Gather Inform ation on New Software Releases Documentum as a Service will maintain a comprehensive record of all deployed software, including infrastructure software and the software stack deployed in your environment. In order to determine what updates are available, assigned subject matter experts (SMEs) review standard software product update tools and information available to all licensed customers. These tools vary by software product, yet can be automated update verification tools such as Windows Update or EMC Tech Alerts sent via product specific support advisory subscriptions. Once this information has been gathered, it is categorized into a release type and submitted for review as part of the Analyze phase.

Infrastructure Software Release Terminology Example Release Type

Description

Major

A major release contains an architectural change and/or several significant features.

Minor

A minor release contains one significant feature or several small ones.

Service Pack

A service pack contains two or more bug fixes. It may not contain new features.

Hotfix

A hotfix is a single bug fix.

EMC ECD Release Definitions EMC Documentum as a Service deploys the same General Availability (GA) software releases that EMC customers can download from the download center (https://emc.subscribenet.com). Special software builds are not created for Documentum as a Service environments. This means that the EMC administration team is dependent on the same ECD software release cycles and availability as On-Premise customers. Understanding ECD’s software release process is necessary to better understanding the flow and availability of software to environments managed by EMC.

18


The following tables describe the applicable software categories used for analysis:

ECD Software Release Terminology Release Type

Example

Description

Major

7.x, 8.x

Software that includes significant features and code corrections. May include architectural changes.

Minor

7.1, 7.1.1

Software that includes minor features and code corrections. May include significant features.

Service Pack

7.1 SP2

Software that includes code corrections. Not intended to include features, but may include minor features upon exception.

Patch Rollup

7.1 SP2 P01

Software that is a group of code corrections. Does not include new features.

Out of cycle hotfix /Hotfix

7.1 SP2 P01 HF1

Software that is a single code correction for a specific issue. Does not include new features.

1) Major Release – 7.x, 8.x: A Major Release is ECD software that includes significant features and code corrections. A Major Release may include architectural changes. In most scenarios, ECD will release all primary components of an ECD software solution stack as part of a Major Release. These releases generally include supportability with more current releases of operating systems, databases, applications, and platform software such as Java. EMC Partner and other third-party add-ons for ECD software typically require a corresponding update in order to be compatible with a Major Release. 2) Minor Release – 7.1, 7.1.1: A Minor Release is ECD software that includes minor features and code corrections. A Minor Release may not include architectural changes, but may include significant features. In most scenarios, EMC will release all primary components of an ECD software solution stack as part of Minor Release. These releases generally include supportability with more current releases of operating systems, databases, applications, and platform software such as Java. EMC Partner and other third-party add-ons for ECD software typically require a corresponding update in order to be compatible with a Minor Release. 3) Service Pack Release – 7.1 SP1, 7.1 SP2: A Service Pack is ECD Software that includes code corrections applicable to a Major Release. Service Pack releases are not intended to be a feature release, but may include minor features upon exception. These releases may include supportability with more current releases of operating systems, databases, applications, and platform software such as Java. Service Pack Releases may require updates to multiple products in order to achieve a software stack documented as supported and compatible. EMC Partner and other third-party add-ons for ECD software may require a corresponding update in order to be compatible with a Service Pack Release. The code corrections and any features included in Service Pack Releases are included in subsequent Major and Minor Releases. 4) Patch Rollup Release – 7.0 SP2 P01 A Patch Rollup is software that contains a group of code corrections and does not include new features. This type of release typically does not adversely impact other software components in the software stack, including EMC Partner and Third-Party add-ons. The code corrections included in Patch Rollup Releases are included in subsequent Major and Minor Releases. Out-of-cycle Hot Fix and Hot Fixes – 7.0 SP2 P01 HF1 An out-of-cycle Patch and Hot Fixes are code corrections for specific urgent customer-specific issues. Not all issues result in an Out-of-cycle or hot fix due to the complexity of the fix. If the software problem encountered is part of the GA software, then the fix will be included in the subsequent Patch Rollup Release. If the code correction is not generally applicable to all customers, then it may not necessarily be included in the subsequent Patch Rollup Release.

