Attachment F Service Level Agreements The Illinois Department of Transportation (IDOT/Agency) has a set expectation for the performance and service level provided by the Offeror. This section defines both required (mandatory) service level elements for the APMS RFP as well as base draft requirements to be finalized during negotiations. Offerors’ proposal for Service Level Agreement will be evaluated within the mandatory with evidence review to determine Award.

The Agency and Offeror must establish one or multiple Service Level Agreements (SLAs) for all the service areas identified in sections 1 through 10 of this Attachment F. For all service areas, the SLA must include a description and definitions of the service; roles and responsibilities; and reporting requirements. For some service areas the SLA may also include service level objectives (SLO), service qualitative objectives (SQO), metrics, monitoring, remedies and/or penalties. The Agency requires all SLAs to be specific and detailed enough to define expectations for the service area, have clearly defined measure(s) of the service, be achievable by the offeror, be relevant to evaluating performance against the goal of the service, and specific to the time frame in-which the service will be delivered.

All Service Level Agreements will be reviewed on an annual basis for performance against existing Service Level Objectives and Service Qualitative Objectives. The SLAs will also be reviewed for effectiveness in benefitting the Agency.

For each of the service areas identified in sections 1 through 10 of this Attachment F, MANDATORY SLA elements including reporting requirements, SLOs, SQOs, metrics, monitoring, remedies, or penalties – are shown in black, underlined, italicied text. All other information within this Attachment F is presented for informational purposes to provide guidance to Offerors on the structure, content and scope of Service Level Agreements (SLA) that IDOT will negotiate and enter.

1. SUPPORT MANAGEMENT

1.1. Service Description

Offeror must provide support to the Agency 24 hours a day, 7 days a week, 365 days a year. Service must be available to enable the Agency to provide often critical services. Service Desk Support is essential during designated business hours as indicated below. Support for service is grouped into two tiers:

· Tier 1-Operations Application Support Team - The Service Level Targets are solely maintained and managed by the Agency.

· Tier 2-Offeror Support. For the purposes of this publication, the Offeror is responsible for only Tier 2-Offeror Support Service Level Targets. Tier 2-Offeror Support SLAs are as per needs of the Agency. Tier 2-Offeror Support Service must provide the following:

Service desk operations Offeror must provide application monitoring 24x7x365. The offeror proactively monitors the application and checks for issues. Issues are reported to the agency upon discovery.

Offeror must provide technical application support 24x7x365. Contact information for a dedicated technical support representative (phone/email) must be provided.

Service Desk support must be readily available during regular business hours of 7:00 AM to 5:00 PM CDT/CST, Monday through Friday. Service Desk must provide emergency support outside the designated hours for critical requests. Offeror’s Service Desk must have a published policy for support request management, defect handling, recurring issues identification and escalation procedures, outage resolution and disaster recovery. Service Desk must support the complete service including standard and customer specific configurations or customizations and reporting as implemented by Offeror and updated by future releases. Service Desk must provide multiple methods of communication including online access to requests. Service Desk outages or planned downtimes should be in line with the service support and availability SLA. Service Desk must also provide access to the Agency’s service, tickets, and/or outage data and details for report creation and data export.

1.2. Roles and Responsibilities

When the Agency requests Tier 2-Offeror Support for an identified issue (Request), the Agency shall clearly and reasonably classify the Severity Level of a request (Request Severity Level). The Offeror may ask the Agency to reclassify the Request Severity Level, if it reasonably believes that the Agency’s classification is incorrect. However, the Agency shall be under no obligation to change the Severity Level of the Request. Severity levels are defined in table 1.

Table 1: Tier 2-Offeror Support - Severity Level Definitions

1.3. Reporting Requirements

The Offeror will produce an analytical dashboard view or equivalent reports for two monthly reports regarding Tier 2-Offeror Support.

1.3.1. Monthly Service Support SLA Performance Report/View

Table 2: Monthly Service Support SLA Performance Reporting Overview

Table 3: Example Monthly Service Support SLA Performance Reporting

Cause

Mitigation

1.3.2. Monthly Service Support Severity Level 1 & 2 Root Cause Analysis Table 4: Monthly Service Support Severity Level 1 & 2 Root Cause Analysis Overview

Each Root Cause Analysis will include:

· Date and time of the incident

· Description of the impact of the incident

· Timeline of events related to the incident including the first report, notifications sent, investigation steps, findings, and close date and time

· Identified Recurrence based on historic cases

· Final determination of the root cause

· Mitigation plan for the root cause identified All Root Cause Analysis’ must be accepted by the Agency. The Agency may reject a Root Cause Analysis due to incompleteness, inaccuracies, or an unacceptable mitigation plan.

