Attachment C-Service Level Agreements.docx

DOCX document 34 KB Posted

Attached to
MyFloridaNet-3 ITN
Solicitation number
ITN-16760
Issued by
Florida

About this file

MyFloridaNet-3 Service Level Agreements Summary

This is a Service Level Agreements (SLA) document for the MyFloridaNet-3 Invitation to Negotiate (ITN No. DMS-26/27-025) issued by the Florida Department of Management Services (DMS). The document establishes comprehensive performance standards and financial consequences for a statewide network services contract covering internet access, WAN connectivity, operational services, VPN infrastructure, SD-WAN/SASE capabilities, security services, DDoS mitigation, and cloud transport services. The SLAs apply to both new service installations and migrations from existing contracts, with specific performance targets ranging from 99.99% uptime for internet access to defined response times for security incidents, configuration changes, and installation activities. The contract term includes a six-month infrastructure readiness period and an 18-month migration completion window for transitioning all existing sites and services to the new MFN-3 infrastructure.

The SLAs establish financial consequences for non-performance structured as monthly credits ranging from $20,000 for brief internet outages to $5,000 per day for delayed infrastructure readiness and migration activities. Performance metrics include internet availability at 99.99% uptime, WAN latency not exceeding 40 milliseconds, packet loss limited to 1% monthly, and operational delivery times ranging from two hours for CPE configuration changes to 45 calendar days for new service installations. Security-focused SLAs require incident identification within two hours, notification within 15 minutes, and DDoS mitigation within 10-15 minutes depending on deployment location. The contractor is responsible for monitoring and reporting SLA compliance through the CSAB system and contractor ticketing systems, with DDoS attacks and high utilization scenarios (75% or greater) providing exemptions from certain performance degradation violations. Credits accumulate on a daily or hourly basis depending on the specific SLA category and are issued monthly until the performance target is met and validated through the SLA scrubbing process.

View the file

Other files

File Type Posted
FORM 12-PUR 1355-FOREIGN COUNTRY OF CONCERN ATTESTATION.pdf PDF
FORM 05–MANDATORY RESPONSIVENESS REQUIREMENTS.pdf PDF
Attachment E-Reply Format.pdf PDF
Attachment D MFN-3_Business Case_9.06.24 FINAL.pdf PDF
Attachment N-Negotiator Scoring Sheet.pdf PDF
Attachment I-Technical Reply.docx DOCX document
FORM 06–QUALIFICATIONS & EXPERIENCE QUESTIONNAIRE.docx DOCX document
Attachment F-Technical Reply Instructions.pdf PDF
FORM 09-PUR 2024_USE OF COERCION FOR LABOR AND SERVICES.pdf PDF
Attachment A Statement of work.pdf PDF
Attachment M-Points Table.pdf PDF
FORM 10-CERTIFICATION OF DRUG-FREE WORKPLACE PROGRAM.pdf PDF
Attachment O-Price Evaluation Workbook.xlsx XLSX spreadsheet
MFN-3 ITN DMS 2627-025.pdf PDF
Attachment H-Staffing Plan Worksheets.xlsx XLSX spreadsheet
Attachment B-Draft Contract.docx DOCX document
FORM 14-PUR 2023-PROVISION OF COMMODITIES PRODUCED BY FORCED LABOR.pdf PDF
Attachment G-Instructions for Cost Reply Price Workbook.pdf PDF
FORM 02-NOTICE OF CONFLICT OF INTEREST.pdf PDF
Attachment K-Cost Reply Price Workbook.xlsx XLSX spreadsheet
Attachment J-Evaluator Scoresheet.xlsx XLSX spreadsheet
FORM 11-NON-COLLUSION CERTIFICATION.pdf PDF
FORM 03-SUBCONTRACTING.pdf PDF
FORM 01–CONTACT INFORMATION.pdf PDF
Attachment L-Evaluator Instructions-Technical Reply.pdf PDF
FORM 08-PUR 7801 VENDOR CERTIFICATION FORM.docx DOCX document
FORM 07–CLIENT REFERENCE FORM.pdf PDF
FORM 13-PUR 1808-COMMON CARRIER OR CONTRACTED CARRIER ATTESTATION.pdf PDF
FORM 04-STATEMENT OF NO PRIOR DISQUALIFYING INVOLVEMENT.pdf PDF
Show all 29

