Attachment_5_DX_Service_Level_Requirements_Draft.pdf

U.S Census Bureau

Draft Attachment 5: D-X Service Level Requirements

Attachment 5: Draft Service Level Requirements

2028 Census Test and 2030 Census Decennial as a Service (D-X)

September 15, 2026

Table of Contents

1. Purpose

2. Scope and Applicability

3. Document Structure and Column Definitions

4. Service Level Monitoring, Measurement and Reporting

5. Continual Improvement Framework

7. Service Level Requirements Matrix

6. Definitions and Acronyms

1. Purpose This document establishes the Service Level Requirements (SLRs) for the Decennial-as-a-Service (D-X) program in support of the 2028 Dress Rehearsal and the 2030 Decennial Census. It defines the measurable performance outcomes the Contractor shall achieve across the D-X service domains, the calculation methods, reporting periods, and measurement sources by which performance will be evaluated.

2. Scope and Applicability Each SLR set forth in this document identifies key performance measures that will be used to evaluate the Contractor's delivery of services. The goal of establishing SLRs is to support USCB’s management of Contractor services by monitoring and measuring performance of critical D-X business requirements. USCB expects continuous improvement in the Contractor’s services and expects to review SLRs at least annually to adjust and reflect continuous improvement in the Contractor's provision of services.

The Contractor is accountable for end-to-end service outcomes across the device lifecycle, provisioning, connectivity, management, support, and disposition, regardless of subcontracted, carrier, or platform dependencies. Performance requirements apply to the Contractor's integrated service, and third-party dependencies do not relieve the Contractor of SLR accountability except where an exclusion is expressly granted in writing by the Government.

3. Document Structure and Column Definitions Each SLR is presented in a structured matrix, grouped by service domain. The columns are defined as follows:

Column Definition

SLR ID Unique identifier for the requirement, formatted SLR-<domain>. <sequence> (e.g., SLR-5.08). IDs are stable across document revisions; retired requirements are not renumbered.

Service Level Requirement Short descriptive title used as operational shorthand for the requirement.

Description Outcome-based statement of the required service behavior, using “shall” convention. Describes what must be achieved, not how.

Formula / Calculation Method The calculation, ratio, or measurement basis used to compute achieved performance for the reporting period.

Performance Requirement The quantitative threshold(s) the Contractor shall meet or exceed each reporting period.

Reporting Period The interval over which performance is measured and reported. Per-event metrics are measured at occurrence and summarized in the monthly performance report.

Measurement Tool / Source Data The authoritative system(s) or artifact(s) from which performance data is drawn.

All source data shall be auditable and retained per contract records requirements.

CI (Continual Improvement Eligible)

“Yes” indicates the target is eligible for periodic upward adjustment under the Continual Improvement Framework (Section 5). “No” indicates a fixed

Column Definition compliance floor (typically zero-tolerance security, accuracy, or timeliness requirements) not subject to renegotiation.

4. Service Level Monitoring, Measurement and Reporting

The Contractor will continuously monitor in scope systems and services in order to identify, report, and correct service level failures and to ensure the Contractor is meeting or exceeding the service levels as required. The Contractor will give notice to USCB immediately if the Contractor becomes aware it has failed or will fail to achieve a service level.

Measurement basis: Unless otherwise stated, availability and uptime metrics are measured on a 24×7 basis and exclude Government-approved maintenance windows only. Response-time metrics are measured at the 95th percentile unless otherwise specified. Percentage metrics are computed on the full population for the reporting period unless a government-approved sampling methodology applies.

Reporting: The Contractor shall deliver a consolidated monthly SLR performance report through the Government's ITSM platform or other designated reporting channel no later than the tenth (10th) business day following the close of each reporting period. Each report shall include achieved values, the underlying calculation, source-data references, and, for any missed requirement, a documented corrective action with owner and due date.

Auditability: The Government reserves the right to independently validate reported performance against source data. The Contractor shall provide read access to measurement tooling, raw telemetry, and supporting records upon request, consistent with applicable security and Title 13 handling requirements.

