J.7_Attachment_07_A001.pdf

Attachment 07 ‐ BAS SLA Requirements

Page 1 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐01: Infrastructure Support

SLA‐01‐01: General

SLA‐01‐01‐01 Provide a dedicated account manager for customer support management to ensure delivery of products and services as described in the SLA. The customer account manager would be responsible and/or the point of contact for DOC on the following items:

Manage documentation such as the SLA.

The contractor will assume all responsibility to ensure the cloud provider meets the SLA requirements and will serve as the primary interface to the cloud provider for sharing of all information necessary to execute the SLAs.

All responsibilities assigned to the “contractor” are assumed to include responsibilities of the cloud provider, as managed for the client by the contractor.

Manage the SLAs to ensure roles and responsibilities, and specification of provided services, are properly defined and current.

Provide reports as agreed upon, in the agreed upon timeframe. To include at a minimum:

availability, capacity, service support and recoverability.

Implement and maintain SLA metrics and primary analysis, as agreed upon. Metrics must include both service desk and architecture performance attributes and CSFs for each.

Conduct reviews of the SLA through scheduled meetings.

Coordinate with assigned support personnel as required.

Collect initial and supplemental requirements through questionnaires and meetings with the

Customer and validate requirements annually.

Develop and gain consensus on escalation procedures, and remedies; Coordinate resolution of service level deficiencies in a timely manner.

SLA‐01‐01‐02 Additional products needed to meet the SLAs will be the responsibility of the contractor. The contractor will also be responsible for the production control functions of the systems.

SLA‐01‐01‐03 The contractor will provide the data network designed and built in accordance with industry best practices and maintain an inventory and control of all circuits initiating from or terminating at the Contractor’s Data Center (to or from the control points) and including the DR site.

SLA‐01‐01‐04 The contractor will provide hardware, manage access to, and control the configuration of firewalls, switches, load balancers, and intrusion detection systems.

SLA‐01‐01‐05 The contractor must enforce the appropriate Configuration Management policies and practices as requested by DOC.

SLA‐01‐01‐06 The contractor shall honor DOC’s requests to update or change access ports, Virtual IPs, and other configuration items.

SLA‐01‐01‐07 The contractor shall honor DOC’s requests to update or change physical connectivity and changes to the physical network architecture as requested.

SLA‐01‐01‐08 The contractor shall provide DOC management with timely information, statistics and/or reports related to the contractor’s hosted environment and overall operations and maintenance services as requested.

SLA‐01‐02: Facilities

SLA‐01‐02‐01 The contractor shall supply appropriate provisions for power, power conditioning, and power continuity.

Page 2 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐01‐02‐02 The contractor shall supply appropriate provisions for air conditioning and ventilation.

SLA‐01‐02‐03 The contractor shall provide appropriate space for racks and rack door openings.

SLA‐01‐02‐04 The contractor shall supply appropriate fire detection and control.

SLA‐01‐02‐05 The contractor shall supply a managed and controlled IT environment including controlled temperature and humidity, UPS and generator power backup, fire detection and suppression systems, and physical and electronic security.

SLA‐01‐02‐06 The contractor shall ensure proper fail over and continuity of operations facilities are available immediately upon need, are properly configured, and procedures are in place to initiate and maintain operation of the facility.

SLA‐01‐03: Hardware

SLA‐01‐03‐01 The contractor is responsible for providing the hardware, operating systems and a detailed design of the system.

SLA‐01‐03‐02 The contractor shall provide at minimum environments for Production, Testing, and Training.

SLA‐01‐03‐03 Provide all hardware and operating system maintenance, repair or replacement for the systems.

SLA‐01‐03‐04 The contractor shall provide environments and capabilities to leverage capabilities such as virtualization and containers to allow for more efficient utilization of storage and compute assets.

SLA‐01‐03‐05 The contractor shall propose a technology refresh cycle for the Government’s review and approval. Technology Refresh should be built into the computing capacity charge. Technology refresh for telecom and network will be added to the annual telecom/network cost.

SLA‐01‐03‐06 The contractor shall provide all required storage to support the customers’ current and future processing needs. Storage must be specified in Gigabytes. The contractor shall provide 24x7x365 maintenance of the underlying storage hardware components.

