Attachment J-03 Service Level Agreement with Incentives and Penalties.pdf

Attachment J-03

Service Level Agreement with Incentives and Penalties

1. Service level agreement purpose

1.1 This Service Level Agreement (SLA) outlines the required performance metrics, escalation procedures, and support commitments expected from the Contractor for the Senate Document Management Solution (SDMS).

1.2 These standards are in effect for the duration of the period of performance as defined in the Statement of Work.

2. Definitions

2.1 Uptime: The period during which the solution is operational and accessible.

2.2 Downtime: The period during which the solution is inaccessible or malfunctioning.

2.3 LOE (level-of-effort): The estimated amount of labor, expressed in hours or days, required to complete a specified task or deliverable. LOE must include a breakdown by labor category, role, or individual and reflect a reasonable, good-faith projection of the time needed to perform the work.

2.4 NTE (not-to-exceed): A financial ceiling associated with a task or set of tasks, representing the maximum amount the Contractor is authorized to bill without prior written approval from the COR. The NTE amount is derived from the approved LOE and associated labor rates and serves as a contractual cap on labor charges.

2.5 Severity Levels:

• Severity 1 – Critical impact: complete loss of service or major solution failure.

• Severity 2 – Significant impact: major functionality degraded or unusable.

• Severity 3 – Moderate impact: minor functionality impaired.

• Severity 4 – Low impact: informational or routine requests.

3. Solution availability

3.1 The Contractor shall ensure solution availability of 99.9% or higher, including scheduled maintenance windows. The solution shall ensure 100% uptime outside of scheduled maintenance windows with a target of 0% unplanned downtime.

3.2 The Contractor shall schedule maintenance windows in coordination with the Contracting Officer’s Representative (COR) outside of normal business hours to ensure minimal interference with operations (see Section 6 below).

3.3 Total planned uptime percentage (inclusive of scheduled maintenance windows) will be assessed annually. For each 1% drop in uptime (rounded) below the 99.900% threshold, a 10% reduction in the annual maintenance fee may be assessed.

3.4 Total unplanned downtime percentage will be assessed monthly, with a target of 100% uptime (excluding COR-approved maintenance windows). For every 1% of downtime above 0% (rounded), a 1% reduction will be applied to the monthly invoice.

4. Incident response and resolution

4.1 Severity levels

Severity Initial Response Time Resolution Time Objective

1 (Critical) Within 1 hour (24x7) Within 4 hours

2 (High) Within 2 business hours Within 1 business day

3 (Medium) Within 4 business hours Within 3 business days

4 (Low) Within 1 business day Within 5 business days

4.2 At least 98% of Severity 1–3 incidents shall be resolved within the defined resolution time windows. This percentage shall be used to calculate SLA compliance for the purposes of incentives and penalties.

5. Escalation process

5.1 If the Contractor fails to meet the resolution time for a Severity 1 or 2 incident, the issue shall be escalated.

5.2 After 2 hours (Severity 1) or 1 business day (Severity 2), the issue shall be escalated to the Contractor’s senior technical personnel.

5.3 If unresolved beyond 1 additional day, the issue shall be escalated to the Contractor’s management personnel and the Contractor shall notify the COR in writing of the situation.

5.4 Upon request, the Contractor shall provide the COR with a detailed incident report describing the nature of the issue, the Contractor’s plan for resolving the issue, any obstacles preventing a timely resolution, and the expected resolution date and anticipated level of effort.

6. Maintenance

6.1 The Contractor shall provide the COR with at least 5 business days’ notice for any planned downtime.

6.2 Scheduled maintenance shall occur outside business hours, 8:00 AM to 5:00 PM ET, Monday to Friday (excluding federal holidays) unless otherwise approved in writing by the COR.

7. Reporting

7.1 The Contractor shall provide monthly report including:

a. Monthly uptime percentage (indicating whether downtime was planned and approved);

b. Number and type of incidents;

c. Incident response times and compliance rates;

d. Incident resolution times and compliance rates;

e. Root cause analysis of Severity 1 incidents (as applicable);

f. User activity summaries (e.g. logins, uploads, activity);

g. Workflow completion rates and success metrics;

h. Duplicate submission alerts and false positive rates;

i. Alert logs and solution performance issues; and

j. Risk mitigation report (provided quarterly).

7.2 Reports must be provided to the COR by the fifth business day of every month. No extension or exceptions will be applied to this due date requirement. Monthly reports shall include raw solution-generated timestamps and logs for all tracked incidents. The COR reserves the right to request full log extracts or audit trails to verify compliance.

8. Contractor responsibility for solution failures

8.1 The Contractor is responsible for identifying and resolving solution failures that arise from expected usage scenarios, configuration problems, solution instability, or software defects, even if they occur unexpectedly.

8.2 All solution failures must be resolved without additional cost to the Senate, unless prior approval is obtained from the COR.

8.3 The Contractor shall proactively identify and resolve any configuration or ingestion issues that may affect workflow execution. Persistent ingestion or indexing failures must trigger an incident resolution and be tracked for SLA compliance.

8.4 Any SLA disputes or inconsistencies in reported performance will be resolved in consultation with the COR and documented in writing within 15 business days of report submission.