Exclusions: Performance failures caused solely by Government-directed actions, Government-furnished equipment or systems, or force majeure events (as defined in the contract) may be excluded from SLR calculations upon Government approval of a documented exclusion request submitted within ten (10) business days of the event.

Remedies: Failure to meet a mandatory performance requirement may result in remedies as set forth in the contract, which may include corrective action plans, performance improvement plans, and/or service level credits.

5. Continual Improvement Framework SLRs marked Continual Improvement (CI) eligible are subject to periodic review, no more frequently than annually, and at natural program milestones (e.g., post 2028 Census Test), to raise targets where sustained Contractor performance demonstrates achievable headroom. Adjustments shall be proposed with supporting trend data, mutually agreed, and incorporated by contract modification. CI adjustments shall never lower a target below its baseline value in this document.

SLRs marked “No” represent fixed compliance floors, principally zero-tolerance security, data accuracy, and synchronization requirements where the mission or Title 13 compliance would fail at any lesser standard. These are not candidates for target adjustment.

7. Service Level Requirements Matrix The following tables present the SLRs by service domain.

Service Domain 1: Contract, Program, and MSI Service Coordination SLR ID Service Level

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

SLR-1.01 Issue Resolution The Contractor shall close escalated program-level issues within the resolution thresholds defined in the applicable SLA matrix, maintaining full documentation of disposition and closure rationale for each escalated issue.

(Number of escalated issues closed within SLA threshold ÷ Total escalated issues due for closure in the period) ×

≥ 95% of P1/P2 (critical or high priority) issues resolved within SLA thresholds (XX hours/days)

≥ 90% of issues overall across all severities are resolved within SLA thresholds.

Monthly Government ITSM platform ticket records;

escalation log

Yes

Service Domain 2: Systems Development and Maintenance SLR ID Service Level

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

SLR-2.01 Integration Endpoint Availability

The Contractor shall maintain availability of all Contractor-managed integration endpoints and shall successfully validate connectivity for all authorized interfacing systems.

Endpoint availability = (Total endpoint uptime minutes ÷ Total scheduled minutes, excluding approved maintenance) × 100; connection validation = (Authorized systems with successful validated connections ÷ Total authorized systems) × 100

≥ 99% integration endpoint availability; successful connection validation for 100% of authorized systems.

Monthly Integration platform monitoring logs;

connection validation reports

Yes

SLR-2.02 Issue Detection, Logging & Resolution

The Contractor shall detect, log, and resolve integration issues within Government-defined timelines, with full traceability from detection through resolution and no impact to the program schedule. Integration issues identified by the Government that the Contractor's monitoring failed to detect shall be tracked as detection escapes with documented RCA.

(Detected integration issues logged and resolved within Government timelines ÷ Total detected integration issues) × 100;

detection escapes and schedule-impacting issues tracked as absolute counts

100% of detected integration issues logged and resolved within Government timelines with full traceability.

100% of detection escapes receive documented RCA.

No critical path slippage is attributable solely to Contractor causes.

Monthly ITSM platform records;

integration issue log;

detection escape register;

program schedule baseline

No

SLR-2.03 Mission-Critical Application Uptime

The Contractor shall maintain uptime of mission-critical application components and shall ensure no outages result from Contractor misconfiguration.

(Total mission-critical application uptime minutes ÷ Total scheduled minutes, excluding approved maintenance windows) × 100; misconfiguration

Maintain ≥ 99.5% mission-critical application uptime monthly on a per application basis.

Monthly Application performance monitoring (APM) tools;

outage and root-cause analysis (RCA) reports

Service Domain 2: Systems Development and Maintenance

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

outages tracked as an absolute count from root-cause findings

No more than one misconfiguration-attributable outage per quarter with cumulative downtime of 30 minutes or less, each with documented RCA and corrective actions.

SLR-2.04 Scalability & Application Response Times

The Contractor shall ensure delivered applications scale to at least twice the baseline user and device population without material performance degradation and shall maintain responsive transaction performance for standard operations.