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

MyFloridaNet–3 ITN No: DMS-26/27-025 Attachment C - Service Level Agreements

#
SLA Requirements
Performance Target
Financial Consequence for non-performance
SLA Details, Measurement and Performance Criteria

Internet Access Availability

1
Internet Access Availability: the amount of time Internet Access is accessible to the customers.
99.99% Uptime
5 minutes - 30 minutes downtime = $20,000

31 minutes - 60 minutes downtime = $60,000 61 minutes - 120 minutes downtime = $150,000 Every additional hour of downtime past 120 minutes will incur an additional $50,000

Each IAG probe will poll six (6) DMS provided Internet Hosts once every sixty (60) seconds. The intention is to measure the IAGs ability to access the internet while traversing all IAG infrastructure. A poll is defined as “HTTP GET”. Loss of connectivity to all six (6) Internet Hosts from any IAG probe specific to each Internet facing VRF would indicate a test failure. This test failure will trigger an alert in the alert monitoring system and will be maintained for SLA scrubbing calculations. Test failures will be used to calculate the total amount of downtime per month.

An SLA violation occurs when Internet access is not restored or converged to an alternate infrastructure within the applicable performance target. Test failures can be caused by any device in the critical path to the Internet. This includes but is not limited to:

• Failure of any component between the probe and the Internet gateway facility

• Configuration errors

• Poor engineering or design

• Line card failures

• Firewall devices and services

• Virus/Malware Signatures not updated

• Intrusion Detection System devices

• Domain Name Servers (DNS) failure

• Content filtering services

• Lack of default route

In addition, test failures recorded during an event that the loss of internet access availability is determined, via the mitigation process, to be the result of a DDoS attack, will not be calculated as a failed test. In this event, the “Initiate Mitigation of DDoS Attack” SLA would apply.

WAN - Last Mile Local Loop Access and CPE Availability and Performance Degradation

2
Local Loop Access availability: the amount of time the local loop access is accessible to the customer.

On a monthly basis, WAN Access will be maintained for each Customer end site at the minimum acceptable available level of 99.99%

5 minutes - 30 minutes downtime = 10% MRC 31 minutes - 60 minutes downtime = 20% MRC 61 minutes - 120 minutes downtime = 30% MRC 121 minutes - 240 minutes downtime = 40% MRC 241 minutes - 480 minutes downtime = 50% MRC 481 minutes or higher downtime = 100% MRC

CPE and local loop access availability measurement test will be performed. The CPE will be polled every 5 minutes. One missed poll will indicate a test failure. This test failure will trigger an alert in the alert monitoring system and will be maintained for SLA scrubbing calculations. Test failures will be used to calculate downtime per month.

An SLA violation occurs when the total monthly downtime exceeds the applicable performance target.

3
Latency (performance degradation): the round-trip delay across the local loop.

Jitter (performance degradation): the delay variation in the time between packet arrivals across the local loop.

Average Latency will be less or equal to 40ms round trip.

Average Jitter will be less than or equal to 10ms round trip.

60 minutes - 120 minutes exceeding performance target = 10% MRC 121 minutes - 240 minutes exceeding performance target = 20% MRC 241 minutes - 480 minutes exceeding performance target = 30% MRC 481 minutes or longer exceeding performance target = 50% MRC

Latency and jitter measurement tests will be performed and measured for the local loop. Performance degradation will not trigger an SLA violation if the local loop access utilization is greater than or equal to 75%. Performance degradation tests will be repeated every 5 minutes. Test results that exceed the performance targets will indicate a test failure. This test failure will trigger an alert in the alert monitoring system and will be maintained for SLA scrubbing calculations. Test failures will be used to calculate performance degradation per month.

An SLA violation occurs when the performance degradation exceeds the applicable performance target.

4
Packet Loss (performance degradation): the percentage of packets lost as data is traveling across the local loop.

Packet Loss will be less than or equal to 1% per month

1-2% packet loss = 10% MRC 2-3% packet loss = 20% MRC 3-4% packet loss = 30% MRC 4-5% packet loss = 40% MRC Greater than 5% packet loss = 50% MRC

Packet Loss measurement tests will be performed and measured for the local loop. Performance degradation will not trigger an SLA violation if the local loop access utilization is greater than or equal to 75%. Performance degradation tests will be repeated every 5 minutes. Test results will be maintained for SLA scrubbing calculations.

