Attachment+B+-+Saas+Service+Level+Agreement.docx

Attachment B – Software as a Service (SaaS) Service Level Agreement (SLA) Offeror Note: If this is not a SaaS offering, this section does not apply and will be deleted.

CONTRACTOR represents and warrants that the services will be performed in a professional manner consistent with industry standards reasonably applicable to such services.

1. SaaS AVAILABILITY:

The SaaS shall be available twenty-four (24) hours per day, 365 days per year (excluding agreed-upon scheduled maintenance downtime).

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

SUPPORT AND ERROR RESOLUTION:

Offeror Note: Provide information in the Offeror Response to assist STATE in completing items in red font.

CONTRACTOR will respond to STATE requests for support services regarding the licensed software in accordance with the procedures identified below. In each case, STATE may describe and submit the problem by telephone, email or online helpdesk/service desk tool. STATE will determine the Severity level. The Severity level will not be changed unless agreed to by STATE and CONTRACTOR.

High Impact – System unusable

4 hours Describe escalation procedure

Medium Impact – System useable with severely restricted functionality or performance

8 hours (1 business day) Describe escalation procedure

Low Impact – system useable with minor impact on functionality or performance

40 hours (1 business week) Describe escalation procedure

CONTRACTOR’S failure to meet the above defined Response Times or Resolution Times in any given month during the term and any renewal term shall be deemed a service level default (“Service Level Default”) and STATE may obtain the non-exclusive remedies set forth below.

Response and Resolution Service Levels (calculated monthly on a per incident basis) Service Level Credit (Prorated Fees – Monthly)

In the event STATE is eligible for a 20% Service Level Credit under this section for any two (2) consecutive months of the term, STATE may terminate this Contract without penalty upon written notice to CONTRACTOR.

Credits shall be applied against the next invoice. In the event a Service Level Default occurs after a party has given notice of termination, or STATE has made final payment to CONTRACTOR for the software support services and no further invoices shall issue as a result, CONTRACTOR shall refund to STATE the amount of the appropriate Service Level Credit due for the period of default.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

AVAILABILITY SERVICE LEVEL:

CONTRACTOR’s failure to make the services available at least 99.9% of the time in any given month during the term and any renewal term, excluding scheduled maintenance, shall be deemed a service level default (“Service Level Default”) and STATE may obtain the non-exclusive remedies set forth below. For purposes of this Contract, “Available” means that STATE users are able to access all features and functions of the licensed product and services including, but not limited to the licensed software and licensed content.

In the event STATE is eligible for a 100% Service Level Credit under this section during any given month of the term or is eligible for a Service Level Credit greater than 10% in any two (2) months, during any rolling twelve (12) month period, STATE may terminate this Contract without penalty upon written notice to CONTRACTOR.

Credits shall be applied against the next invoice. In the event a Service Level Default occurs after a party has given notice of termination, or STATE has made final payment to CONTRACTOR for the software support services and no further invoices shall issue as a result, CONTRACTOR shall refund to STATE the amount of the appropriate Service Level Credit due for the period of default.

Once each calendar month during the term of this Contract, CONTRACTOR shall provide STATE with a written report comparing the actual performance of licensed product and services with the Service Level Requirement. Such report shall also contain such other information with respect to the performance of the licensed product and services as mutually agreed upon by the Parties from time to time, and in conformity with reporting CONTRACTOR provides to its other customers utilizing the licensed product and services.

STATE retains the right to use a Third-Party service to validate the CONTRACTOR’s performance meeting agreed upon service levels.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

RESPONSE TIME SERVICE LEVEL:

CONTRACTOR represents and warrants that ninety-five percent (95%) of all transactions shall process at a mutually agreed upon time threshold. STATE retains right to use a Third-Party service to validate the performance of CONTRACTOR’s response times.

If the CONTRACTOR’s System response times fall below the warranted level for two (2) or more consecutive weeks, STATE shall receive service credits in the amount of <#> percent of the fees for that month. If CONTRACTOR’s system response times fall below the warranted level for six (6) out of eight (8) consecutive weeks, CONTRACTOR shall be considered in default, and STATE may terminate the Contract without penalty.