Degradation = (Response time at 2× load − Baseline response Ɵme) ÷ Baseline response time) × 100; standard transaction response measured at the 95th percentile

Scale to 2× users/devices with ≤ 10% performance degradation; application response times ≤ 2 seconds for standard transactions.

Monthly (load validation at least quarterly or prior to major operational surges)

APM telemetry; load and performance test reports

Yes

SLR-2.05 Supply Chain Security The Contractor shall comply with Government supply chain security requirements for all third-party and open-source components in delivered software, including Software Bill of Materials (SBOM) submission, vulnerability scanning, and mitigation tracking for identified risks.

(Delivered software releases with complete SBOM, current vulnerability scan, and active mitigation tracking ÷ Total delivered releases) × 100

100% compliance with Government supply chain security requirements, including SBOM submission, vulnerability scanning, and mitigation tracking for identified risks.

Per release;

summarized monthly

SBOM submissions;

vulnerability scan reports;

mitigation tracking register

No

SLR-2.06 Software & Licensing Management – Patch Compliance

The Contractor shall apply software patches within required timelines across all Contractor-managed software and shall ensure no critical vulnerabilities remain unremediated beyond the maximum permitted age.

(Patches applied within required timeline ÷ Total patches due in the period) × 100;

critical vulnerability aging tracked as a count of open critical vulnerabilities older than 30 days

100% patch compliance within required timelines; zero critical vulnerabilities older than 30 days.

Monthly Patch management system reports;

vulnerability scanner output

No

SLR-2.07 Tier 3 Incident Resolution & Continuous Improvement

The Contractor shall resolve Tier 3 (engineering-level) incidents within agreed timelines, perform root-cause analysis on recurring or severe incidents, and demonstrate measurable reduction in incident recurrence over time.

(Tier 3 incidents resolved within agreed timeline ÷ Total Tier 3 incidents) × 100;

recurrence rate = (Repeat incidents with the same root cause ÷ Total resolved incidents) × 100, trended period over period

≥ 95% of Tier 3 incidents resolved within agreed timelines; 100% of severe or recurring incidents include documented RCA; demonstrated downward trend in recurrence rate.

Monthly;

trend analysis quarterly

ITSM platform incident records; RCA reports;

trend dashboards

Service Domain 3: Device Equipment and Asset Lifecycle Management Services

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

SLR-3.01 Transaction Timeliness

The Contractor shall complete asset lifecycle transactions, receipt, issue, transfer, return, and disposition, within 24 hours of initiation and shall maintain zero transaction backlog beyond SLA thresholds.

(Lifecycle transactions completed within 24 hours ÷ Total lifecycle transactions initiated) × 100; backlog measured as a count of transactions open beyond the backlog aging threshold at period close

≥ 95% on time completion of receipt, issue, transfer, return, and disposition transactions within 24 hours;

Zero transactions open beyond 5 business days.

Monthly Asset management system transaction records

Yes

SLR-3.02 Transaction Scalability

The Contractor shall sustain asset lifecycle transaction performance at twice the baseline transaction volume without material degradation in timeliness or accuracy, supporting peak operational surges.

Degradation = ((On-time completion rate at baseline volume − On-time completion rate at 2× volume) ÷ On-time completion rate at baseline volume) × 100

Support 2× transaction volume with ≤ 10% degradation in transaction timeliness performance.

Measured during surge periods;

validated at least quarterly

Asset management system throughput reports;

surge/volume test results

Yes

SLR-3.03 Reporting Accuracy

The Contractor shall deliver accurate asset reporting, refresh management dashboards daily, and deliver all required reports on the Government-approved schedule. Accuracy is validated by Government audit sampling against source systems.

(Validated-accurate report data elements ÷ Total sampled report data elements) × 100; dashboard refresh compliance = (Days with successful daily refresh ÷ Total operating days) × 100;

on-time report delivery = (Reports delivered on schedule ÷ Reports due) ×

≥ 99.5% reporting accuracy validated by audit sampling; dashboards refreshed daily; 100% of required reports delivered on schedule.