Operational

5
Operational Installation, Move, Add, Change (IMAC) - (Service Order)

Complete within 45 calendar days from services order submission.

Credit of $150 per calendar day, for each service not delivered not completed within the applicable performance target.

This Operational IMAC SLA is only applicable to new sites/connections/services installed under the MFN-3 contract, not those sites/connections/services that are migrating from the current Contracts to MFN-3.

An SLA violation occurs when the Operational IMAC is not completed within the applicable performance target.

The SLA clock starts on day 46. Credits will be issued every calendar month until the SLA clock stops.

The SLA clock start and stop timestamps will be documented in CSAB. CSAB system will be the book of record for timestamps and order issuance to the Contractor.

The SLA clock stops when all criteria have been met in the "Criteria for IMAC signoff and billing start" subsection of the "Miscellaneous Conditions" section of the Statement of Work, 2.17.20

6
Operational Installation, Move, Add, Change (IMAC) - (CPE Configuration Change requests)

Complete changes in 2 hours or less (at the rate of up to 6 devices in a 2 hour window)

Credit of $50 per hour beyond the performance target.

An SLA violation occurs when the CPE configuration change is not completed within the performance target.

CPE configuration changes will be reported in the Contractor's trouble ticketing system with the SLA clock start and stop time stamps.

The SLA clock will start when the trouble ticket is created within the Contractor's trouble ticketing system. Customers are only required to submit one ticket.

The SLA clock will stop when the changes are complete, and the Contractor's NOC ticket is closed.

The SLA requirement of two hours per request will be increased in two-hour increments per multiple of six devices.

7
Service Availability Check (Service Inquiry) - Check availability of facilities from Contractor's facility to customer's premises

Complete within 10 calendar days

Credit of $100 per calendar day, for each customer end-site request not complete within the performance target.

Credit is not capped.

This SLA is only applicable to new sites/connections/services installed under the MFN-3 contract, not those sites/connections/services that are migrating from the current Contracts to MFN-3.

Service availability check for local loop facilities will be completed by Contractor; this process takes place in CSAB before DMS submits a service order to the Contractor.

An SLA violation occurs when the service availability check results are not completed and provided to DMS within the applicable performance target.

The SLA clock starts with the official statement to the Contractor through the CSAB system. The SLA clock stops when the service availability check results have been completed and provided to DMS. The Contractor shall provide the results of the service availability check to DMS through the CSAB system.

8
Facility Installation Date for orders that require Special Construction

Provide the number of calendar days and cost to complete the service order with facility installation within 7 calendar days of the Service Availability Check results.

Credit of $100 per calendar day, for each request not complete within the performance target.

Credit is not capped.

This SLA is only applicable to new sites/connections/services installed under the MFN-3 contract, not those sites/connections/services that are migrating from the current Contracts to MFN-3. The Contractor shall provide the number of calendar days to complete installation of the facility.

This SLA will only apply if the "Service Availability Check" SLA results indicate that special construction is required to build-out facilities. The Operational IMAC SLA (Service Order) will apply in cases where there are no special construction involved. .

An SLA violation occurs when the Facility Installation Date is not provided by the Contractor to DMS within the applicable performance target.

The SLA clock starts once the results of the Service Availability Check are complete and provided to DMS. The SLA clock stops when the Facility Installation Date is provided to DMS. The Contractor shall provide the Facility Installation Date to DMS through the CSAB system.

9
Operational Installation, Move, Add, Change (IMAC) - (Service Change)

Complete within 15 calendar days

Credit of $100 per calendar day, for each customer end-site service change not complete within the applicable performance target.

Disconnect of services is not considered an IMAC.

These changes are initiated through the CSAB system, not the Contractor's NOC ticketing system. This SLA applies to the following list of change types:

1) CPE upgrade on existing local loop access

2) CPE module upgrade on existing CPE

3) Extension of the Demarcation on existing service within the same building

4) Bandwidth upgrade/downgrade on existing local loop access.

5) Establishing optional features such QoS, Multicast, and Encryption on existing service that requires DMS service order.

An SLA violation occurs when an applicable change is not completed within the applicable performance target.