CONTRACTOR represents and warrants that the above performance Service Levels shall be valid with up to <#> users using the system at any given time.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

SCHEDULED MAINTENANCE AND NOTIFICATIONS

Offeror Note: Provide information in the Offeror Response to assist STATE in completing items in red font.

a) Standard Maintenance Windows Define maintenance window schedule

b) Notification of Scheduled Maintenance Downtime CONTRACTOR shall provide 48 hours advance notice to the STATE of any scheduled maintenance downtime which will cause the total scheduled maintenance downtime for the month to exceed <#> hours or will occur outside of the Standard Maintenance Windows outlined above. In cases of emergency, CONTRACTOR shall use its best efforts to notify STATE of a planned downtime as soon as practicable.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

RPO AND RTO

CONTRACTOR commits to a RPO of four (4) hours and RTO of twelve (12) hours. In other words, when unscheduled downtime occurs, CONTRACTOR will resume service with data matching what the system contained at some point within the four hours preceding the unscheduled downtime. Additionally, the system cannot be down for longer than twelve (12) hours during unscheduled downtime.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

SAAS AND DATA SECURITY:

a) CONTRACTOR shall:

1) Certify the sufficiency of its security standards, tools, technologies and procedures in providing SaaS under this Contract.

2) Compliance with the following:

i. Undergo an annual Statement on Standards for Attestation Engagements (SSAE) Service Organization Control (SOC) 2 Type II audit or equivalent such as ISO 27001 for the CONTRACTOR’s Control Environment. Audit results and CONTRACTOR’s plan to correct any negative findings shall be provided to the STATE within seven (7) calendar days upon CONTRACTOR’s receipt of such.

ii. Provide STATE with a detailed description of the audited Control Environment. If STATE determines the Control Environment is not satisfactory, the STATE may request CONTRACTOR to correct any deficiencies.

3) Compliance with applicable industry standards, law, regulations and guidelines.

b) CONTRACTOR shall undergo the third-party security questionnaire on an annual basis at no cost to the STATE, unless CONTRACTOR has received FedRAMP, StateRAMP, or HiTrust certification. CONTRACTOR shall provide completed questionnaire within twenty-one (21) calendar days of receiving a written request. CONTRACTOR shall undergo the third-party security questionnaire when a breach has occurred.

c) CONTRACTOR shall implement and maintain all appropriate administrative, physical, technical and procedural safeguards in accordance with section a) above at all times during the term of this Contract to secure such Data from Data Breach, protect the Data and the SaaS from hacks, introduction of viruses, disabling devices, malware and other forms of malicious or inadvertent acts that can disrupt the STATE’s access to its Data.

c) CONTRACTOR shall allow the STATE reasonable access to SaaS security logs, latency statistics, and other related SaaS security data that affect this Contract and the STATE’s Data, at no cost to the STATE.

d) CONTRACTOR assumes responsibility for the security and confidentiality of the Data under its control.

e) No Data shall be copied, modified, destroyed or deleted by CONTRACTOR other than for normal operation or maintenance of SaaS during the Contract period without prior written notice to and written approval by the STATE.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

SAAS AND ARCHITECURE:

CONTRACTOR shall provide STATE with detailed architectural diagrams on an annual basis. The architectural diagrams are to include but not limited to servers, hardware, software solution (operating system, application servers, databases, identity repository), network architecture (dataflow diagram, firewalls, proxies, IDS/IPS). CONTRACTOR shall allow the STATE reasonable access to review the architecture.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

ENCRYPTION:

Information designated as sensitive, including PII, shall be encrypted end-to-end while it is in transit and at rest. Data must be encrypted using the most current Federal Information Processing Standard (FIPS) 140-2 validated cryptographic modules and the current Advanced Encryption Standard algorithm.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

RIGHTS TO DATA:

The Parties agree that as between them, all rights, including all intellectual property rights, in and to Data shall remain the exclusive property of the STATE, and CONTRACTOR has a limited, non-exclusive license to access and use the Data as provided to CONTRACTOR solely for performing its obligations under the Contract. Nothing herein shall be construed to confer any license or right to the Data, including user tracking and exception Data within the system, by implication, estoppel or otherwise, under copyright or other intellectual property rights, to any third party. Unauthorized use of Data by CONTRACTOR or third parties is prohibited. For the purposes of this requirement, the phrase “unauthorized use” means the data mining or processing of data, stored or transmitted by the service, for unrelated commercial purposes, advertising or advertising-related purposes, or for any other purpose other than security or service delivery analysis that is not explicitly authorized.