19


Analyze: Determine Upgrade & Update Viability There are several factors to consider when determining timely and appropriate updates for environments managed by the EMC. Some of these factors include, but are not limited to, the following: • Documentum as a Service Update Category o

Categories 1-5

• Complexity Associated with Release Type o

Major, Minor, Service Pack, and Patch Rollup Release

• End of Service Life (EOSL) Date of the Product Version that is Currently Deployed • Enterprise Software Customer Adoption of Infrastructure Software Releases • EMC Customer Adoption of New Software Version o

New Deployments and Upgrades

o

On-Premise and Documentum as a Service

• Impact on the Full Software Stack o

Infrastructure Software Updates: Optional and Required

o

Compatibility with Other Deployed ECD Software

o

Compatibility with Other Deployed EMC Partner and Third-party Add-On Software

o

ECD Software Updates: Optional and Required

o

EMC Partner and Third-Party Add-On Software

• Risks associated with an Upgrade • Anticipated Impact to the Customer o

Compatibility with New and Existing Customizations

o

Regression Testing: Planning and Execution

o

Anticipated Duration of Downtime for Upgrade

Once these factors are investigated, relevant updates are designated as candidates for scheduled maintenance. EMC has a team of experts that meet frequently to review and plan scheduled maintenance activities. This review includes existing candidates for scheduled maintenance in addition to new candidates designated as relevant via research activities. A package of software patches and/or upgrades is approved for verification at the end of the Analyze phase for scheduled maintenance.

EMC ECD Product Information You can keep up-to-date with EMC ECD product notifications, service life information, and other important product specific information via the “Support by Product” section of https://support.emc.com. All EMC ECD products managed by EMC within Documentum as a Service must be in a supported state with a minimum of Enhanced Support in order to ensure complete 24x7 coverage for products and services. Products that are designated EOSL are eligible for additional Extended Support Services.

Verify: Testing and Confirm ation of Updates & Upgrades In order to maximize the efficiency, minimize risks, and verify overall applicability of a software upgrade within a Documentum as a Service environment, members of the EMC R&D team will verify the documented deployment process of the GA software in an internal lab environment. The environments managed in the lab contain a representative sample of the core ECD products installed in applicable Documentum as a Service environments in order to assess compatibility risks with the new product. Only default product configurations are tested. Therefore, when you approve the upgrade you are still required to adequately plan time and resources to test the compatibility of customizations deployed within your environment.

20


The types of changes included in Major Releases, Minor Releases, and Service Packs typically include a level of complexity that requires deployment testing in order to minimize risks. Before Major Releases are considered for availability within Documentum as a Service, the GA product documentation is used by members of the R&D team to verify installation and upgrade steps in the Documentum as a Service lab. This testing process is designed to verify installation procedures and compatibility between software components in the core ECD software stack deployed within Documentum as a Service environments. EMC performs additional sanity testing to further ensure quality and stability. Once the deployment testing has been deemed successful, the installation and upgrade steps are scripted to ensure consistency in deployment, reduce chances of human error, and minimize system downtime for you. Major Releases, Minor Releases, and Service Packs typically require extended downtime for deployment. The extended downtime would need to be precisely planned and include time for installation, your specific configuration changes, customization upgrades for tailored usability and functionality, and extensive regression testing by you. As a result, you may not desire to upgrade to every new release upon GA. Therefore, not all Major Releases, Minor Releases, and Service Packs are pre-approved for availability within the Documentum as a Service environment. Patch Rollup Releases have a lower level of regression and compatibility impact to the deployed environment and related customizations. Before Patch Rollup Releases are considered for availability within Documentum as a Service, the GA product documentation is used by members of the R&D team to verify installation and upgrade steps in the Documentum as a Service lab. This testing process is designed to verify installation procedures and compatibility between the affected software components of EMC ECD software deployed within Documentum as a Service environments. The GA documentation can be verified in the lab without any need for scripts and can be approved for deployment within Documentum as a Service environments quickly and efficiently. Unlike larger feature inclusive releases, the downtime required for the deployment of Patch Rollup Releases typically can be kept within standard maintenance windows. Given the reduced deployment risk of these types of releases, you should only need to regression test the items listed in the GA Release Notes published for that specific Patch Rollup Release. All Patch Rollup Releases can be made available for deployment within Documentum as a Service at your request. Out-of-Cycle Patches and Hot Fixes have the least amount of risk of any type of software upgrade. Before Out-of-Cycle Patches and Hot Fixes are considered for availability within Documentum as a Service, the GA product documentation is used by members of the R&D team to verify installation and upgrade steps in the Documentum as a Service lab. This testing process is designed to verify installation procedures and compatibility between the affected software components of ECD software deployed within Documentum as a Service environments. The GA documentation can be verified in the lab without any need for scripts and can be approved for deployment within Documentum as a Service environments quickly and efficiently. Given the significantly reduced deployment risk of these types of releases, you should only need to regression test any items affected by the release. EMC ECD R&D may not be able to create an Out-of-Cycle Patch or Hot Fix if the complexity of the issue requires a larger and more comprehensive software release.