1.4. Service Level Objectives/Service Qualitative Objectives

Severity Level SLO - Tier 2-Offeror Support Service Level Targets The following activities shall be conducted within the timeframes designated in table 5, given the Agency’s classification of Request Severity Level:

Upon receipt of a Tier 2-Offeror Support request, the Offeror will respond to the Agency Tier 1-Operations Application Support team. The response must include an estimated issue resolution time for the request and outline escalation steps. The Offeror will provide status update to the Agency Tier 1-Operations Application Support team.

Table 5: Tier 2-Offeror Support - Response and Resolution Times

1.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

1.6. Remedies or Penalties

A Request is considered and reported as failing to meet the Tier 2-Offeror Support SLA if the Response Time and/or the Resolution Time does not meet the time specified in table 5 given Agency’s classification of the Request Severity Level. SLA Performance for Tier 2-Offeror Support will be calculated for each Severity Level by dividing the number of Requests that do not meet the SLA for the Severity Level divided by the total number of tickets for the same Severity Level. Percent below 100% response and resolution times will necessitate review and identification of reason along with mitigation steps from Offeror.

2. SERVICE AVAILABILITY

2.1. Service Description

Service Availability represents the amount of time the Service and all components are available for use by the Agency. This requires critical components of the Service to be available 24 hours a day, 365 days a year, allowing for the most effective means to serve the needs of the Agency.

Users of the Service are required to make expedited decisions throughout their day. When users are unable to retrieve information quickly, they are forced to make decisions without appropriate amounts of information. The inability of a user to access timely information via the service can delay the provisioning of other critical state infrastructure services. This can lead to unfavorable outcomes. Service Availability SLAs are as per needs of the Agency.

2.2. Roles and Responsibilities

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

2.3. Reporting Requirements

The Offeror will produce an analytical dashboard view or equivalent reports for monthly service availability reporting.

Monthly Service Availability SLA Performance Report/View Table 6: Monthly Service Availability SLA Performance Reporting Overview

2.4. Service Level Objectives/Service Qualitative Objectives

Offeror will meet or exceed the Service Availability SLO Target defined as 99.9% up-time for the Service. See the below table for definitions of terms and calculations for the Availability Service Level Target.

Table 7: Service Availability - Service Level Target Definitions

The Agency provides scheduled maintenance windows to users at specified times, usually after 5:00 pm CST/CDT and on weekends. The Offeror must obtain approval in writing (email is allowed) from the Agency before downtime occurs. Planned Downtime outside of the Agency Maintenance Window will receive greater scrutiny by the Agency before approval and is less likely to be approved if downtime will impact critical functions or areas of the Agency.

2.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

2.6. Remedies or Penalties

The Service Availability Service Level is considered and reported as failing to meet the SLA if the Service Level Percentage is less than the Threshold Percentage (99.9%). A credit percentage of should be identified for services that fail to meet the requirement. Offeror will provide credits on the monthly billing statement if applicable. Example with 0.12% SLA Maintenance Fee Credit is provided below:

0.12% of the SLA Maintenance Fee for each tenth of a percent (0.1%) that the Service Level Percentage is less than the Threshold Percentage will be calculated for months failing to meet the SLA.

Compliance with the Service Threshold will be measured monthly, for example: This calculation is for a 30-day month. The Offeror scheduled 360 minutes of Planned Downtime. The Service experienced 150 minutes of Unplanned Downtime.

Table 8: Example - Service Availability Service Level Target Credit

3. INCIDENT RESPONSE

3.1. Service Description

In the event of service interruptions, offeror will need to outline the type of action that will be taken. SLAs should go into as much detail as necessary, defining such parameters as the categories of incidents and how providers will respond to each type of event. ITIL incident types and responses may serve as a basis for this section. This concerns the resolution of the incident, or alternately launching mitigation steps or invoking recovery or continuity procedures. There should be an integrated system to manage and monitor incidents, shared between the Agency, offeror and any involved third parties (such as subcontractors to the offeror) to avoid multiple entry of problems and inconsistencies in status reporting.