Monthly Reporting/dashboard platform logs;

Government validation samples

Yes

SLR-3.04 System Integration & Synchronization

The Contractor shall maintain continuous near-real-time synchronization of asset data with Sunflower, DAPPS, IDMS, and other Government-approved systems, keeping data latency within defined limits, and shall complete a full daily reconciliation to verify data consistency across all synchronized systems.

(Successful synchronization cycles ÷ Total scheduled synchronization cycles) × 100; data latency measured as elapsed time from source-system update to synchronized availability; daily reconciliation completion = (Days with successful full reconciliation ÷ Total operating days) × 100

100% successful near-real-time synchronization with Sunflower, DAPPS, IDMS, and approved systems;

data latency ≤ 15 minutes; 100% completion of daily full reconciliation.

Continuous measurement;

reported monthly

Integration job logs;

synchronization monitoring dashboards

No

SLR-3.05 Inventory Accuracy & Reconciliation

The Contractor shall maintain physical-to-record inventory accuracy, perform monthly reconciliations, and keep asset record accuracy within defined tolerances across all managed asset populations.

Inventory accuracy = (Assets verified as matching records ÷ Total assets sampled or counted) × 100; reconciliation variance = (Unreconciled asset value or count ÷ Total asset value or count) × 100; record accuracy = (Accurate asset records ÷ Total audited records) × 100

Inventory accuracy ≥ 99%; monthly reconciliation variance ≤ 0.5%; asset record accuracy ≥ 99.5%.

Monthly Asset management system records; cycle count and reconciliation reports; audit samples

Yes

SLR-3.06 Break/Fix Initiation, Resolution & Diagnostics Accuracy

The Contractor shall initiate break/fix, maintenance, or replacement actions promptly upon issue confirmation, accurately diagnose root causes, resolve complex device issues within defined timelines, and document root-cause analysis for all recurring issues, while

Initiation = (Actions initiated within the applicable geographic timeline ÷ Total confirmed issues) × 100; diagnostics accuracy = (Correct root-cause identifications ÷ Total diagnosed issues) × 100; recurrence = (post-resolution

100% initiation of break/fix, maintenance, or replacement ≤ 24 clock hours (urban/metropolitan) and ≤ 72 clock hours (remote/island) from issue confirmation, measured on a calendar (not business-hours) basis;

Monthly ITSM platform ticket records; field service dispatch logs; RCA reports

Service Domain 3: Device Equipment and Asset Lifecycle Management Services

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

maintaining overall SLA compliance for helpdesk, break/fix, and escalation activity.

defect recurrences ÷ Total resolved issues) × 100; resolution timeliness = (Complex issues resolved ≤ 3 business days ÷ Total complex issues) × 100;

overall SLA compliance = (Tickets meeting SLA ÷ Total tickets) × 100 diagnostics accuracy ≥ 99% with post-resolution defect recurrence < 1%; ≥ 90% of complex issues (laptops/tablets/smartphones) resolved ≤ 3 business days; 100% of recurring issues include documented RCA; ≥ 95% SLA compliance rate for help-desk, break/fix, and escalations.

Service Domain 4: Logistics, Warehousing, Kitting, Distribution, Site Deployment and Teardown

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

SLR-4.01 Site Deployment & Installation Readiness – Office Automation Equipment Availability

The Contractor shall ensure office automation equipment deployed to operational sites is installed, configured, and operationally ready, with minimal device-related downtime during the initial stabilization period following site activation.

(Device-related downtime hours during first 30 calendar days of site operation ÷ Total scheduled device operating hours during the same period) × 100

< 1% device-related downtime for office automation equipment during the first 30 calendar days of site operation.

Per site activation;

summarized monthly during deployment waves

Site activation checklists;

device monitoring/ITSM incident records tied to site and asset

Yes

SLR-4.02 On-Time Delivery The Contractor shall deliver kitted equipment and materials to designated sites and recipients by the Government-approved delivery schedule, maintaining chain of custody throughout transit.