Schedule: Coordinate with Custom ers An ECM Service Delivery Manager works with you to get prior approval for any software update that affects your application usage. Please refer to previous Update Categories table for details on when you would be notified.

Customer Responsibility Pre-Deployment You need to get an internal change request approved if needed as per your process. The update should be reviewed and test plan created accordingly. Release notes for the update should be reviewed and any configuration or customization updates required should be considered and planned. Deployment plan for all environments should be created.

Deploy: Implementation of Updates & Upgrades After the update is successfully tested in the Documentum as a Service lab environment, deployment in your environment can proceed. An EMC Service Delivery Manager will manage the update as per the mutually agreed upon deployment plan. An EMC Product Specialist will take the snapshot of the environment prior to any update. Each environment update starting from sandbox/dev, test and production is done separately and one at a time. After each environment is smoke tested, it is handed over to you for regression testing. After you confirm that deployment is successful then the subsequent environment is updated as per the schedule defined in the deployment plan. Snapshot is deleted after the environment is successfully tested and confirmed.

21


Customer Responsibilities Post Deployment As per the pre-defined test plan, an environment should be tested by you. Based on the release notes review, all test cases should be considered. Upon successful completion of testing, approval to deploy the update in subsequent environment should be given. If testing fails, you would need to work with EMC Cloud Services resources and ECD Support to find the root cause of the issue and the resolution.

Record All new customer Service Requests (SR) are entered in Oracle/CSI to track the progress and activities of the fix. This service request will be owned by the EMC team and is separate from the service request owned by ECD product support. The update SR is to remain open until the update has been successfully promoted to your Documentum as a Service environment(s). Once you confirm by successfully testing the environments, then the SR can be closed.

Notify All customer communications are coordinated by an EMC Service Delivery Manager and an EMC Services Product Specialist for software updates. You will be notified after each environment’s deployment and smoke testing is completed. The specific open Service Request will be closed upon successful deployment in all environments and communication sent to you.

Customer Customization Updates You are responsible for configuration management and versioning control of customized files. You have specific access permissions to each environment. Refer to proceeding Documentum as a Service Access section in this document for details on access allowed. You can deploy customized updates to the development environments and perform the testing. Upon successful testing, you can request to deploy the updates into the test and production environments. This is done by creating a new SR providing details of what needs to be deployed and in what environment. Proceed with caution when requesting changes in the production environment. It should only be requested after the updates have been thoroughly tested in the DEV and TEST environments. The test plans should be all inclusive of all scenarios to avoid any issue in the production system. The EMC Cloud Services Product Specialists will record the activities in the open SR and deploy the updates as per your instructions in the requested environment. The EMC Cloud Service Product Specialists will verify that all environments have the same updates and there is no discrepancy. Once the updates are completed in all environments and successfully tested, the SR can be closed.

22


Transitioning to EMC Documentum as a Service EMC Professional Services, an EMC certified partner or you may design the migration approach and perform the migration services. EMC Professional Services specializes in designing and performing migration services by leveraging the technical resources within the organization that developed and supports the migration application. You can leverage this expertise by using EMC Professional Services to assist with the design and performance of the migration services.