SLA‐01‐04: Connectivity, Mobility, and Networks

SLA‐01‐04‐01 The proposed secure transmission facility must be compliant with Federal Information Processing Standard (FIPS) 140‐2.

SLA‐01‐04‐02 The contractor shall provide a network solution that is scalable to account for all user locations by bureau and all relevant data centers. The final network design must account for users worldwide, from DOC, other Federal, non‐Federal, temporary duty and telework locations.

SLA‐01‐04‐03 The contractor shall provide a network solution that is scalable to account for the total users (both current and future) across all applications/products/business demand (core financial, acquisition, personal property, real property, fleet and data warehouse and reporting).

SLA‐01‐04‐04 The contractor shall provide a network solution with bandwidth that is scalable to accommodate the busiest day, busiest hour across the business cycle for all the applications/products/business demand within BAS.

SLA‐01‐04‐05 The contractor shall provide a network solution that meets the following criteria:

Final network design and implementation includes resiliency and includes connectivity to the disaster recovery site.

Final network design allows (without any performance degradation) for peak (including Census decennial) days/loads per application.

Final network design must enforce all applicable security requirements.

Flexible network design to evolve with future security requirements and future technologies.

Final network design must allow for increased user base and/or applications.

SLA‐01‐04‐06 The contractor shall provide a network design that includes resiliency to eliminate and/or reduce the impact of downtime on users and business operations. (No single points of failure)

Page 3 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐01‐04‐07 The contractor shall provide a network design that enables a ubiquitous connection portal that enables transparent connectivity to all application end users while complying with HSPD‐12, application embedded technologies such that users will connect from any type of desktop, machine or user productivity device in supporting the applications included in BAS (i.e., Windows, Linux, desktop, smartphone, Apple, Android, IPad, etc.).

SLA‐01‐04‐08 The contractor shall provide a network architecture that does not prevent use of executive level presentation capabilities (e.g., IPad) due to limitations associated with network security and/or encryption.

SLA‐01‐04‐09 The contractor shall provide a network solution that supports end‐users ability to connect concurrently and transparently to the BAS solution without limiting the users’ productivity on other non‐BAS applications/products.

SLA‐01‐04‐10 The contractor shall provide a networking architecture that complies with all current security (i.e., NIST 800‐53) and networking requirements/policies and must evolve to comply with future security requirements/policies and future technologies.

SLA‐01‐04‐11 The contractor shall provide a network solution that prevents data loss (particularly assure no data loss of personally identifiable information (PII) and business identifiable information (BII)).

SLA‐01‐04‐12 Connectivity entering the selected network will pass through several layers of network and server‐ based controls including Intrusion Detection Systems (IDS), packet filtering systems, and proxy filtering systems, as appropriate.

SLA‐01‐04‐13 The contractor shall provide IPV6 and HTTPS network encryption for the BAS Solution Set.

SLA‐01‐04‐14 The contractor solution shall allow BAS Solution Set data to be exposed through APIs so that regulated third parties can access and read the data.

SLA‐01‐04‐15 The contractor solution shall allow laptops, tablets and other wireless capable devices to access the managed network regardless of location or time zone.

SLA‐01‐04‐16 The contractor solution shall allow virtual private network (VPN) remote access thorough standard internet connection, which allows the end user to experience the central network in a manner identical to being connected directly thereto.

SLA‐02: Application Management

SLA‐02‐01: Software

SLA‐02‐01‐01 The contractor shall be responsible for the administration of the solution and all related environments to include at a minimum: operating system, database, and application administration.

SLA‐02‐01‐02 The Contractor shall make every reasonable effort to remain current with all software versions, patches or new releases. Appropriate testing is required to ensure that business functionality is not compromised by updates. Patching and version upgrade functions for infrastructure software components will be done by the Contractor. Planned upgrades must be communicated to DOC in advance so they can complete regression testing prior to changes being implemented. The contractor must ensure all changes to applications, operating systems, and data bases are cascaded through the architecture to maintain proper alignment of all instances of the software (production, test, training, etc.)

SLA‐02‐01‐03 Provide oversight of system changes and operations based on Information Technology Infrastructure library (ITIL) best practices and ISO/IEC 20000‐1:2011 processes.