(Shipments delivered on or before the scheduled delivery date with intact chain of custody ÷ Total scheduled shipments) × 100

≥ 98% on time delivery to designated sites and recipients;

100% chain-of-custody documentation for all shipments.

90% of deliveries are on time in accordance with contract requirements during peak operations/surge periods.

Monthly Shipment tracking records; delivery confirmations; chain-of-custody documentation

Yes

SLR-4.03 Kitting Accuracy The Contractor shall assemble device kits complete and correct to the Government-approved kit configuration, so that recipients receive fully operational kits without missing, incorrect, or non-functional components.

(Kits verified complete and correct to approved configuration ÷ Total kits shipped) × 100

≥ 99.5% kitting accuracy against the approved kit configuration; 100% of kit discrepancies corrected within 2 business days of report.

Monthly Kit configuration baselines; QA inspection records; discrepancy reports

Yes

SLR-4.04 Site Teardown & Asset Recovery Completion

The Contractor shall complete site teardown, equipment recovery, and disposition initiation within the

(Sites with teardown and asset recovery completed on schedule ÷ Total sites scheduled for teardown) × 100; asset

≥ 98% of site teardowns completed on schedule; 100% asset accountability at teardown with documented recovery

Per teardown wave;

Teardown schedules and completion reports; asset

Service Domain 4: Logistics, Warehousing, Kitting, Distribution, Site Deployment and Teardown

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

Government-approved teardown schedule, with full accountability for all deployed assets. [Proposed addition to address domain coverage;

accountability = (Deployed assets recovered or dispositioned with documentation ÷ Total deployed assets at torn-down sites) × 100 or disposition for every deployed asset.

summarized monthly management system disposition records

Service Domain 5: Mobility, Connectivity, and UEM

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

SLR-5.01 Cellular Service Activation at Shipment

The Contractor shall ensure devices requiring cellular connectivity ship with active cellular service, so devices are operationally ready upon receipt without field activation steps.

(Devices shipped with verified active cellular service ÷ Total cellular-enabled devices shipped) × 100

≥ 99% of devices have active cellular service at shipment.

Monthly Carrier activation records;

shipment manifests; UEM enrollment/connectivity telemetry

Yes

SLR-5.02 Service Availability The Contractor shall maintain end-to-end delivered connectivity service availability across all Government-designated operational geographies, inclusive of multi-carrier resiliency measures where applicable, and shall ensure underlying carrier core-network availability meets the carrier-attested standard.

Delivered service: (Total service-available minutes across the measured device population ÷ Total scheduled minutes) × 100, aggregated across designated geographies; carrier core-network availability attested via carrier availability reporting

End-to-end delivered service availability ≥ 99.9% across required geographies; carrier core-network availability ≥ 99.999% as attested by carrier reporting. [Availability structure restated from a single 99.999% end-to-end target;

Monthly Connectivity telemetry;

carrier availability attestations; outage records

Yes

SLR-5.03 Outage Notification & Escalation

The Contractor shall detect service outages and degradations and notify the Government with affected-area granularity sufficient to support operational response, escalating in accordance with the approved communications plan. Outages identified by the Government that the Contractor's monitoring failed to detect shall be tracked as detection escapes with documented RCA.

(Detected outage/degradation events reported by affected ZIP code within 1 hour of detection ÷ Total detected outage/degradation events) × 100;

detection escapes tracked as an absolute count

100% of detected outages or service degradations reported by affected ZIP code ≤ 1 hour of detection; 100% of detection escapes receive documented RCA.

Per event;

summarized monthly

Network monitoring alerts; outage notification log; ITSM records

No

SLR-5.04 Geographic Coverage & Remediation

The Contractor shall maintain cellular coverage availability across designated operational areas and shall deliver remediation plans for any identified coverage gaps within defined timelines.