The SLA clock will start when the Contractor receives a complete and accurate service order from DMS. The SLA clock will not restart for any reason once the service order is submitted to the Contractor. However, the SLA clock will be suspended for any of the DMS approved SLA hold time reasons.

The SLA clock start and stop timestamps will be reported in CSAB. CSAB system will be the book of record for timestamps and order issuance to the Contractor.

The SLA clock stops when all criteria have been met in the "Criteria for IMAC signoff and billing start" subsection of the "Miscellaneous Conditions" section of the Statement of Work 2.21.24.

10
Operational Installation, Move, Add, Change (IMAC) – (Service orders that require Special Construction)

Complete the service order within the number of calendar days specified in the results provided by the Contractor in response to the Facility Installation Date SLA requirement.

Credit of $100 per calendar day, for each customer end-site service order not complete within the applicable performance target.

Credit is not capped.

This Operational IMAC SLA will apply if special construction is required to build-out facilities. Disconnect of services is not considered an IMAC.

An SLA violation occurs when this Operational IMAC is not completed within the performance target.

The SLA clock starts when the Contractor receives a complete and accurate service order from DMS. The SLA clock will not restart if the Contractor rejects the service order. However, the SLA clock can be suspended for any of the DMS approved SLA hold time reasons.

The SLA clock start and stop timestamps will be reported in CSAB. CSAB system will be the book of record for timestamps and order issuance to the Contractor.

The SLA clock stops when all criteria have been met in the Statement of Work, Section 2.21, Criteria for IMAC signoff and billing start" subsection 2.21.24.

11
Timely Invoicing

All invoices will be complete, accurate and electronically posted to the DMS site within 10 calendar days of the invoice date.

Credit of $250 per calendar day until all invoices are posted

An SLA violation occurs if the Contractor has not submitted all invoices within the applicable performance target.

The Contractor's billing cycle starts on the first day of each calendar month and ends the last day of the same calendar month, unless alternative monthly billing cycle dates are mutually agreed upon.

The SLA violation will start on the 11th calendar day of the billing cycle and stop when all invoices have been electronically posted to DMS. To ensure coordination, the Contractor will provide an email notification of the posting and DMS will immediately provide an official statement of the receipt of the billing invoices.

12
Timely Correction of Billing Issues and Adjustments

Resolve billing issues and post invoice adjustments by the next billing cycle.

Credit of $5,000 per billing cycle beyond the performance target

An SLA violation occurs if the Contractor has not resolved all billing issues and provided all billing adjustments within the applicable performance target. The Contractor will apply all billing adjustments on the following monthly invoice.

The Contractor's billing cycle starts on the first day of each calendar month and ends the last day of the same calendar month, unless alternative monthly billing cycle dates are mutually agreed upon.

Within 15 days of receiving an invoice, DMS will provide the Contractor with a written statement detailing all billing issues. The Contractor must resolve all billing issues and post adjustments by the end of the billing cycle

This SLA shall not be waived if there is a delay in providing a timely invoice.

13
Functionality and availability of Network Management Systems, security monitoring tools and other tools that support MFN-3 services. These tools will collectively be referenced as NMS tools.

Outage, degradation or functionality restored within 4 hours.

Credit of $100 per hour beyond the performance target.

The Contractor will be responsible for credits if there are performance issues with the Network Management Systems tools.

An SLA violation occurs when functionality, degradation, or outage of any NMS component is not restored to normal operation within the applicable performance target. All NMS tools must be monitored for proper functionality including up and down status and reported to DMS. It is still considered an outage even if the NMS tool is up but the customer cannot access the portal to view the tool.

The contractor is required to monitor the NMS tools. The SLA clock start and stop times are based on timestamps in the alert monitoring system and validated in the scrubbing process. The SLA clock will stop once the NMS tool has been restored.

14
RFO Requests

10 business days

$1,000 per day beyond 10 business days

In response to a request from DMS or the customer, after an issue has been mitigated, within a reasonable timeframe as defined by DMS in SLAs, the Services Provider NOC will publish a Reason for Outage report to CSAB in sufficient detail to allow DMS and the Services Provider to take actions as lessons learned.

An SLA violation occurs with the passing of 10 business days without RFO report submitted to DMS and/or customer.

