ATTM 012.pdf

ATTACHMENT 012

Service Level Agreements (SLA)

Member Management System – O&E – Performance Standards

SLA

Desired Outcomes

RFP Subsection Number/Name Required Services Performance Standard Measurement/Monitoring Method Liquidated Damages

1 Timely Deliverables 3.5.1 Initiation Deliverables identified in the approved CDML are delivered within the specified timeframes and with sufficient quality.

Contractor shall provide all Operations Phase and Turnover Phase Deliverables within the time frames identified in the approved CDML.

Liquidated damages may be assessed when the Contractor does not meet Deliverable submission dates and

i) those dates are not modified in the approved Final CDML and related to Payment Milestones submitted to SCDHHS or

ii) if modified, those dates are not accompanied by written approval from SCDHHS or iii)if modified, those dates are not accompanied by an approved Contract amendment

Scheduled Deliverable date(s) against actual submission Deliverable date(s)

$1000 per business day for each Key Deliverable that is late.

$100 per business day that each non-key Operations Phase Deliverable is late.

Key Deliverables will be designated during the Initiation Phase.

2 Timely Financial Reporting

3.8.1 Financial

Reporting

Financial reports are provided within established timeframes.

Contractor produces weekly, monthly, quarterly, and annual reports within established reporting timeframe.

Date of actual report receipt against date of required submission.

$1000 per business day for each monthly, quarterly, and annual report that is late.

$100 per business day that each weekly report is late.

3 On-Call Emergency Contact Availability

3.5.2 Operations and

Enhancements (O&E) Phase

Contractor maintains an on-call emergency contact process.

Contractor maintains an on-call emergency contact process by which if not answered authorized SCDHHS staff will receive a call-back within thirty (30) minutes on a 24x365 basis.

Communication Contact Log $500 per hour or partial hour each time the Contractor fails to call-back within thirty (30) minutes from a message left by authorized State staff.

4 Security Breach Handling and Notification

3.19.1 Security and

Privacy Controls

Contractor notifies the state within acceptable timeframes and provides remediation of security breach events.

The Contractor must notify the State within one (1) hour of discovery of an actual breach and within twenty-four (24) hours of discovery of any potential security breach event, or vulnerabilities identified to the system or program information utilized under the Contract. The Contractor shall prepare and

Security alert $10,000 per calendar day for each event that SCDHHS is not notified per the standard, plus the cost of any penalties

Member Management System – O&E – Performance Standards present a remediation plan outlining the extent of the security breach or to address correction of vulnerabilities that would allow a potential breach within the latter of ten (10) business days of discovery or a date directed by SCDHHS.

applied by the federal government.

and

$1,000 per business day or any portion thereof beyond the defined remediation date window that remediation plans are not received by SCDHHS.

and $1,000 per business day or any portion thereof that the remediation plan for a breach does not begin execution according to the SCDHHS approved plan

5 Independent Assessment of Security/Privacy Controls

3.19.3 Independent

Assessment of Security and Privacy Controls

Contractor participation in Independent Assessment(s) of Security/Privacy Controls

Contractor shall participate in any Independent Assessment of Security and Privacy Controls and provide required inputs to Audit Reports that include applicable risk mitigation plan(s) as stipulated in this RFP Subsection specific to this requirement.

Audit Report(s) containing results and any and all identified risks to the information system environment.

$7,500 per month or any portion thereof required inputs to Audit Report(s) are late.

6 Training Assistance and Participation

3.23 Training and

Organizational Change Management (OCM)

Contractor develop and deliver MMS training as stipulated in RFP section 3.23

Contractor shall develop and deliver training on the system, as stipulated in RFP Section 3.23

Observation by SCDHHS staff of assistance and attendance in the training sessions specified by SCDHHS and review of developed training materials.

SCDHHS will perform random sampling for monitoring accuracy.

$2,500 per training session or material that the Contractor fails to deliver.

7 Performance Standard Reporting

3.36.2 Performance

Standard Calculations

Contractor reports on Performance Standard adherence

The Contractor shall by the seventh (7th) business day of a month report on the achievement of performance standards for the previous month and identify all performance standards that were not met.

Date of actual report receipt against date of required submission.

$100 per business day that the report is late.

8 Backup Persistence 3.5.2 Operations and Enhancements (O&E) Phase

System backup data will be maintained for potential restore operations.

Data will be maintained for 42 days; capability to restore will be tested quarterly.

Monthly report of any discovered loss of backup data and quarterly report of restoration capability (test results).

$1,000 per occurrence of failure to meet acceptable quality level.

Member Management System – O&E – Performance Standards 9 Service Uptime 3.5.2 Operations and

Enhancements (O&E) Phase

Production services are up and accessible with exception of scheduled maintenance windows and emergency maintenance operations (e.g. critical security patching).

Service is up and running 99.9% of the time (excluding SCDHHS approved maintenance windows); Incident management procedures are followed.

Monthly report of services availability. 0.5% of the Total Contract Value (TCV) for 98.9% - 99.8% uptime.

1.0% of the TCV for 97.9%

- 98.8% uptime.

10 Batch/Job Schedule Adherence and Completion

3.5.2 Operations and

Enhancements (O&E) Phase

Scheduled batch and other jobs are completed as required.

100% of batch and other scheduled jobs are completed within communicated acceptable timeframes. Acceptable batch/job timeframes will be established during Initiation Phase activities.

Monthly report of job completion metrics. Job reconciliation performed by SCDHHS MMRP staff.

$1,000 per batch/job not completed within acceptable timeframes

11 Data Persistence 3.5.2 Operations and Enhancements (O&E) Phase

The data is protected against loss. 0% loss of production data that meets the recovery point objective defined in MMS’s disaster recovery plan. SCDHHS shall be notified as soon as is practical and within one (1) business day of any production data discovered to be lost.