(Designated operational areas with verified coverage ÷ Total designated operational areas) × 100; remediation timeliness = (Gap remediation plans

Coverage availability ≥ 99% in designated operational areas;

remediation plans for identified gaps delivered ≤ 10 business days.

Monthly Coverage validation reports; drive/field test data; gap remediation tracker

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

delivered ≤ 10 business days ÷ Total identified gaps) × 100

SLR-5.05 Network Uptime Quality

The Contractor shall maintain up time of Contractor-managed connectivity infrastructure and configurations (distinct from carrier core-network availability addressed in SLR-5.02) and shall ensure no outages result from Contractor misconfiguration.

(Total network uptime minutes ÷ Total scheduled minutes, excluding approved maintenance) × 100; misconfiguration outages tracked as an absolute count from RCA findings

≥ 99.9% network uptime; zero outages attributable to Contractor misconfiguration.

Monthly Network monitoring platforms; outage and RCA reports

Yes

SLR-5.06 Security Compliance & Controls

The Contractor shall enforce required security controls for mobility and connectivity services, including encryption of data in transit and safeguards preventing unauthorized SIM or eSIM profile changes.

(Managed connections with verified encryption in transit ÷ Total managed connections) × 100; unauthorized SIM/eSIM change events tracked as an absolute count

100% encryption in transit; zero unauthorized SIM swaps or profile changes.

Monthly UEM/security configuration compliance reports; carrier security logs; incident records

No

SLR-5.07 Service Termination for Returns

The Contractor shall terminate cellular service for returned devices promptly upon device return to decommissioning, preventing unnecessary service charges and reducing security exposure from active lines on unassigned devices.

(Returned devices with service terminated ≤ 3 days from return to decommissioning ÷ Total returned devices) × 100

100% of cellular service for returned devices terminated ≤ 3 days from device return to decommissioning.

Monthly Carrier deactivation records; asset return/decommissioning transactions

Yes

SLR-5.08 UEM Platform Uptime The Contractor shall maintain availability of the Unified Endpoint Management (UEM) platform and all supporting management services, measured monthly and excluding Government-approved maintenance windows.

(Total UEM platform uptime minutes ÷ Total minutes in month − approved maintenance minutes) × 100

UEM platform uptime ≥ 99.9% (monthly), excluding Government-approved maintenance windows.

Monthly UEM platform availability monitoring; maintenance window approvals

Yes

SLR-5.09 Transaction Response Times

The Contractor shall ensure the UEM platform delivers responsive performance for standard end-user and administrator transactions, including console operations and device-facing actions.

95th-percentile response time for standard UEM transactions, measured across end-user and administrator actions

End-user and administrator transaction response times ≤ 2 seconds for standard UEM actions.

Monthly UEM platform performance telemetry;

synthetic transaction monitoring

Yes

SLR-5.10 Component Availability The Contractor shall maintain availability of individual UEM functional components, enrollment, configuration, compliance, remote actions, and reporting, so that a component-level failure does not go unmeasured within aggregate platform uptime.

Per component: (Component uptime minutes ÷ Total scheduled minutes, excluding approved maintenance) × 100

Component-level availability ≥ 99.9% for enrollment, configuration, compliance, remote actions, and reporting functions.

Monthly UEM component monitoring; service health dashboards

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

SLR-5.11 Non-Compliance Detection, Containment & Remediation

The Contractor shall detect endpoint policy non-compliance, quarantine non-compliant devices, and remediate findings within severity-based timelines to maintain fleet security posture.

Timelines are measured from receipt of device telemetry indicating non-compliance; devices offline or out of coverage enter measurement upon next check-in.

Elapsed time from receipt of non-compliance telemetry to detection, from detection to quarantine, and from detection to remediation, measured per event and evaluated against severity-based thresholds

Detect non-compliance ≤ 5 minutes of telemetry receipt; quarantine ≤ 15 minutes of detection; remediate critical findings ≤ 24 hours; remediate non-critical findings ≤ 5 business days.