STATE shall have the ability to export data in partial or in entirety at its discretion without interference from the CONTRACTOR. This includes the ability for the STATE to export data to other service providers.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

DATA BACKUP:

a) CONTRACTOR shall provide geographical disparate storage on a daily basis of all backup disks, data, or materials of any type whatsoever produced in whole or in part in connection with or related to the performance by CONTRACTOR of its obligations under this Contract (including without limitations discs, tapes, other storage media, work papers and partial drafts of documentation code).

b) CONTRACTOR shall use appropriate and reliable storage media. CONTRACTOR shall regularly backup STATE Data and retain such backup copies for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

DATA RETENTION schedule AND DISPOSAL:

a) CONTRACTOR shall retain STATE’s Data until the STATE deletes the data.

b) At the STATE’s election, CONTRACTOR will either securely destroy or transmit to STATE repository any backup copies of STATE Data.

c) CONTRACTOR shall supply STATE a certificate indicating the records disposed of, the date disposed of, and the method of disposition used.

d) CONTRACTOR shall retain logs associated with STATE activity for a minimum of twelve (12) months or timeframe required by applicable laws and regulations.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

TRANSITION ASSISTANCE:

a) For ninety (90) days prior to the expiration date of this Contract, or upon notice of termination of this Contract, CONTRACTOR shall assist the STATE in extracting and/or transitioning all Data securely in the format determined by the STATE (“Transition Period”). CONTRACTOR agrees that there shall be no additional fees to execute the transition of Data during Transition Period.

b) CONTRACTOR and STATE shall develop a Transition Plan (“Transition Plan”) detailing each party’s respective tasks in connection with the orderly transition and migration of the licensed software, Data, any generated contextual data such as reference tables, metadata, structured and unstructured data not necessarily provided by STATE, and hosting services.

c) Upon termination or non-renewal of this Contract or in the event STATE makes a determination to host the licensed software at STATE’s hosting location or a third-party location as defined in SOW or Exhibit X (Transition Plan), the Transition Plan shall be implemented.

d) During the Transition Period, SaaS and Data access shall continue to be made available to the STATE without alteration.

e) Unless otherwise stated in SOW or Exhibit X (Transition Plan), as determined by the STATE the CONTRACTOR shall permanently destroy or render inaccessible any portion of the Data in CONTRACTOR’s and/or subcontractor’s possession or control following the expiration of all obligations in this section. Within thirty (30) days, CONTRACTOR shall issue a written statement to the STATE confirming the destruction or inaccessibility of the STATE’s Data.

f) In the event the Transition Plan is implemented, costs shall not be higher than the current amounts assessed to STATE by CONTRACTOR under this Contract. CONTRACTOR shall provide reasonable assistance as requested by STATE to successfully complete transition. The STATE at its option, may purchase additional transition services as agreed upon in the SOW or Exhibit X (Transition Plan).

g) In the event the SaaS is decommissioned or no longer offered the Transition Plan shall be implemented.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

DATA BREACH:

a) Upon discovery or reasonable belief of any Data Breach, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in SAAS NOTICE section of this Exhibit. CONTRACTOR shall provide such notification within the lesser of twelve (12) hours or the timeframe required by applicable laws and regulations after CONTRACTOR reasonably believes there has been such a Data Breach. To the extent known at the time of notification, CONTRACTOR’s notice shall include:

1) The nature of the Data Breach;

2) The Data accessed, used or disclosed;

3) The person(s) who accessed, used, disclosed and/or received Data (if known);

4) What CONTRACTOR has done or will do to quarantine and mitigate the Data Breach; and

5) What corrective action CONTRACTOR has taken or will take to prevent future Data Breaches.