SLA‐02‐02: Configuration Management

SLA‐02‐02‐01 The contractor shall provide a Configuration and Change Management Plan and gain approval from DOC. The Change Management Plan will include a description of how the contractor will inform DOC of all changes applied to the system.

SLA‐02‐02‐02 The contractor will maintain standard process and documentation for any functional changes. An impact analysis document should be maintained for every change. All changes would be implemented only upon approval from DOC.

Page 4 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐02‐02‐03 The contractor should maintain a tool to capture version control and changes to the base requirements. The contractor is responsible for the software, licenses, and maintenance of the tool.

The contractor will provide the required audit information to DOC.

SLA‐02‐02‐04 The Contractor should plan with appropriate documentation on all software upgrade, modifications, patches or any other system changes and get approval on the Release schedule from DOC.

SLA‐02‐02‐05 The Contractor shall implement software implementation, operation, maintenance, update, and/or patching in a manner that does not alter the configuration settings from the DOC approved configurations.

SLA‐02‐02‐06 The contractor will regularly provide DOC the detailed list of the implemented Production requests.

SLA‐02‐02‐07 Where a system or application is approaching the End of Service Life (EOSL), where the vendor will no longer support the software or equipment, the Contractor will prepare a plan to migrate to a supported platform or version. DOC will review the plan and approve it, or request modifications.

SLA‐02‐02‐08 Purchase and maintain licensing for system related software such as operating system, Secure Socket Layer (SSL) certificates, backup, and monitoring, as applicable.

SLA‐02‐02‐09 The contractor will provide file transfer configuration and support (e.g., SSH, SSL, Secure File Transfer Program (SFTP)).

SLA‐02‐02‐10 The contractor will provide interface configuration services to schedule, monitor, test, and diagnose system interfaces at a minimum.

SLA‐02‐02‐11 The contractor should provide tools to support configuration maintenance and management for DOC during product modification and build efforts.

SLA‐03: System Performance

SLA‐03‐01: Capacity

SLA‐03‐01‐01 The Contractor shall establish a solution that supports the user base and transaction volumes as summarized in Attachment 06 BAS User Count Estimates and Attachment 07 BAS Transaction Volume Summary. The solution must take into account the planned phased implementation approach as well as be scalable to support peak periods encountered during the Decennial for Census and/or future growth of the DOC business areas.

SLA‐03‐02: Availability SLA‐03‐02‐01 The system will be available 24 hours a day, 365 days a year (99.9 % uptime for production during core hours) with the exception of scheduled down time agreed upon between the contractor and the DOC. Planned outages must be communicated to DOC at least one month in advance.

SLA‐03‐02‐02 The system shall have a target Mean Time to Repair (MTTR) of 24 hours, with additional allowable lead times, administrative delays, and technician transportation delays as deemed appropriate.

Procures for determining each on a case by case basis will be documented in the incident response and escalation procedures. .

SLA‐03‐02‐03 Monitoring and metric reporting will be done by the contractor.

SLA‐03‐02‐04 System performance and metric data must be provided to DOC on a regular basis.

SLA‐03‐02‐05 Planned downtime must not correspond with core business hours of the System Users, 7 a.m. EST to 8 p.m. EST Monday through Friday or during end of fiscal year processing.

SLA‐03‐02‐06 The contractor shall alert the DOC contacts through the monitoring software and notify immediately by telephone and then e‐mail when (at a minimum) unscheduled system outages, server issues, network issues or data backup issues occur so that appropriate notification and/or contingency procedures can be executed.

SLA‐03‐03: Integration SLA‐03‐03‐01 Each business transaction should be processed in the system and sent back to the DOC systems in accordance with the performance metrics governing system response time.

SLA‐03‐03‐02 In a near real‐time scenario, upon failure to communicate the response to DOC systems, the system should make 5 consecutive tries within a duration of 60 seconds before throwing any exceptions.

Page 5 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐03‐03‐03 The System should provide proper reconciliation reports for all business transactions through the interface.

SLA‐03‐03‐04 The interfaces should be available consistent with SLA‐03‐02‐01

SLA‐03‐03‐05 The interfaces should be able to support transaction processing without performance degradation.