Per event;

summarized monthly

UEM compliance engine logs;

quarantine/remediation records

Yes

SLR-5.12 Vulnerability Management

The Contractor shall remediate vulnerabilities across managed endpoints and the UEM platform within severity-based aging limits. Aging limits apply to actively enrolled and connected devices; devices returning from offline status shall be remediated within a defined window of reconnection.

Count of open critical vulnerabilities older than 30 days and open high vulnerabilities older than 60 days on actively connected managed endpoints, measured at period close; reconnect remediation = (Returning devices remediated within the reconnect window ÷ Total returning devices with open findings) × 100

Zero critical vulnerabilities older than 30 days and zero high vulnerabilities older than 60 days on actively connected endpoints; devices returning from offline status remediate 72 hours of reconnection.

Monthly Vulnerability scanner reports;

patch/remediation tracking

No

SLR-5.13 Endpoint Incident Response

The Contractor shall initiate response to endpoint security incidents rapidly, contain affected endpoints, and resolve incidents within defined timelines unless otherwise directed by the Government.

Elapsed time from incident declaration to response initiation and to containment, per incident; resolution rate = (Incidents resolved ≤ 8 hours ÷ Total incidents) × 100

Initiate response ≤ 15 minutes and contain ≤ 60 minutes, measured from incident declaration or alert receipt; ≥ 90% of incidents resolved ≤ 8 hours (unless directed otherwise by the Government).

Per event;

summarized monthly

Security incident records;

UEM/EDR telemetry; ITSM incident tickets

Yes

SLR-5.14 Profile/Policy Application Accuracy

The Contractor shall ensure UEM configuration profiles and policies apply successfully to targeted devices on the first push, minimizing retry cycles and configuration drifting across the fleet.

(Devices with successful profile/policy application on first push ÷ Total targeted devices) × 100

Profile/policy application accuracy ≥ 99.5% at first push.

Monthly UEM deployment/compliance reports

Yes

SLR-5.15 Support Case Resolution & RCA

The Contractor shall resolve UEM and mobility support cases within defined timelines, correctly identify root causes, and prevent issue recurrence.

(Support cases resolved ≤ 3 business days ÷ Total support cases) × 100; root-cause accuracy = (Cases with validated-correct root cause ÷ Total cases with RCA) × 100; recurrence = (Repeat cases with the same root cause ÷ Total resolved cases) × 100

≥ 95% of support cases resolved ≤ 3 business days; ≥ 99% correct root-cause identification; recurrence < 1%.

Monthly ITSM platform case records; RCA documentation

Yes

SLR-5.16 Training & Documentation

The Contractor shall deliver role-based training and documentation for UEM administrators and support personnel

(Personnel completing required role-based training ≤ 30 days of role

Role-based training and documentation delivered for all UEM administrator and support roles; ≥

Quarterly Learning management system (LMS) records;

Requirement Description Formula / Calculation Method Performance Requirement Reporting

Period Measurement Tool / Source Data

CI

and shall ensure timely completion of required training following role assignment.

assignment ÷ Total personnel assigned to covered roles) × 100

95% training completion ≤ 30 days of role assignment.

training completion rosters

SLR-5.17 Version-Controlled Documentation Changes

The Contractor shall maintain all operational documentation under version control and shall update change logs promptly following policy or image changes, ensuring documentation remains authoritative and auditable.

(Policy/image changes with change log updated ≤ 5 business days ÷ Total policy/image changes) × 100

100% of documentation is maintained under version control; change logs updated ≤ 5 business days after policy or image changes.

Monthly Document repository version history; change management records

No

6. Definitions and Acronyms

Term Definition

CI Continual Improvement

DaaS Device-as-a-Service

D-X Decennial-as-a-Service

EDR Endpoint Detection and Response

ITSM Information Technology Service Management

MSI Managed Services Integrator

RCA Root-Cause Analysis

SBOM Software Bill of Materials

SLA Service Level Agreement

SLR Service Level Requirement

UEM Unified Endpoint Management

USCB United States Census Bureau

D-X Service Level Requirements v0.2 · Page 13