9. Automated monitoring and alerting

9.1 The solution shall generate automatic alerts for ingestion failures, duplicate document submissions, workflow stoppages, and solution performance anomalies.

9.2 The solution shall include a configurable notification solution to escalate alerts to users, administrators, and the COR based on severity.

9.3 The solution shall provide automated retention enforcement to archive or remove documents after defined intervals. Retention policy configuration must comply with Senate requirements.

Compliance with retention policies must be confirmed in quarterly audit reports.

9.4 The solution shall offer fault-tolerant workflow logic that isolates errors and allows remaining transactions to complete.

9.5 The Contractor shall prevent notification overload by enabling configurable digests and expiry controls for recurring alerts (e.g., Document Knowledge Transfer alerts).

10. Diagnostic support

10.1 The solution shall provide detailed diagnostic messages and error codes to help users and support staff quickly identify the cause of ingestion, search, or workflow failures.

10.2 The solution shall validate documents at time of upload for acceptable file size, format, and metadata completeness.

10.3 The solution shall automatically flag suspected duplicate document submissions and require user confirmation before acceptance.

10.4 Solution workflows must be fault-tolerant and not fail completely due to large files, corrupt data, or unsupported formats.

10.5 Resolution of workflow bottlenecks and ingestion failures shall occur within 1 business day.

10.6 Contractor must document and submit detailed error logs for each incident.

10.7 Duplicate alerts must be user-visible and actionable.

10.8 The Contractor must track and audit duplicate detection as part of monthly solution integrity checks.

11. Penalties and incentives

11.1 The Senate will assess performance monthly using metrics outlined in this document. SLA compliance and penalties will be assessed per Table 1 (below).

11.2 For full SLA compliance (0 SLA breaches on any criterion), the Contractor may earn a bonus equal to 2% of the monthly invoice.

11.3 Penalties will apply according to the following schedule:

Table 1: Penalty Schedule

SLA Metric Target Penalty

Annual up�me (including planned maintenance)

99.9% up�me (assessed annually)

10% cumula�ve penalty for each percentage point below 99.9% (rounded), applied to annual maintenance cost.

Monthly solu�on up�me (excluding planned maintenance)

100% up�me (assessed monthly)

1% cumula�ve penalty for each percentage point below 100% (rounded).

Incident response �meliness (all severi�es)

≥98% of incident responses on �me (assessed monthly)

1% cumula�ve penalty for each percentage point below 98 (rounded).

Incident resolu�on �mes (all severi�es)

≥98% of incidents resolved on �me (assessed monthly)

1% cumula�ve penalty for each percentage point below 98 (rounded).

Incident logs/audit trails complete (all severi�es)

≥98% of incidents logged (assessed monthly)

1% cumula�ve penalty for each percentage point below 98 (rounded).

Root cause analyses submited (when applicable)

≥98% of Sev. 1 incidents analyzed (assessed monthly)

1% cumula�ve penalty for each percentage point below 98 (rounded).

Monthly report on-�me fi�h business day (assessed monthly)

1% flat penalty if not on schedule.

Risk mi�ga�on repor�ng (quarterly)

Report provided (assessed quarterly)

1% flat penalty if not provided.

11.4 Incentives apply only in months when no Severity 1 incident remains unresolved beyond the established SLA resolution window. Penalties apply cumulatively to any unresolved SLA obligations.

11.5 Actual SLA achievement for each criterion will be rounded to the nearest whole number (e.g., 97.4% = 97%; 97.5% = 98%).

11.6 The COR may waive or adjust penalties due to Senate-side constraints.

11.7 No combination of monthly incentives or penalties shall exceed 10% of the applicable monthly invoice.

11.8 SLA compliance issues shall be documented monthly and resolved no later than the twenty-fifth calendar day of the following month.

12. Measurement and validation

12.1 The Contractor shall use automated tools, incident logs, and solution logs to collect all data used for SLA measurement.

12.2 Monthly SLA reports must include timestamped logs and activity histories as applicable.

The Senate reserves the right to audit these logs or request additional verification of their accuracy. The Contractor shall provide these reports by the fifth business day of each month.

13. Contacts

The Contractor shall maintain an up-to-date escalation and contact list (including the individuals to whom incidents are escalated) and provide it to the COR at contract award and anytime it is updated.

14. Labor estimates

14.1 The Contractor shall provide written LOE estimates for any additional tasks, ad hoc work, or out-of-scope requests issued by the Senate. These estimates shall include labor categories, hours by resource, hourly rates, and an NTE cost.

14.2 All estimates must be approved in writing by the CO before the Contractor proceeds with the work.

14.3 If the actual effort is projected to exceed the approved estimate, the Contractor must submit a revised estimate with justification for approval by the CO.

14.4 Invoices submitted without an approved LOE and corresponding COR authorization may be rejected or unpaid at the Senate’s discretion.

14.5 Invoices submitted in excess of the Contractor’s initial estimate without prior CO approval may be rejected or unpaid at the Senate’s discretion.

15. Proactive risk mitigation

15.1 The Contractor shall submit a quarterly report to the COR detailing any vulnerabilities, the Contractor’s recommended mitigation steps, and progress on any COR-approved risk mitigation projects.

15.2 Contractor must act on Senate-approved mitigations within 30 business days.