Copying the Repository from the Customer Environment EMC recommends that EMC Professional Services be engaged to design the approach and perform the migration services. Content files and the Database data files can be copied into the Documentum as a Service production environment over the private VPN connection. If the filestore size is significant, we recommend using a differential copy program like Robocopy to start the copying process early on in the project timeline. A final differential copy should be run on the go-live day to ensure that all content has been moved over to the Documentum as a Service environment. The filestore size and timeline should be considered in formulating the migration approach defined in the contract. The time it takes to load should be tested and verified to ensure it meets the customer required timeframe. Integrity of the data is verified by the customer. This model assumes that the source (your environment from where we are migrating) and Target (Documentum as a Service environment) match exactly: • OS and version of the Documentum Content Server match exactly • OS and DB version match exactly • Docbase Repository name and ID match exactly • Docbase meets the Documentum as a Service guidelines (cleanup performed and clear of consistency check errors)

Loading Using a Tool EMC Professional Services, an EMC certified partner or you may design the migration approach and perform the migration services. In this model, migration is from source to target using a migration tool that performs extract, transformation and load. Loading should be specific to Documentum version and the SQL database deployed in the Documentum as a Service environment. Integrity of the data should be verified and is not the responsibility of the EMC Cloud Services team. There are certain limitations when running the migration tool: • A temporary database repository owner password can be provided for the migration period. This password would be changed after the migration is finished. • Temporarily the customer share is mounted on Documentum as a Service but not Documentum as a Service storage on customer side. • Ongoing migration requiring super user access is not allowed. • If the ongoing migration can be done by just using Documentum admin rights (not Windows system admin rights) with the migration tool, then it can be configured.

M igration Tool Deploym ent Documentum as a Service has a pre-built catalog of applications that EMC takes responsibility for installing, configuring, monitoring, scaling, tuning, patching, and upgrading. The team also leverages the technical resources within the organization that developed the application and is responsible for supporting it. This enables EMC to meet the contractual level of system availability and maintainability. The Migration tool is not included in this pre-built catalog of applications. EMC’s recommendation is for you or EMC Professional Services to install it on VMs on your side to communicate with Documentum as a Service servers. By having this on-premise, you have full control to make any changes and customizations when needed. 23


Deploying either an EMC developed migration tool or third-party tool to Documentum as a Service would require a contractual agreement on cost and deliverables. Any third-party tool installation in a Documentum as a Service environment needs to go through rigorous change management process ensuring the feasibility, compatibility and maintenance of the tool to ensure the security and system availability EMC promises. The deployment and working of the tool within the Documentum as a Service environment has to follow the access defined in the next section. If the tool requires access beyond what is allowed, then it is not feasible for it to be deployed in a Documentum as a Service environment.

Documentum As A Service Access Documentum as a Service has achieved the highest level of data center certifications in the entire EMC ecosystem. We are unable to retain these certifications should we grant administrator or super user access outside of the EMC Cloud Services team. Doing so would break documented processes and procedures. Breaking those procedures would result in failure of audits against our certifications, loss of certifications, and loss of customers relying upon us to retain those certifications. For example, a fundamental standard for running data centers and Information Technology is change management and tracking. Before EMC makes any change to a data center for any reason, even a development environment, we create a change control record and document the changes. When we grant administrator rights outside of EMC Documentum as a Service, we lose that control, and there is no way to guarantee all changes are properly documented, as EMC is not performing the changes. No super user access can be given to you in the Documentum as a Service Test and Production environments. • A temporary Database repository owner password can be given before the production starts to migrate. After migration, the password would need to be changed. • A Windows system admin right for any environment is not allowed. However, Documentum admin rights are given.

24


Network Connectivity Requirements EMC Documentum as a Service provides both on-premise and off premise cloud models. For on-premise models, EMC connects the your data directly with our on-premise equipment to enable ongoing monitoring and management of the environment. For off premise models, you are provisioned within one of EMC’s shared clouds, such as VPN-over Internet, MPLS, or a leased line.

Off Prem ise M odel If you desire to be provisioned within one of EMC’s shared clouds, EMC provides for three multiple private network connections into your Documentum as a Service virtual private cloud. Factors to consider when choosing type of connectivity are outlined in the table below.

Approach

Cost

Reliability

Scalability

Security

VPN-overInternet

Low

Subject to the variability and congestion of the Internet

Requires increasing Internet capacity, which may be complex for some organizations

End-to-end IPSEC encryption

MPLS

Moderate

Allows prioritization of traffic and establishment of quality of service levels

Can be easily scaled depending on endpoint connection selected

Not typically encrypted, relies on network carrier for isolation and security

Leased Line

High

Committed and predictable

Most difficult to scale due to dedicated nature of the connection

Very secure since no aspect of the circuit is shared

Most Documentum as a Service customers opt for the VPN-over-Internet approach for connectivity. VPN provides a low cost approach that is typically quick and easy to get started with. Other options can always be deployed later as use cases change or if issues arise with latency, bandwidth, etc.

