ATTACHMENT 6 - Hosting SLA Amend 2.pdf

Attachment 6 – Service Level Agreement for Task 4.2

Superstructure

• Power Availability – A/C Power systems in the datacenter are designed to run uninterrupted, including during a utility power outage. A/C power to the outbound port on FDA serving power distribution unit (PDU) is guaranteed to be available 99.9995% of the time in a calendar month.

• HVAC Quality and Availability (Heating Ventilation and Air Conditioning) – Target ambient room temperature will be 72 Degrees F in the server area of the datacenter.

Ambient room temperature will not vary by more than +/- 5 degrees. Relative humidity will be targeted for 45% in the server area. Relative humidity will not vary by more than +/- 5%. The vendor guarantees that the HVAC facilities will provide adequate cooling 99.9995% of the time in a calendar month.

• No Public Access - Public access to the data centers is strictly forbidden. Only data center operations engineers and other authorized personnel are allowed in the server areas of the data centers.

• Biometric and Proximity Access Controls – Access to data centers is strictly controlled through the use of biometric scanners and proximity access cards.

• Fire Detection and Suppression – Data centers are equipped with sophisticated fire detection and suppression systems. The objective is to prevent and suppress potential causes of fires through the use of early detection systems. In the event of an actual fire, Rackspace utilizes advanced fire suppression systems to suppress fire.

• Network Availability – Data center network infrastructure is guaranteed to be available 99.9995% of the time in a calendar month. Network infrastructure is defined as the portion of the network extending from the outbound port on the FDA cabinet switch to the outbound port on the border router. Network Availability is defined as the ability to pass TCP/IP traffic with less than 3% packet loss and less than 30ms latency across the vendor network infrastructure. Vendor guarantees 99.9995% availability of all components of the network infrastructure including switches, routers, and cabling.

Devices

• Server Hardware replacement – Hosting vendor guarantees the functioning of all hardware components provided by the hosting vendor and will replace any failed component at no cost to FDA. Hardware replacement will begin when a hosting vendor technician identifies the cause of the problem, and is guaranteed to be complete within one (1) hour of problem identification by hosting Vendor. Server Hardware is defined as the processor(s), RAM, hard disk(s), motherboard and NIC card. This guarantee excludes the time required to rebuild a RAID array, reload the operating system, reload and configure applications, and/or restore from backup (if necessary).

• Network Device Management – Hosting vendor manages and maintains the advanced network devices in FDA’s configuration. Firewalls are managed and monitored 24/7/365 by hosting vendor security engineers. The initial firewall rule-set adheres to a strict “default-deny” policy which means that only a select few TCP/UDP ports are open on the firewall for remote management purposes. The opening of additional ports must be specifically requested in writing by FDA. Basic configuration changes are guaranteed to be implemented within 24 hours of receipt of a written request from FDA.

• Network Device Availability – A high-availability network device solution typically requires two (2) devices configured in a fail-over configuration. Devices configured for high availability are guaranteed to be available 99.9995% of the time in a calendar month. In the event of failure of a non-redundant network device (i.e. a device not configured for high availability) which causes an outage in FDA’s hosted configuration, the device is guaranteed to be repaired or replaced within one (1) hour of problem identification by hosting vendor.

Security

• Operating System – When software vulnerabilities are revealed and addressed by a software vendor patch, hosting vendor obtains the patches from the software vendor and categorizes the urgency of application as either “critical” or “non-critical” in nature. The determination of the critical/non-critical nature of patches is solely at the discretion of the hosting vendor. Hosting vendor will conduct testing for patches in its lab and on its internal production environment. Patches will be applied after they have been approved and qualified by hosting vendor technicians. Non-critical patches are typically applied on a monthly basis whereas critical patches are applied on an ‘as needed’ basis. Hosting vendor will apply any software vendor supplied patch to supported software within 4 hours of receiving a written request from FDA. Hosting vendor will only apply software vendor supplied and software vendor supported patches. FDA will be notified via support ticket prior to the application of patches, unless agreed to otherwise.

Backups

• Data Backup – Hosting vendor will schedule, perform, monitor, and maintain data backups. Hosting vendor will backup all files and file systems on each server in FDA’s configuration. Default backup policy includes weekly full backups and daily differential backups of all files to a central tape library. Data backups are retained onsite for two (2) weeks and offsite for twelve (12) weeks.

• Data Restoration – Data restoration allows data to be pulled from back-ups and placed back to production or provided to FDA in another capacity, as requested. Hosting vendor will initiate restoration of FDA’s data within two (2) hours of receipt of FDA’s written request for LOCAL restores. Hosting vendor will initiate restoration of FDA’s data within six (6) hours of receipt of FDA’s written request for OFFSITE restores. The contractor is responsible for two (2) LOCAL restoration events per calendar month, and one (1) OFFSITE restoration event per calendar month. Any additional restoration events shall be ordered by FDA using IDIQ ordering procedures in Section 8 of the contract.

Monitoring

• Availability Monitoring – Hosting vendor will monitor up to 6 TCP ports (HTTP, HTTPS, SMTP, POP3, Etc.) Per server for service availability. General server availability is tested every five (5) minutes via PING. FDA will be alerted via email if port or ping monitors fail three consecutive times.

• Fault Monitoring – Hosting vendor monitors status events on servers and network devices including network availability, process status, file system capacity, and backup success/failure. Hosting vendor also monitors COTRe OS and application log files for critical/warning application and system events. Hosting vendor will also monitor server hardware faults.

• Performance Monitoring – Hosting vendor monitors key performance metrics for operating system (i.e. CPU, RAM, Disk), and select applications (i.e. process statistics, users, throughput) and databases (i.e. caching, performance, transaction success).

• Response to monitoring alerts and FDA-initiated trouble tickets – When alerted of a potentially critical problem by any monitoring systems, Hosting vendor will begin troubleshooting and addressing the problem and will initiate FDA contact via support ticket, telephone call, or both depending upon the severity of the situation or the rules of engagement according to the table below. FDA-initiated trouble tickets will receive responses in the same manner.

Priority/Severity Levels and Guaranteed Response Times

Priority/Severity Level Example Situation Support Response Time

Emergency:

Server, switch, or site down

Cannot access server or site from the public Internet.

24 X 7 Within 15 minutes

Urgent:

Server or site functioning improperly or at less then optimal performance

Server or site is accessible but in a reduced state (timeouts or slow response)

24 X 7 Within 1 hour

Standard:

Non-critical; server or site is functioning normally, but you require information or assistance on Intensive services, wish to schedule maintenance outages, or any other non-immediate tasks

Site is functioning with acceptable parameters, but assistance is required in loading software or have a help desk-type question 24 X 7 Within 4 hour

Disaster Recovery/Continuity of Operations

• The hosting service provided must guarantee a not-to-exceed downtime of 8 hours for all production systems including all server nodes, supporting databases and supporting network and IDS components except for the secure FTP server and web analytics server in the event of a data center disaster.

• The recovery requirement for the secure FTP and web analytics servers is five business days.

• The recovery requirement for all other systems test, preproduction etc. is 10 business days.