SLA‐03‐03‐06 All changes to the interfaces endpoints should be documented and communicated to DOC at least six months in advance.

SLA‐03‐03‐07 The data load from the system to the solution staging area should happen as designed and agreed to within each specific interface design document.

SLA‐03‐03‐08 Supporting documentation (data dictionary, data model) on the data should be provided to DOC.

SLA‐03‐03‐09 Any planned outages should be notified to DOC at least one month in advance.

SLA‐03‐03‐10 The data transport mechanism should be secured per FIPS 140‐2 AND maintain support as NIST updates that standard and publishes new versions.

SLA‐04: Security

SLA‐04‐01: General Security

SLA‐04‐01‐01 The Contractor shall be responsible for Information Technology security for all systems used in performance of this contract, or those which are connected to a Government network. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor must have physical or electronic access to DOC’s information, including sensitive information and personally identifiable information, contained in unclassified systems that directly support the mission of the Agency. This includes information technology, hardware, software, and the management, operation, maintenance, programming, and system administration of computer systems, networks, and telecommunications systems.

SLA‐04‐01‐02 Contractor provisioning and utilization of Information, systems, technology, and data in the performance of this contract shall be managed in compliance with security and privacy laws, regulations, guidance, and direction including but not limited to the:

Federal Information Security Management Act (FISMA);

National Institute of Standards and Technology (NIST) guidance;

Federal Information Processing Standards (FIPS) on information security;

Applicable Office of Management and Budget (OMB) memoranda; and, DOC policies, procedures and guidance.

SLA‐04‐01‐03 The use of common security configurations is mandatory. This requirement must include all common security configurations for computing and networking systems, as available, to Contractor products and services delivered under this contract.

SLA‐04‐01‐04 The Contractor shall validate all common security configurations utilizing National Institute of Standards and Technology approved Security Content Automation Protocol (SCAP) validated tools.

SLA‐04‐01‐05 The default DOC requirement for NIST common security configurations is full compliance by the Contractor. Regular reviews of compliance to FIPS 199 shall be executed.

SLA‐04‐01‐06 The Contractor shall not deviate from the NIST common security configurations without written authorization from DOC. The Contractor shall follow DOC's approval protocol when requesting deviation. A Contractor request for deviation does not imply an obligation for DOC approval.

SLA‐04‐01‐07 The Contractor shall provide continuous automated review and a monthly manual review of system logs to verify no suspicious activity has taken place.

SLA‐04‐01‐08 The Contractor shall provide auditing of the logs on a monthly basis using a separate audit review group that does not have system privileges. The System Administrator shall have access to the audit logs but the audit logs shall be backed up to a separate location. DOC shall also be given access to the audit logs upon request. Copies of the audit logs shall be maintained for a period of at least one year.

Page 6 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐04‐01‐09 The Contractor shall provide reporting of all security incidents for this system in a timely manner to the Shared Service Provider’s Data Center’s Information Systems Security Officer (ISSO) as well as the DOC ISSO in accordance with Shared Service Provider’s Data Center and DOC/CFO/ASA Incident Response policies. In accordance with DOC security policy, incidents potentially involving Personally Identifiable Information (PII) data shall be reported to the DOC in accordance with the timelines established by DOC policy (e.g. within 45 minutes). All other incidents shall be reported to the DOC in accordance with the performance metrics governing information security management.

SLA‐04‐01‐10 The Contractor shall provide DOC/CFO/ASA with access to all security documentation upon request. All security documentation shall be redacted to remove any sensitive and/or confidential information prior to release.

SLA‐04‐01‐11 The contractor will provide a full suite of security services, which will include (but not necessarily be limited to):

Secure system engineering and management Information security training and awareness IT service continuity Information security compliance and monitoring Information security forensics Vulnerability and threat management Boundary defense Endpoint defense Identity and access management Physical security

SLA‐04‐02: Physical Security SLA‐04‐02‐01 The Contractor shall maintain the systems required for this agreement, including any operational support systems in secure, access‐ controlled facilities.

SLA‐04‐02‐02 These facilities will comply with all required fire protection codes.