1 - Typical Off Premise Networking Connectivity

On-Prem ise M odel If you desire an on-premise deployment of your Documentum as a Service, network connectivity is a bit different. In this case, EMC will provision a management circuit that will connect directly with our on-premise equipment to enable ongoing monitoring and management of the environment. You would provide a resilient network uplink into the EMC equipment. This connection is typically firewalled from your primary network as illustrated in the on-premise networking model. You would also provide connectivity between EMC equipment located at the primary site and located at the recovery site, which would be used for data replication in the event of a disaster. This connectivity is optional as EMC can also provide interconnection as part of our service.

25


EMC Documentum As A Service Roles and Responsibilities EMC Documentum as a Service provides various options for management and control of your data. The following table outlines the variety of services activities that relate to the products/business solutions. Note: Assume service activities relate to the products/business solutions covered by the EMC scope of service

Activity Group Incident Management

Critical Situation Management Problem Management

Note: For OD only engagements, the Client is responsible for diagnosing the root cause of issues in the business logic layer. This can be done with the assistance of EMC Product Support # 'Platform' refers to infrastructure layers, up to and including the ECD product layer Operational Change and Release Management

TYPE

Application Managed Services

Documentum as a Service -EMC responsible for management of platform only

Documentum as a Service -EMC responsible for management of platform and application

Off Prem

On Prem

Off Prem

Client Infra

On Prem

Off Prem

Client Infra

Service Desk

Client

Client

Client

Client

Client

Client

Client

Level 1 Support

Client

Client

Client

Client

Client

Client

Client

Level 2 and 3 Support

EMC

Client

Client

Client

EMC

EMC

Shared

End User Assistance

EMC

Client

Client

Client

EMC

EMC

EMC

Event Management

Client

EMC

EMC

Client

EMC

EMC

Client

Service Restoration

EMC

EMC

EMC

EMC

EMC

EMC

EMC

Shared

Shared

Shared

Shared

Shared

Shared

Shared

Application / Business Solution RCA

EMC

Client

Client

Client

EMC

EMC

EMC

Platform RCA #

EMC

EMC

EMC

EMC

EMC

EMC

EMC

Initiate Corrective Actions Application / Business Solution

EMC

Client

Client

Client

EMC

EMC

EMC

Initiate Corrective Actions ECD Solution Stack

EMC

EMC

EMC

EMC

EMC

EMC

EMC

Initiate Corrective Actions Infrastructure

Client

EMC

EMC

Client

EMC

EMC

Client

Request Logging

Client

Shared

Shared

Shared

Shared

Shared

Shared

Evaluate/Impact Analysis

Shared

Shared

Shared

Shared

EMC

EMC

Shared

Problem Control

Authorize

Client

Client

Client

Client

Client

Client

Client

Schedule

Shared

Shared

Shared

Shared

Shared

Shared

Shared

Deploy Application / Business Solution

EMC

Client

Client

Client

EMC

EMC

EMC

Deploy ECD Solution Stack

EMC

EMC

EMC

EMC

EMC

EMC

EMC

Deploy Infrastructure Stack

Client

EMC

EMC

Client

EMC

EMC

Client

Configuration Management

Asset tracking (CMDB)

Client

EMC

EMC

Shared

EMC

EMC

Shared

Application

Request Logging

Client

Client

Client

Client

Client

Client

Client

Note: This section refers to Operational Changes (not changes to application functionality) that may impact the availability of the system.