b) CONTRACTOR will provide daily updates, or more frequently if required by the STATE, regarding findings and actions performed by CONTRACTOR until the Data Breach has been effectively resolved to the STATE’s satisfaction.

c) CONTRACTOR shall quarantine the Data Breach, ensure secure access to Data, and repair SaaS as needed in accordance with SLA set above in this attachment. Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

d) CONTRACTOR shall conduct an investigation of the Data Breach and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

DISASTER RECOVERY/BUSINESS CONTINUITY:

a) In the event of disaster or catastrophic failure that results in significant Data loss or extended loss of access to Data, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this exhibit. CONTRACTOR shall provide such notification within twenty-four (24) hours after CONTRACTOR reasonably believes there has been such a disaster or catastrophic failure. In the notification, CONTRACTOR shall inform the STATE of:

1) The scale and quantity of the Data loss;

2) What CONTRACTOR has done or will do to recover the Data and mitigate any deleterious effect of the Data loss; and

3) What corrective action CONTRACTOR has taken or will take to prevent future Data loss.

4) If CONTRACTOR fails to respond immediately and remedy the failure, the STATE may exercise its options for assessing damages or other remedies under this Contract.

b) CONTRACTOR shall restore continuity of SaaS, restore Data in accordance with the RPO and RTO as set forth in the SLA, restore accessibility of Data, and repair SaaS as needed to meet the performance requirements stated in the SLA. Failure to do so may result in the STATE exercising its options for assessing damages or other remedies under this Contract.

c) CONTRACTOR shall conduct an investigation of the disaster or catastrophic failure and shall share the report of the investigation with the STATE. The STATE and/or its authorized agents shall have the right to lead (if required by law) or participate in the investigation. CONTRACTOR shall cooperate fully with the STATE, its agents and law enforcement.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

AUDIT AND EXAMINATION:

a) Upon advance written request, CONTRACTOR agrees that the STATE or its designated representative shall have access to CONTRACTOR’s SaaS operational documentation, records and databases, including online inspections, that relate to the SaaS purchased by the STATE.

b) The online inspection shall allow the STATE, its authorized agents, or a mutually acceptable third party to test that controls are in place and working as intended. Tests may include, but not be limited to, the following:

1) Operating system/network vulnerability scans,

2) Web application vulnerability scans,

3) Database application vulnerability scans, and

4) Any other scans to be performed by the STATE or representatives on behalf of the STATE.

c) After any significant Data loss or Data Breach or as a result of any disaster or catastrophic failure, CONTRACTOR will at its expense have an independent, industry-recognized, STATE-approved third party perform an information security audit. The audit results shall be shared with the STATE within seven (7) days of CONTRACTOR’s receipt of such results. Upon CONTRACTOR receiving the results of the audit, CONTRACTOR will provide the STATE with written evidence of planned remediation within thirty (30) days and promptly modify its security measures in order to meet its obligations under this Contract.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

DISCOVERY:

If CONTRACTOR receives a request which may reasonably be interpreted as requiring access to the Data of the STATE or the STATE’s use of the SaaS, CONTRACTOR shall provide notice, by phone and through electronic mail, to the individuals identified in the SAAS NOTICE section of this Exhibit, unless prohibited by law from providing such notification. CONTRACTOR shall provide such notification within forty-eight (48) hours after CONTRACTOR receives the request. CONTRACTOR shall not respond to subpoenas, service of process, Public Records Act requests, and other legal requests directed at CONTRACTOR regarding this Contract without first notifying the STATE unless prohibited by law from providing such notification. CONTRACTOR agrees to provide its intended responses to the STATE with adequate time for the STATE to review, revise and, if necessary, seek a protective order in a court of competent jurisdiction. CONTRACTOR shall not respond to legal requests directed at the STATE unless authorized in writing to do so by the STATE.

Offeror Response:

Agree or Provide Alternate Language/Comments via Redline Above

SAAS NOTICE:

All notices or other communications required under this exhibit must be provided to the following:

STATE – ITD

GRC Team

GRC Team

4201 Normandy Street

Bismarck, ND 58503

701-328-4470 cygrc@nd.gov