Page 7 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐04‐02‐03 The storage facility must meet the following requirements:

Magnetic media protection must meet standards set by:

o NFPA‐ The National Fire Protection Association o NIST‐ The National Institute of Standards and Technology o UL ‐ Underwriters Laboratories

Fire detection and suppression must meet UL and NFPA guidelines. U.L. Standards Listing:

o UL 72: ‐ Test for Fire Resistance of Record Protection Equipment o UL 155: ‐Tests for Fire Resistance of Vault and File Room Doors

NFPA Standards Listing:

o NFPA 232 Protections of Records o NFPA 232A Guide for Fire Protection of Archives and Records Centers o NFPA 80 Standard for Fire Doors and other openings o NFPA 80A Recommended Practice for Protection of Buildings from Exterior Fire

Exposures o NFPA 12A Standard on Halon 1301 Fire Extinguishing Systems o NFPA 72 National Fire Alarm Code o NFPA75 Standard for the Protection of Information Technology Equipment

NIST Standards listing:

o NIST Pub 500‐101 Care and Handling of Computer Magnetic Storage Media o NIST Pub 500‐199 Data Storage Risks, and Procedures to minimize o NIST Pub 800‐53 Security and Configuration Management o Vault environment must meet the following temperature requirements:

o Temperature: maintain between 60 and 70 degrees Fahrenheit SLA‐04‐03: Monitoring SLA‐04‐03‐01 In case of detection of anomalies, the contractor shall provide appropriate notification to its own personnel assigned to DOC and to personnel designated by DOC. Staff from the contractor shall respond to the issue in a timely manner and work to correct it. The contractor shall provide reports detailing anomaly correction activities to DOC.

SLA‐04‐03‐02 The contractor will perform a monthly vulnerability assessment with administrative credentials for all DOC‐related systems (OS, databases and application software.) These scan results; along with any explanatory notes will be provided to DOC. These reports will be due within 24 hours for “Critical” exposures, and included on a monthly report for “High” and “Medium”. DOC defines “Critical” as a vulnerability that is being actively and widely exploited, with loss of control of either the machine or the data on it as a consequence. The definitions of High, Medium and Low are defined for Common Vulnerabilities and Exposures (CVE) in the National Vulnerability Database (NVD) at http://nvd.nist.gov run by the National Institute of Standards and Technology (NIST).

SLA‐04‐03‐03 The contractor shall mitigate vulnerabilities in accordance with DOC’s established policies and procedures based on each system’s categorization.

SLA‐04‐03‐04 The contractor shall offer continuous monitoring and management of all servers, infrastructure software, networking equipment, and the application web interface. Contractor shall provide appropriate notification to its own personnel and to personnel designated by DOC for anomalies.

SLA‐04‐03‐05 The system must provide detailed logging and auditing capabilities, such as recording users' log‐in and log‐out events, as well as logging changes to data identified by DOC as important or sensitive data.

Page 8 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐04‐03‐06 Monitor server and storage utilization (including CPU utilization, memory utilization, and allocated

vs. used storage) to ensure server and storage utilization is being managed efficiently. The Contractor shall provide monthly reports of server and storage utilization with the agreed upon thresholds and meet at least annually with DOC to discuss future capacity requirements.

SLA‐05: Data

SLA‐05‐01: Protection of Sensitive Information

SLA‐05‐01‐01 All Contractor personnel are responsible for recognizing sensitive information and avoiding inappropriate or accidental access, use, or disclosure in accordance with DOC IT and privacy policies.

SLA‐05‐01‐02 All Contractor personnel are responsible for recognizing personally identifiable information and avoiding inappropriate or accidental access, use, or disclosure in accordance with DOC IT and privacy policies.

Personally identifiable information (PII) refers to information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, etc., alone or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

The Contractor is expected to provide a solution for masking data that is defined as PII.

SLA‐05‐01‐03 The Contractor must not use or redistribute any and all DOC information except as specified in the

Contract.

SLA‐05‐01‐04 All Contractor personnel with access to the systems or applications covered under this contract must have training appropriate to their role. As well, they must complete annual Security Awareness Training (SAT), and the Contractor will provide certification to DOC that all personnel have successfully completed the SAT.