15
Annual Failover Testing

Complete failover testing of all dedicated components and services under MFN-3 every calendar year between April 1st and May 30th. Any issues resulting from failover testing must also be remediated between April 1st and May 30th of the same calendar year.

Credit of $500 per calendar day, for failover testing and remediation of issues not completed for all dedicated components and services by the performance target.

An SLA violation occurs when the failover testing of all dedicated components and services under MFN-3 are not completed along with remediation of issues by the performance target. A detailed step-by-step process and procedure must be provided before beginning the failover test.

The SLA clock stops once the failover testing for all dedicated components and services under MFN-3 has been completed and remediation of issue(s) have been resolved with DMS approval via an email.

The SLA clock start and stop times shall be validated through CSAB.

See Section in SOW for details and applicability related to COOP and Failover testing plan.

16
Connections/Link Utilization

Connections/Links usage will not exceed 60% average utilization between 8AM to 5PM EST for five (5) consecutive business days.

Credit of $1,000 per calendar day that Connections/Links utilization is above 60% to 70% utilization

Credit of $5,000 per calendar day that Connections/Links utilization is above 70% utilization

The applicable link types for this SLA are Backbone, Aggregate, and Transit.

An SLA violation occurs when the Connections/Links Usage is not corrected within the applicable performance target.

The SLA clock starts once the performance target has been exceeded on the applicable link. Credits will be issued every calendar month until the SLA clock stops.

The SLA clock stops once the usage has been normalized to 60% or lower.

The SLA clock start and stop times shall be validated from the monitoring system.

See section in SOW related to Connections/Links Utilization for details and applicability.

17
Remedy Identified Staff Deficiencies

Contractor must remedy the Department identified staffing deficiencies within 90 calendar days of receipt of notice.

Credit of $250 per calendar day that the Contractor does not remedy staffing deficiencies beyond 90 days for each deficiency.

The SLA clock starts upon Contractor's receipt of a written notice from the Department identifying staffing deficiencies and stops when Contractor demonstrates to the Department the position is filled. The SLA clock is on hold in the event the Department invokes its right to review and approve a candidate to fill a vacant key staff position.

18
Evaluation of equipment for the Approved CPE list

60 days

On day 61 a penalty of $200 will be incurred.

Credit of $200 per week, for each evaluation not complete within the performance target.

The SLA clock starts after the performance target is exceeded. Credits will be issued every calendar month until the SLA clock stops.

The SLA clock stops when a determination has been made and response has been provided to DMS based on the CPE evaluation results.

Remote Access VPN Service

19
Centralized VPN Appliance

Outage restored within 1 hour, with time increments of 1 hour

Credit of $2,500 per hour if outage is greater than 1 hour

The SLA violation measurement tool shall log all SLA violations and automatically send an electronic notification(s) for all service issues. The SLA clock start and stop time are based on timestamps in the alert monitoring system.

An SLA violation occurs if any portion of the VPN IP connectivity path provided by the Contractor is unavailable. The SLA violation measurement timer shall start five minutes after the Centralized VPN service is interrupted and continue five minutes after the service restoration.

The SLA monitoring solution must verify that all VPN service components and their dependencies are functional; supporting VPN connectivity as configured for both the stateside and the remote side if the remote site is a Contractor provided VPN appliance. IP connectivity to the remote site VPN appliance must be monitored for all possible service anomalies.

20
Remote site VPN Appliance

Outage restored within one calendar day for in-state and two calendar days for out-of-state with both (in-state and out-of-state) time increments of 1 day.

Credit of $25 per impacted end-site per calendar day if outage is greater than one calendar day for in-state. Credit of $25 per impacted end-site per calendar day if outage is greater than two calendar days for out-of-state.

The SLA violation measurement tool shall log all SLA violations and automatically send an electronic notification(s) for all service issues. The SLA clock start and stop time are based on timestamps in the alert monitoring system.

An SLA violation occurs if any portion of the VPN IP connectivity path provided by the Contractor is unavailable. The SLA violation measurement timer shall start five minutes after the Centralized VPN service is interrupted and continue five minutes after the service restoration.

The SLA monitoring solution must verify that all VPN service components and their dependencies are functional; supporting VPN connectivity as configured for both the stateside and the remote side if the remote site is a Contractor provided VPN appliance. IP connectivity to the remote site VPN appliance must be monitored for all possible service anomalies.