Monthly report of any production data loss incidents.

$10,000 for each incident of data loss.

12 Data Retention 3.5.2 Operations and Enhancements (O&E) Phase

System data will be retained for seven (7) years (as required by CMS).

Master and transactional data will be maintained for data retention purposes for seven (7) years; capability to access historical data will be tested quarterly.

Monthly report of any discovered loss of historical data and quarterly report of restoration capability.

$1,000 per occurrence of failure to meet acceptable quality level.

13 Backup 3.5.2 Operations and Enhancements (O&E) Phase

All production data on the database is backed up according to the schedules the System Design Document

Required services are performed on schedule with mutually agreed procedures to manage deviations.

Backups are executed and maintained on schedule;

deviations are managed according to procedure.

Monthly report of any deviations to daily production backups, as defined in the System Design Document

$1,000 per failure to meet performance standard.

14 Timely Invoicing Contractor (Vendor) shall invoice SCDHHS in arrears for all expenses in a timely manner.

Contractor (Vendor) shall invoice SCDHHS no later than three months after the expenditure. 100% occurs within three months after the expenditure

Review of monthly invoice received by SCDHHS designated staff

For expenses invoiced beyond three months, 0.1% of the TCV per business day or fraction of business day late.

15 Timely Received Corrective Action Plan (CAP)

Contractor (Vendor) will be required to respond to identified deficiencies with a CAP and the CAP must include the action(s) to be taken to correct the deficiencies and the time frame(s) associated with the corrective actions.

CAP must be delivered within fifteen (15) business days of request.

Monthly report 0.5% of the TCV per business day or fraction of business day late.

16 Disaster Recovery Services

3.5.2 Operations and

Enhancements (O&E) Phase

Execution of services described in the Contract and DR/BC Plan

Meet the effective objectives and dates documented in the Contract and DR/BC Plan. Meet or exceed the stated RTO and RPO objectives in those documents.

Monthly report 1.0% of the TCV per business day or fraction of business day per occurrence.

Member Management System – O&E – Performance Standards 17 UAT, Staging, and

Training Environment Availability

3.5.2 Operations and

Enhancements (O&E) Phase

The MMS UAT, Staging, and Training Environments must be accessible to SCDHHS staff 7 am to 7 pm EST, Monday through Friday; and as needed for afterhours and weekend work. SCDHHS to provide at least forty-eight (48) hours’ notice for weekend or after-hours work.

The specified MMS Environments must be available during agreed upon dates and times, except when SCDHHS request a build update or data refresh which is needed during the agreed normal System Availability. Such a request will not be considered unavailable time and not count against the Acceptable Quality Levels. Other Exceptions to "System Availability," would be network outages not caused by Contractor (Vendor) networks. This includes outages by ISP (Internet Service Provider), SCDHHS Outages, and any perceived network outage caused by certificate validations not related to these servers.

Availability of at minimum 95% of agreed uptime for a particular environment during a calendar month.

Monthly report of availability $2,000 per environment for missing the 95% monthly threshold.

18 Achieve Defined Actual Operational Start Date (AOSD)

3.5.2 Operations and

Enhancements (O&E) Phase

The MMS Production environment must be online and accessible to citizens (Citizen Portal) and SCDHHS workers (Worker Portal), with all interfaces functional, all operational processes in place, and all data successfully migrated and available, by the AOSD defined in the Migration Plan and associated Project Plan/Schedule.

100% of MMS Production infrastructure, applications, processes/procedures, interfaces, and access points must be online, functioning, and available to SCDHHS on the AOSD.

Adherence to approved Project Plan/Schedule

$15,000 per day (or partial day) past AOSD defined in the Migration Plan and associated Project Plan/Schedule.

19 Lower Environment Migration

3.5.2 Operations and

Enhancements (O&E) Phase

All MMS non-production environments (Dev, QA, UA, staging, training etc.) must be online and accessible to all MMRP State Team with all interfaces functional, all operational processes in place, and all data successfully migrated and available, by the date specified in the Project Plan/Schedule.

100% of MMS non-production environment infrastructure, applications, processes/procedures, interfaces, and access points must be online, functioning, and available to SCDHHS on the date specified in the Project Plan/Schedule.

Adherence to approved Project Plan/Schedule

$5,000 per day (or partial day) past migration date defined in the Migration Plan and associated Project Plan/Schedule.

20 Key Personnel 3.11.4 Key Personnel;

3.11.5 Vacancies of

Key Personnel

Key Personnel commitments defined in the Contract must not be changed unless prior written approval is obtained from the Contract Administrator, unless the Change is beyond the control of Contractor.

Contractor must replace Key Personnel

With respect to all vacancies of Key Personnel during all phases, SCDHHS shall receive a credit of three hundred dollars ($300 USD) per day, per vacancy. The credit shall begin to accrue at the time the vacancy occurs.

Monthly report (to include updated Contractor organizational charts);

Contractor must notify SCDHHS immediately upon the vacancy occurring

$300 per day, per vacancy, beginning at the time the vacancy occurs.

Member Management System – O&E – Performance Standards with a person of equivalent experience, knowledge and talent.

Temporary or permanent transfer of any of the Key Personnel within the project or temporary or permanent transfer of any of the above-named Key Personnel between Contractor projects shall require prior written approval of the Contract Administrator.

The Contract Administrator shall respond to Contractor’s request within five (5) business days.

21 DDI Project SLA’s 3.5.2 Operations and Enhancements (O&E) Phase

DDI Projects initiated shall have additional project-specific SLA’s defined and agreed-upon by the Contractor (Vendor) and SCDHHS as a part of the Project initiation.

TBD TBD TBD