SLA‐05‐01‐05 In addition, contractor personnel with enhanced access (security administrators, domain administrators, system administrators, Data Base Administrators, etc.) must also take at least one day (8 hours) of specialized security training per year. The course taken, date completed, and confirmation that the course was passed will be provided to DOC as part of the annual security assessment. This information will be included as part of DOC’s FISMA evaluation should the systems and applications in the contract be included in the FISMA review.

SLA‐05‐01‐06 The system must store sensitive data, including credit card numbers and Social Security Numbers, at the database level in an encrypted form using industry‐standard encryption methods with 128‐bit and higher encryption keys.

SLA‐05‐02: Privacy Impact Assessment

SLA‐05‐02‐01 Consistent with the E‐Government Act of 2002 and in OMB Memorandum M‐03‐22, the Contractor will conduct a privacy impact assessment (PIA) for the information system.

SLA‐05‐02‐02 PIAs are conducted to ensure that there is no collection, storage, access, use, or dissemination of identifiable information from or about members of the general public and businesses that is not needed or authorized, and that identifiable information that is collected is adequately protected.

PIAs may address issues relating to the integrity and availability of data handled by a system, to the extent these issues are not already adequately addressed in a System Security Plan.

SLA‐06: Continuity of Operations

SLA‐06‐01: Backup/ Recovery

SLA‐06‐01‐01 Daily and Weekly full backups must be taken by the contractor. A copy of the weekly backups must be created and stored in an approved facility.

Page 9 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐06‐01‐02 Requested restores by the DOC must be completed as soon as possible considering the restore media type and amount of data requested.

SLA‐06‐01‐03 All databases and software required to operate the systems will be backed up whenever changed, and backups retained for periods of time sufficient to ensure that restoration prior to a failure can be accomplished.

SLA‐06‐01‐04 Copies of the backups must be stored in a secure facility offsite and at least 50 miles from the location of the primary systems.

SLA‐06‐01‐05 Routine restoration of deleted files must not be dependent on the off‐site versions.

SLA‐06‐01‐06 Provide on‐site and off‐site management and access control of all media.

SLA‐06‐01‐07 Sanitize all media prior to disposal, release or reuse.

SLA‐06‐01‐08 Procedures for access to recovered data, including authorizations and maintenance of proper personnel, should be maintained.

SLA‐06‐02: Disaster Recovery

SLA‐06‐02‐01 The Contractor must provide a contingency plan based on the DOC evaluation of the acceptable outage tolerance, using NIST Special Publication (SP) 800‐34 as guidance.

SLA‐06‐02‐02 The Contractor shall restore all systems, including production and non‐production environments, within the agreed upon amount time to be defined as part of the implementation planning activities.

Recovery Point Objective (RPO) will be the backup of data up to the last 24 hours.

SLA‐06‐02‐03 All contingency and disaster recovery plans will be tested at least annually.

SLA‐06‐02‐04 All facilities shall have power source appropriate to the criticality of the hosted systems, which may include battery power, on‐site generators, and provision for re‐fueling in the event of an extended power failure.

SLA‐06‐02‐05 The Shared Service Provider shall provide the same administration support for Disaster Recovery (DR) environment(s) as required at the primary data site.

SLA‐07: User Support

SLA‐07‐01: Trouble Ticketing, Tracking, Escalation

SLA‐07‐01‐01 The contractor shall offer an automated mechanism for submitting and tracking support requests.

The contractor shall indicate in its SLA what type of support request can be made, the maximum amount of time that will expire before work will commence on requests, and the maximum volume of support requests that can be submitted. These values will be agreed upon with the contractor before implementation.

SLA‐07‐01‐02 The contractor shall offer mechanisms for escalating support requests outside the normal support request mechanism if either a support request waits in queue for an excessive amount of time, or if the requestor feels that emergency actions are required. The contractor will have local representation available, as requested by DOC, in the Washington DC metropolitan area.

SLA‐03‐03‐03 All production incidents should be responded within timelines established in the performance metric governing customer care. The incidents should be documented and communicated to DOC via proper communication channels.

SLA‐03‐03‐04 Help desk tickets shall be closed per agreed timeframes based on ticket severity level.

SLA‐07‐02: Help Desk Support

SLA‐07‐02‐01 The contractor must provide Tier I, II, and III level support with the exception of business/policy/procedure related issues, which need to be forwarded to DOC. The contractor will need to define issue escalation criteria as well as provide reports detailing the tracking of user calls.