21
Centralized VPN Service Hardware Components

CPU and RAM Memory 70% Utilization

Credit of $100 per day starting on the 61-day and each day thereafter until the system element has been upgraded

The SLA violation measurement tool shall log all SLA violations and automatically send an electronic notification(s) for all service issues. The SLA clock start and stop time are based on timestamps in the alert monitoring system.

The SLA monitoring solution must verify that all VPN service components and their dependencies are functional; supporting VPN connectivity as configured for both the stateside and the remote side if the remote site is a Contractor provided VPN appliance. IP connectivity to the remote site VPN appliance must be monitored for all possible service anomalies.

An SLA violation occurs if CPU and RAM Memory 70% Utilization: During normal operation over any five (5) minute period a system element reaches seventy percent (70%) of CPU capacity or RAM memory utilization, the Service Provider shall upgrade that element within 60 days.

22
Centralized VPN IP Transport Circuits

Aggregation Circuit 70% Utilization

Credit of $1000 per day starting on the 61st day and each day thereafter until the aggregation circuit has been upgraded

The SLA violation measurement tool shall log all SLA violations and automatically send an electronic notification(s) for all service issues. The SLA clock start and stop time are based on timestamps in the alert monitoring system.

The SLA monitoring solution must verify that all VPN service components and their dependencies are functional; supporting VPN connectivity as configured for both the stateside and the remote side if the remote site is a Contractor provided VPN appliance. IP connectivity to the remote site VPN appliance must be monitored for all possible service anomalies.

An SLA violation occurs if aggregation Circuit 70% Utilization: The bandwidth capacity, of that connected, to the Centralized VPN solution shall be increased within 60-days, if over any five (5) minute period of normal operation, circuit utilization exceeds seventy-percent (70%) of total circuit throughput capacity.

SD-WAN/SASE

23
SD-WAN/SASE Control Plane (including all components responsible for establishing and maintaining logical connectivity and intelligence across the network, including but not limited to routing and policy enforcement)

Outage restored within 60 seconds, with time increments of 15 minutes

Credit of $5,000 per 15 minutes that a SD-WAN/SASE control plane is down starting at 61 seconds of downtime and continuing to accumulate every 15 minutes a SD-WAN/SASE control plane is down.

The SLA violation measurement tool shall log all SLA violations and automatically send an electronic notification(s) for all service issues. The SLA clock start and stop time are based on timestamps in the alert monitoring system.

An SLA violation occurs if any portion of the SD-WAN/SASE control plane is unavailable. The SLA violation measurement timer shall start five minutes after the SDWAN control plane is unavailable and continue five minutes after the service restoration.

The SLA monitoring solution must verify that all SD-WAN/SASE service components and their dependencies are functional; supporting SD-WAN/SASE connectivity as configured for both the stateside and the remote side if the remote site is a Contractor provided SD-WAN/SASE appliance. IP connectivity to the remote site SD-WAN/SASE appliance must be monitored for all possible service anomalies.

24
SD-WAN/SASE management plane

(including all components responsible for the overall administration, configuration, and monitoring of the network)

Outage restored within 1 hour, with time increments of 1 hour

Credit of $2,500 per hour if outage is greater than 1 hour

The SLA violation measurement tool shall log all SLA violations and automatically send an electronic notification(s) for all service issues. The SLA clock start and stop time are based on timestamps in the alert monitoring system.

An SLA violation occurs if any portion of the SD-WAN/SASE management plane is unavailable. The SLA violation measurement timer shall start five minutes after the SDWAN management plane is unavailable and continue five minutes after the service restoration.

The SLA monitoring solution must verify that all SD-WAN/SASE service components and their dependencies are functional; supporting SD-WAN/SASE connectivity as configured for both the stateside and the remote side if the remote site is a Contractor provided SD-WAN/SASE appliance. IP connectivity to the remote site SD-WAN/SASE appliance must be monitored for all possible service anomalies.

Security

25
Security Incident Identification

Identification within 2 hours

Credit of $1,500 if SLA violation continues beyond the performance target.

Credit applies for each 1 hour increment.

The contractor shall analyze all security alerts to determine which alerts constitute a reportable security notification. The contractor must create a security incident within 2 hours of any alert that is deemed reportable excluding DDoS mitigation (see Initiate Mitigation of DDoS Attack).