26


Note: Assume service activities relate to the products/business solutions covered by the EMC scope of service Change and Release Management




Evaluate/Analysis Develop Business Case

Client

Client

Client

Client

Client

Client

Client

Note: Solution development activities are the responsibility of the client. EMC will execute the deployment of application changes in Test and Production environments upon receipt of an installation package and an authorized Change Request

Authorize

Client

Client

Client

Client

Client

Client

Client

Design and build, customize, configure

Client

Client

Client

Client

Client

Client

Client

Regression, Performance and Acceptance Testing

Client

Client

Client

Client

Client

Client

Client

Shared

Shared

Shared

Shared

Shared

Shared

Shared

Production Deployment

EMC

EMC

EMC

EMC

EMC

EMC

EMC

Request Fulfillment

Service Desk

Client

Client

Client

Client

Client

Client

Client

Process Management

Client

Client

Client

Client

Client

Client

Client

User Account Management

Client

Client

Client

Client

Client

Client

Client

Standard Work Requests

EMC

Client

Client

Client

EMC

EMC

EMC

Non Standard Work Requests

EMC

Client

Client

Client

EMC

EMC

EMC

Administration

EMC

Client

Client

Client

EMC

EMC

EMC

Monitoring & Event Response

Client

EMC

EMC

EMC

EMC

EMC

EMC

Patching

EMC

EMC

EMC

EMC

EMC

EMC

EMC

Upgrade

Client

EMC

EMC

EMC

EMC

EMC

EMC

System & Integration Testing

EMC

Client

Client

Client

EMC

EMC

EMC

Regression & Acceptance Testing

Client

Client

Client

Client

Client

Client

Client

Administration

Client

EMC

EMC

EMC

EMC

EMC

EMC


Client

EMC

EMC

EMC

EMC

EMC

EMC

Patching

Client

EMC

EMC

EMC

EMC

EMC

EMC

Upgrade

Client

EMC

EMC

EMC

EMC

EMC

EMC

Pre-Production Deployment

Action Requests

IT Operations EMC Product/Solution Stack Management

Testing

Software Infrastructure Management

Testing 27


Note: Assume service activities relate to the products/business solutions covered by the EMC scope of service

Virtualization Layer Management





Client

EMC

EMC

EMC

EMC

EMC

EMC

Regression & Acceptance Testing

Client

Client

Client

Client

Client

Client

Client

Administration

Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client

Patching

Client

EMC

EMC

Client

EMC

EMC

Client

Upgrade

Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client

Administration

Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client

Patching

Client

EMC

EMC

Client

EMC

EMC

Client

Upgrade

Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client

Administration

Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client

Patching

Client

EMC

EMC

Client

EMC

EMC

Client

Upgrade

Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client


Client

EMC

EMC

Client

EMC

EMC

Client

SIEM

Client

EMC

EMC

Client

EMC

EMC

Client

Penetration Testing

Client

EMC

EMC

Client

EMC

EMC

Client

Anti-virus & Antimalware

Client

EMC

EMC

Client

EMC

EMC

Client

Physical Facilities

Client

EMC

EMC

Client

EMC

EMC

Client

Utilities

Client

EMC

EMC

Client

EMC

EMC

Client

Physical Security

Client

EMC

EMC

Client

EMC

EMC

Client

Personnel

Client

EMC

EMC

Client

EMC

EMC

Client

Primary Site Backup

Client

EMC

EMC

Client

EMC

EMC

Client

Off-site Replication

Client

EMC

EMC

Client

EMC

EMC

Client

Provision DR Site

Client

EMC

EMC

Client

EMC

EMC

Client

Testing

Hardware Infrastructure Management

Testing

Network Operations

Testing

Security Administration

Data Center Services

BACKUP AND DR MANAGEMENT

28


Note: Assume service activities relate to the products/business solutions covered by the EMC scope of service

29





EMC Documentum As A Service Security EMC Documentum as a Service has a multi-layer security approach that sets these services apart from a typical cloud provider. We have multiple layers of security implemented inside and outside of our infrastructure, with all pieces working together as one system instead of functioning as a collection of independent parts. Security has been architected into the Documentum as a Service solution allowing technologies to be applied at inception and become integrated components in the solution. ECD worked with experts from RSA, VMware, VCE, and EMC to choose best-of-breed technologies to apply to the Documentum as a Service solution. From Security Information and Event Management (SIEM) tools to virtualization-optimized anti-malware and Data-At-Rest-Encryption, ECD selected technologies and layered them into the architecture. In addition, ECD supported all those foundational technologies with strong ITIL controls, routine audits, penetration testing, and more to ensure on-going management and continual improvements into the Documentum as a Service solution.