SLA‐07‐02‐02 Help Desk support for end users shall be available five days a week, 7:00am – 8:00pm EST;

excluding Federal holidays. Interactive Voice Response and email logging shall be available 24x7.

SLA‐07‐02‐03 Create new DOC‐related local user accounts and/or add domain user accounts to server with requested privileges only after receiving a request from an authorized official(s) of the DOC.

Page 10 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐07‐02‐04 Modify existing DOC‐related local user accounts (e.g., password resets and unlocking accounts) only after receiving a request from an authorized official(s) of the DOC.

SLA‐07‐02‐05 Notify DOC upon completion of DOC‐related user account requests.

SLA‐07‐02‐06 Manage DOC‐related user accounts per relevant security policies and procedures.

SLA‐08: Audit

SLA‐08‐01: Right to Audit

SLA‐08‐01‐01 The Contractor shall provide access to DOC designated personnel, including the Office of Inspector General, to the Contractor’s and sub‐ Contractors’ facilities, installations, operations, documentation, databases and personnel used in performance of the Contract. Access shall be provided to the extent required to carry out a program of IT inspection, investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DOC data or to the function of computer systems operated on behalf of the DOC, and to preserve evidence of computer crime.

SLA‐08‐01‐02 DOC will provide two weeks’ notice for routine reviews, but reserves the right for immediate access in the event of a security incident.

SLA‐08‐01‐03 DOC intends to conduct reviews in conjunction with the annual Financial Audit and Federal Information Security Management Review (FISMA) evaluation.

SLA‐08‐01‐04 Access to Contractor personnel and systems is to be provided at no additional cost to DOC.

SLA‐08‐01‐05 In the event of a security incident, DOC will negotiate cost sharing based on the results of the investigation.

SLA‐08‐01‐06 Contractor personnel may be required to participate in DOC’ Computer Incident Response

Team (CIRT) process.

The CIRT is a very important part of security. If there is a serious security incident involving malicious software, a virus or hack into a system that results in the loss of availability, integrity or confidentiality of DOC data, a team consisting of DOC’s IT Security Officer (and others) and the contractor’ssecurity or operations team must meet to remediate and report the issue. This is called the Computer Incident Response Team and is essential for system security.

DOC needs to be informed of any “incident” that potentially affects DOC data. DOC must work closely with the contractor to resolve the issue.

SLA‐08‐01‐07 The contractor shall provide assurance that the proper security practices are in place. DOC will periodically scan the applicable systems for vulnerabilities. DOC will provide two weeks’ notice prior to any scans, and will supply the Contractor with the results. Should the scan identify un‐ remediated vulnerabilities, the Contractor will treat the remediation activities as an urgent change, however no additional charge to DOC will apply, as routine remediation falls under standard system maintenance.

SLA‐09: Reporting

SLA‐09‐01: Management Reporting

SLA‐09‐01‐01 The Contractor shall provide routine reporting to DOC management on the security posture, outstanding vulnerabilities and remediation efforts, and other metrics as required by DOC.

SLA‐09‐01‐02 The reporting periods will include monthly, quarterly and annual documents. DOC will define which category each report falls into.

SLA‐09‐01‐03 Reporting may include, but is not limited to, metrics such as patch management statistics, operating systems and application configuration compliance, vulnerability scan results and remediation status, Plan‐of‐Action‐and‐ Milestones tracking, incidents, system administrator certification statistics, and security training statistics.

SLA‐09‐01‐04 A&A activities will be done prior to service commencement (go live into Production,) and periodically thereafter as required by Federal or DOC policies.

Page 11 of 11 April 2019

SLA Requirements

Req ID # Requirement

SLA‐09‐01‐05 The Contractor shall conform to all Federal and DOC policy guidance and reporting requirements regarding A&A of IT systems.

SLA‐09‐01‐06 DOC and the Contractor shall jointly prepare and submit an A&A Package for the Contractor system per an agreed upon schedule (still TBD).

SLA‐09‐01‐07 The contractor shall maintain and update the A&A package on at least an annual basis and submit to DOC for review and approval.