Managed Services — Evidence
v1.3 • Effective 2026-01-25
Owner: Virtus Group Ltd • Audience: Clients, Reviewers & Operations
Classification: Public • Next Review: 2027-01-25
Overview
This page consolidates the artefacts reviewers need to assess Virtus Group’s Managed Services for DIA Marketplace. It links our security and privacy controls, incident/breach procedures, BCDR materials, and core runbooks, and summarises our service levels and governance signals. Use it as the single source of truth during evaluation: follow the links for full policy/procedure text, and refer to the SLA table and governance card on this page for a quick compliance snapshot.
- Security & Assurance Index (full hub)
- Capability Statement (all offerings)
- Pricing Annex v2.15 (public)
- Contacts: privacy@virtusgroup.biz
Linked Assurance Artefacts
- Security Overview NZISM
- Privacy Policy Operational Summary
- DPIA Template
- Breach Response Procedure
- Incident Response Plan
- BCDR Summary
- End-user Support Runbook
- Infrastructure Ops Runbook
- Network Ops Runbook
- MDM Baseline
- Cloud Governance Baseline
- Vulnerability Management Procedure
- Service Access and Administration Summary
Governance & Assurance Signals
- Insurances & certifications: Public Liability, Professional Indemnity, Statutory, and IT Liability (limits/expiry available on request).
- Conflicts of Interest: we disclose, avoid, and manage COI; staff attestations at engagement; clients are notified of potential conflicts.
- Subcontractors/Vendors: vetted for security/privacy; contract flow-downs, incident notice SLAs, and right to audit/assurance evidence on request.
- Information Security posture: data residency posture, backup immutability & restore testing, break-glass access, logging/retention (see Security Overview).
- Privacy contact & DSR: privacy@virtusgroup.biz • DSR by email with subject 'DSR Request'.
- DPIA triggers: new high-risk processing, cross-border transfers, or significant change of purpose/scale.
Service Levels (summary)
Target response and handling for Managed Services incidents and requests.
| Priority | Definition | Acknowledgement | Handling | Escalation |
|---|---|---|---|---|
| P1 Critical | Widespread outage or security incident | ≤ 15 minutes | 24×7 until stable | SD → Duty Eng → Service Mgr → Principal |
| P2 High | Major function impaired / high impact | ≤ 30 minutes | Business hours + after-hours as needed | SD → Duty Eng → Service Mgr |
| P3 Medium | Single user or non-critical feature | ≤ 4 hours | Business hours | Service Desk → Duty Eng |
| P4 Low/Request | Minor issue or standard request | ≤ 1 business day | Queued per change calendar | Service Desk |
Change windows: Tue/Thu 19:00–22:00 NZT (standard); emergency change via on-call approval.
On-call coverage: 24×7 for P1 (Gold tier); business hours for P2–P4 with after-hours by agreement.
Governance documents
- Insurance Statement
- Conflicts of Interest (COI) Statement
- Subcontractor & Vendor Policy
- Breach Response Procedure
- Personnel Vetting (MoJ)
- Physical Security Summary
- MultiVendor Collaboration Playbook
- Knowledge Management Handover Standard
- Resource Scaling Associate Onboarding SOP