Data Center Security Tier 3 & 4 Data centers

SSAE16

Segregated cages

Provides physical separation and containment

Physical access to authorized personnel only

Access list reviewed regularly to ensure it is current and accurate

Detailed access audit trail

Audit logs are reviewed regularly to ensure compliance with access control

Employee background checks

Performed at hiring and periodically thereafter

Security monitoring 24x7x365

Staffed security onsite at data center

EMC data centers and controls are designed with superior physical security in mind to prevent unauthorized access.

Network Security Redundant perimeter firewalls

Allows for routine patches and updates to OS without impact to platform

Intrusion detection on physical components

Physical layer intrusion attempts are monitored and relayed to SIEM tool

Security log aggregation, correlation, and analysis

SIEM tool applied to entire site and aggregated between sites for enhanced security intelligence

Intrusion detection on virtual networks

Intrusion detection for all virtual servers deployed in environment, events are monitored and relayed to SIEM tool

Strong virtual network separation

Use of virtual network separation allows for only defined group of MAC addresses to participate in network

Regular penetration testing

Ensures ongoing viability of perimeter defenses and internal controls

Routine vulnerability scanning and remediation

Validates patching and configuration of physical and virtual resources and feeds information into patch management process

Server Security Hardened operating systems and databases

Apply industry standard validation to OS and database configuration

Managed OS patches and updates

Routinely assess available patches and apply according to risk

Virtual patching technology for Microsoft security issues

Virtual IPDS tool updates rule set to profile network patterns from known vulnerability exploits, effectively “patching” against Microsoft vulnerabilities as soon as they are released

30


Hardened VMware hypervisors

Apply industry standard validation to hypervisor configuration

Unnecessary services disabled

Only required services are enabled on servers to reduce their attack vectors

Password security policies

Strong password security is enforced across all resources

Malware protection optimized for virtual environments

Virtually optimized anti malware platform eliminates virus storm issues and ensure that all servers are automatically protected

Resource availability monitoring

Detects anomalies in resource consumption (CPU/RAM/Disk) which could be the result of malware or attack

Data at rest encryption

Available data at rest encryption for any virtual server to help ensure compliance requirements are met

Blocking malicious activity at the network perimeter prevents suspicious and malicious traffic from ever entering our infrastructure. These security measures add protection and increase performance by eliminating unwanted traffic to servers. Security for the network layer is crucial to prevent and monitor unauthorized access, misuse, or modification of network-accessible resources. All customer environments are isolated and secured at the network level. The server is the layer of defense closest to the application. Ensuring attack vectors are limited and points of entry are hardened is extremely important in solidifying overall security posture and keeping important data safe. Every server is hardened at deployment exceeding compliance mandates.

Application Security

Discrete application deployment

You have your own discrete set of servers deployed for your applications. We don’t share virtual servers among multiple customers.

Application performance monitoring

Detects anomalies in application performance which could be the result of malware or attack

Secured communication protocols

All protocols can be secured to ensure end-to-end data protection

Principle of least access applied to data flows

Discrete firewall rules are applied to allow only defined traffic to flow in and out of the environment

Using best practice application deployments that have been tuned through years of experience helps ensure your Documentum as a Service environments will be there when you need them. By layering in additional controls for end-to-end encryption and restricting traffic, we provide additional layers of security beyond a typical on-premise installation.

Administrative Security Site-to-site IPSEC VPN

Allows private connection with relatively inexpensive bandwidth. (See Networking Section of this document for details.)

MPLS termination

Allows private connection with predictable bandwidth and latency. (See Networking Section of this document for details.)

Secure portal for user management

Enables self-service administration of the small community of user identities maintained for your Documentum administration personnel, xPression designers, and Captiva operators.

Bastion host for EMC administration access

Provides an air gap between the EMC network and the Documentum as a Service data centers. Also allows for blocking of services like file transfer into and out of our environments.