3.2. Roles and Responsibilities

· Offeror shall notify the Agency within 24 hours of any information breach or other security incident which impacts the State’s data.

3.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

3.4. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

3.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

3.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

4. SERVICE PERFORMANCE

4.1. Service Description

The goals of service performance are directly related to the efficiency and accuracy of service/system delivery by the offeror. Typical performance considerations include response time, load speed, concurrent users, and transaction processing speed; but they can include many other performance and system quality perspectives, such as accuracy, interoperability, scalability, serviceability, usability durability, and more.

4.2. Roles and Responsibilities

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

4.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

4.4. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

4.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

4.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

5. SERVICE MAINTENANCE

5.1. Service Description

Offeror must document critical security patch, maintenance patch and release management standards, identifying who applies those patches, sequence of application to non-production and production and notifications of any downtime if applicable or for required testing.

Offeror should document how it assures that Agency is always offered and maintained at the latest generally available supported version. Offeror should also provide guidance on user networking opportunities, conferences, customer features request programs, enhancement and maintenance program(s), customization(s) support or any Beta Programs offered to customers.

5.2. Roles and Responsibilities

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

5.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

5.4. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

5.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

5.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

6. DATA MANAGEMENT

6.1. Service Description

Offeror must document data management policies and practices in the areas of data storage, data access, data retention, data ownership and data disposal. The Agency requires data be kept for at least 10 years and other retention periods and disposition policy and/or legal requirements.

6.2. Roles and Responsibilities

· Offeror must ensure all hosted data pertinent to this contract remains located within the contiguous United States.

· Offeror must ensure that production data is not used outside of the production environment.

· Offeror must provide a copy of all data to the State without delay upon request by the State.

· Offeror must provide a copy of all data to the State prior to termination of contract.

· Offeror must ensure encryption of State of Illinois data at rest and in motion.

· Offeror must store data in a non-proprietary format or offeror must provide a solution to extract any State of Illinois data stored in the offeror’s solution.

6.3. Offeror must store data in a non-proprietary format or offeror must provide a solution to extract any State of Illinois data stored in the offeror’s solution.

6.4. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

6.5. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

6.6. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

6.7. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

7. INFORMATION SECURITY

7.1. Service Description

Offeror must document information security policies and practices in the areas of data protection, access controls, security audits, confidentiality requirements, and security breach identification and notification process. Offeror must ensure that all environments meet cybersecurity compliance standards and all environments must be made available to the State security team to conduct periodic reviews during the contract. Information security policies and practices must address protecting individual privacy and the handling and safeguards for Personally Identifiable Information (PII).

7.2. Roles and Responsibilities

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

7.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

7.4. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

7.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

7.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

8. SERVICE RELIABILITY

8.1. Service Description

Offeror must provide a disaster recovery methodology and provide proof of annual disaster recovery testing, including issues discovered and remediation plans for the issues discovered. Offeror should demonstrate capability to establish, maintain, and effectively implement plans for emergency response, backup operations, and post-disaster recovery for organizational information systems to ensure the availability of critical information resources and continuity of operations in emergency situations.

8.2. Roles and Responsibilities

· Offeror must maintain a robust and reliable data backup system. Offeror must supply a description of backup methodology and this methodology must define Recovery Point Objective (RPO), Recovery Time Objective (RTO), and Maximum Tolerable Downtime (MTD) requirements.

8.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

8.4. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

8.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

8.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

9. AUDITS & COMPLIANCE

9.1. Service Description

Offeror must certify it has undertaken independent third-party audit Statement on Standards for Attestation Engagements (SSAE-18) certifications and must provide the Agency with System Operation Controls report (SOC 2 type 2) annually and applicable or Bridge/Gap letter.

9.2. Roles and Responsibilities

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

9.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

9.4. Service Level Objectives/Service Qualitative Objectives

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

9.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

9.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

10. TERMINATION

10.1. Service Description

Offeror should document termination clauses outlining the requirements for ending the contract and service agreement. The SLA should specify post termination obligations, activities, and timelines as well as dictate the procedures for the Agency to be able to retrieve all Agency data. Termination clauses related to transition services to another offeror may also be specified.

10.2. Roles and Responsibilities

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

10.3. Reporting Requirements

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

10.4. Service Level Objectives/Service Qualitative Objectives If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

10.5. Service Metrics/Monitoring

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.

10.6. Remedies or Penalties

If applicable, negotiated between Agency and Offeror following contract award and prior to contract execution.