If reportable security notifications are sent after hours, the SOC must follow-up the next working day with customer with reportable notification.

The analysis and documentation part of the reporting notification must be detailed for the customer to understand the security threat.

Justify why alerts are not deemed reportable. As part of the scrubbing process, Services Provider provide document listing reportable and non-reportable alerts. This document shall include a criteria outlining what deems an alert reportable or non-reportable.

26
Security Incident Notification

Notification within 15 minutes of the Security Incident Identification end time

Credit of $1,500 if SLA violation continues beyond the performance target.

Credit applies for each 1 hour increment.

The Contractor shall notify DMS and the Customer via email to authorized users when a critical security event that represents a security incident or threat to the Customer, within the performance target timeframe.

The SLA clock starts when the performance target is not met.

An SLA violation occurs when the amount of time between the Security Identification end time and the notification of DMS and the Customer exceeds 15 min.

27
Mitigation of DDoS Attack

Redirect traffic to DDoS Mitigation Service within 15 minutes for cloud mitigation or 10 min for on premises mitigation.

Credit of $5,000 if SLA violation continues beyond the performance target.

Credit applies for each 1 hour increment.

Upon receipt of an alert from DDoS mitigation infrastructure of a DDoS attack affecting Internet access or MFN-3 hosted application availability, a DDoS attack ticket is opened to track the event through the mitigation process.

An SLA violation occurs when the amount of time between receipt of a DDoS alert and the initiation of the mitigation (redirecting traffic to DDoS mitigation service) exceeds the performance target.

The DDoS mitigation or alert system being unavailable or misconfigured does not relieve the contractor of this SLA.

28
Security Vulnerability or Zero-Day exploit of Software/Firmware

Mitigate software/firmware vulnerability within 7 calendar days of approval from DMS

Core Infrastructure: Credit of $500 per device if SLA violation continues beyond the performance target.

CPE: Credit of $25 per device if SLA violation continues beyond the performance target.

Credit applies for each 1 day increment.

When a manufacturer publishes a security vulnerability for software or firmware, it must immediately be reported to DMS. DMS will decide as to whether to approve or deny moving forward with manufacturers recommendations for upgrade or mitigation. If DMS approve the upgrade, the SLA timer starts for the implementation of recommended mitigation actions of all affected components.

An SLA violation occurs when the announced vulnerability is not mitigated within the performance target.

This SLA applies to any equipment/component that supports MFN-3 services including CPE.

If the number of vulnerable CPE devices is deemed to be excessive by DMS then the allotted performance target for mitigation can be adjusted.

29
DDoS Hardware Availability (On Prem)

Outage restored within 1 hour, with time increments of 1 hour

Credit of $1,000 if SLA violation continues beyond the performance target.

Credit applies for each 1 hour increment.

The contractor is required to monitor the DDoS infrastructure and associated components.

An SLA violation occurs when functionality, degradation, or outage of any DDoS infrastructure component is not restored to normal operation within the applicable performance target. All DDoS infrastructure components must be monitored for proper functionality including up and down status and reported to DMS.

The SLA clock starts when the performance target is not met.

The SLA clock stops once the DDoS infrastructure has been stabilized and verified functional.

The SLA clock start and stop times shall be validated as part of the scrubbing process, using a combination of tools such as the Contractor's NOC ticket and the logs from the alert monitoring system.

30
DDoS Service Availability (Cloud Hosted)

Outage restored within 1 hour, with time increments of 1 hour

Credit of $1,000 if SLA violation continues beyond the performance target.

Credit applies for each 1 hour increment.

The contractor is required to monitor the DDoS infrastructure and associated components.

An SLA violation occurs when functionality, degradation, or outage of any DDoS infrastructure component is not restored to normal operation within the applicable performance target. All DDoS infrastructure components must be monitored for proper functionality including up and down status and reported to DMS.

The SLA clock starts when the performance target is not met.

The SLA clock stops once the DDoS infrastructure has been stabilized and verified functional.

The SLA clock start and stop times shall be validated as part of the scrubbing process, using a combination of tools such as the Contractor's NOC ticket and the logs from the alert monitoring system.

Migration

31
MFN-3 Services Infrastructure is fully functional, and the network is ready for migration of individual circuits, representing the "Services Readiness Date."