As a private cloud, we rely on private connections to allow your users access to the Documentum as a Service environments. To that end, we enabled several connection methodologies detailed in the Networking Section of this document. We also ensured the EMC administration team could safely and effectively manage our environments while maintaining strong separation from EMC’s other networks and resources. 31


Governance Complete incident lifecycle management

Utilizing standard ITIL practices for incident and problem management, including continuous improvement

Rigid change control process

Ensures that changes are documented, vetted, reviewed, scheduled, and implemented following standard industry practices

Documented Standards, Policies, and Procedures

Provide for consistent, controlled management of the entire service

SSAE16 certification via annual audit

Provides third part attestation that controls are in place and followed

Specialized security incident response team

Enables fast response to any detected incident to shut down any attack and ensure you are notified of any potential data loss as well as providing for investigation and analysis

Rigid and responsible governance is core to delivering a secure, reliable, and available service, but these are not static processes either; they evolve as you do as we develop better approaches and apply new technologies.

End User Authentication EMC Documentum as a Service supports the LDAP/LDAPS mechanism of directory servers that have been certified with EMC Documentum Content Server. This requires you to open your firewall to the Documentum Server running in the EMC Documentum as a Service data center facility to your on-premise LDAP system via LDAP or LDAPS connection in order to synchronize userids, user groups, and to authenticate userid/passwords. You must create an LDAP service account with privileges as documented in the standard EMC Documentum Content Server documentation to perform these functions. For select Documentum clients (for example, recent versions of Documentum Webtop and D2), EMC Documentum as a Service supports integration with your Identity Provider (IdP) through support for the SAML 2.0 standard. This support still requires Documentum LDAP/LDAPS sync to manage user accounts in Documentum and will not function properly without it. However, SAML integration offers two significant advantages over using LDAP/LDAPS sync alone: 1.

User credentials are not entered into the Documentum Clients and sent through the network. User credentials are entered into your choice of IdP on your network. They are not sent to EMC Documentum as a Service.

2.

Once a user enters credentials into your IdP, you can set up the system to authenticate to any number of systems, including EMC Documentum as a Service, in a single-sign-on fashion. Should you configure your systems properly, Documentum users will not need to enter their credentials again.

EMC Documentum as a Service supports the LDAP mechanism of directory servers that have been certified with EMC Document Sciences xPression. This requires you to open your firewall to the xPression Server running in the EMC Documentum as a Service data center facility to your on-premise LDAP system via LDAP connection in order to authenticate userid/passwords and retrieve group assignments. You must create an LDAP service account with privileges as documented in the standard EMC Document Sciences xPression documentation to perform these functions.

32


Summary In this document we’ve tried to show how you can rapidly and securely leverage the economies of the cloud by deploying Enterprise Content Management (ECM) through EMC Documentum as a Service. EMC Documentum as a Service eliminates the need for in-house expertise and expanded infrastructure, because it’s fully managed and dynamically scaled by EMC—whether delivered from our site or yours. With Documentum as a Service, we believe that any enterprise can better capitalize on its information assets while streamlining its operations. Put succinctly, it will help you “save, simplify, and transform.” EMC Documentum as a Service brings together the leaders in content management: EMC Documentum, EMC Captiva, EMC InfoArchive, and EMC Document Sciences from EMC Enterprise Content Division; EMC storage; EMC security from RSA; virtualization from VMware; and Vblock partners Cisco and Intel—all under one roof, and available to you where and when needed. It’s a new era for Enterprise Content Management in the cloud as organizations transform into the digital age to gain competitive advantage and provide an uncompromising user experience.

About ECD Services EMC Enterprise Content Division (ECD) Services accelerates today’s digital enterprise through world-class technical and industry expertise coupled with end-to-end service capabilities that deliver content management cloud solutions, empower end users, and enable successful project implementations while mitigating risk. Our 500+ services experts worldwide, plus global network of partners, have the skills, knowledge, and experience organizations need to get the maximum value from their EMC software investments.

CONTACT US To learn more about how EMC products, solutions, and services can help solve your business and IT challenges, contact your local representative. Solution Principal or email us at [email protected] or visit us at www.EMC.com/Documentum.

33

EMC2, EMC, the EMC logo are registered trademarks or trademarks of EMC Corporation in the United States and other countries. VMware are registered trademarks or trademarks of VMware, Inc., in the United States and other jurisdictions. All other trademarks used herein are the property of their respective owners. © Copyright 2016 EMC Corporation. All rights reserved. Published in the USA. 1/2016 EMC Documentum As A Service Service Capabilities Brief H12128.3 EMC believes the information in this document is accurate as of its publication date. The information is subject to change without notice.