MFN-3 Services Infrastructure readiness 6 months after contract execution.

A credit of $5,000 per calendar day beyond 6 months from the Services Provider contract execution, until DMS agrees that the Services Readiness Date has been achieved per the terms of the MFN-3 Services Contract.

All required tasks on the MFN-3 Services Infrastructure checklist listed in the Scope of Work must be implemented, successfully tested, or otherwise approved by DMS before the Services Provider is permitted to migrate any sites to the MFN-3 infrastructure.

The SLA clock will start on the date the MFN-3 Services contract has been executed.

An SLA violation occurs if the MFN-3 Services Infrastructure checklist is not completed within the performance target.

32
Endsite and service migration completion

18 months from the MFN-3 Services Infrastructure checklist acceptance date.

Credit of $15,000 per calendar day until migration of all sites/connections/services are completed and accepted by DMS.

The Services Provider is responsible for the migration of all sites/connections/services off the current contract.

The SLA clock start time is the MFN-3 Services Infrastructure checklist acceptance date.

An SLA violation occurs if all sites/connections/services are not complete and accepted by DMS within the performance target.

Cloud Transport Services

33
Customer EVC Availability: the amount of time the EVC path is accessible to the Customers.

Outage restored within 4 hours, with time increments of 4 hours

Credit of $150 per impacted Customer EVC if outage continues beyond 4 hours.

Credit applies for each 4 hour increment.

An SLA violation occurs when the availability is not restored within the applicable performance target. The SLA clock stops once the impacted Customer is no longer impacted.

The SLA clock start and stop times shall be validated part of the scrubbing process using a combination of tools such as the Service Provider's NOC ticket and the logs from the alert monitoring system. Routing protocol adjacency messages shall be used for SLA start and stop times. Connections that do not use dynamic routing protocols will not be subject to this SLA.

MAN and Offnet DIA

34
Service Availability: The amount of time the service is available for customer use.

On a monthly basis, service availability will be maintained for each customer end site at the minimum acceptable available level of 99.99%

5 minutes - 30 minutes downtime = 10% MRC 31 minutes - 60 minutes downtime = 20% MRC 61 minutes - 120 minutes downtime = 30% MRC 121 minutes - 240 minutes downtime = 40% MRC 241 minutes - 480 minutes downtime = 50% MRC 481 minutes or higher downtime = 100% MRC

Service availability measurement tests will be performed. The service availability will be checked at regular intervals. One missed check will indicate a test failure. This test failure will trigger an alert in the alert monitoring system and will be maintained for SLA scrubbing calculations. Test failures will be used to calculate downtime per month.

An SLA violation occurs when the total monthly downtime exceeds the applicable performance target.

35
Latency (performance degradation): the round-trip delay across the local loop.

Jitter (performance degradation): the delay variation in the time between packet arrivals across the local loop.

Average Latency will be less or equal to 40ms round trip.

Average Jitter will be less than or equal to 10ms round trip.

60 minutes - 120 minutes exceeding performance target = 10% MRC 121 minutes - 240 minutes exceeding performance target = 20% MRC 241 minutes - 480 minutes exceeding performance target = 30% MRC 481 minutes or longer exceeding performance target = 50% MRC

Latency and jitter measurement tests will be performed and measured for the service. Performance degradation will not trigger an SLA violation if the service utilization is greater than or equal to 75%. Performance degradation tests will be performed at regular intervals. Test results that exceed the performance targets will indicate a test failure. This test failure will trigger an alert in the alert monitoring system and will be maintained for SLA scrubbing calculations. Test failures will be used to calculate performance degradation per month.

36
Packet Loss (performance degradation): the percentage of packets lost as data is traveling across the local loop.

Packet Loss will be less than or equal to 1% per month

1-2% packet loss = 10% MRC 2-3% packet loss = 20% MRC 3-4% packet loss = 30% MRC 4-5% packet loss = 40% MRC Greater than 5% packet loss = 50% MRC

Packet Loss measurement tests will be performed and measured for the service. Performance degradation will not trigger an SLA violation if the service utilization is greater than or equal to 75%. Performance degradation tests will be performed at regular intervals. Test results will be maintained for SLA scrubbing calculations.

File details come from the government source that posted it. Updated .