CalTABS_SOW_Attachment_3_-_SLAs_FINAL.pdf

The Contractor shall meet the Service Level Agreements (SLA) as defined in this SOW

ATTACHMENT 3 - SERVICE LEVEL AGREEMENTS.

Key Staff Service Levels

SLA Name: Key Staff

SLA ID 1

Reference(s) SOW Section 7 - Contractor Qualifications

Performance Standard:

Contractor positions that are designated as Key Staff shall not remain vacant during their scheduled project time.

Effective Date: This SLA shall begin upon Contract execution.

Measurement Process:

As defined in SOW Section 7 - Contractor Qualifications, positions vacated shall not remain vacant for more than fifteen (15) calendar days, unless the replacement candidate is not accepted by the State. In which case, the Contractor is provided an additional ten

(10) calendar days, and the Contractor must provide another candidate and receive State acceptance within twenty-five (25) calendar days of the date the original Key Staff member becomes unavailable.

Measurement Period:

Monthly

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per SOW Section 8 - Project Tasks/Deliverables) if the Contractor continues to have Key Staff vacancies.

Exceptions: N/A

Reporting: Contractor shall notify the State of replacement as indicated within this contract and report on replacements in regular monthly reporting (e.g., Monthly Status Report (ID: DEL-13)), or as directed by the State.

Service Levels Post-Go-Live

Availability Service Levels for Production Environment

SLA Name: Production Environment Availability

SLA ID 2

Reference(s) DEL-19 Requirements Traceability Matrix, DEL-14 Performance and Capacity Management Plan, DEL-12 Maintenance and Operations Plan

Performance Standard:

The CalTABS solution Production Environment of the shall be Available twenty-four (24) hours per day seven (7) days per week 99.5% of the time, except for scheduled maintenance or downtime, which shall be approved by the State in writing monthly. Availability shall be measured by a State-approved monitoring tool.

Effective Date: This SLA shall begin at CalTABS Go-Live.

Measurement Process:

Availability shall be calculated monthly rounded to the nearest tenth of a percent.

The calculation is as follows:

• Scheduled Downtime: in whole minutes, approved by the State monthly and for pre-determined outage schedule.

(Pre-determined outage schedule (dates and times) will be agreed to by the Contractor and State in advance of an outage. Time more than an agreed upon outage shall be considered Unscheduled Downtime.)

• Unscheduled Downtime: in minutes, for which any portion of the CalTABS solution Production Environment is not available to all users

• Available Minutes: [(24-hours * calendar days in month) * 60 minutes] – Scheduled Downtime

• Availability: [(Available Minutes – Unscheduled Downtime)/ Available Minutes] * 100

Calculation example:

SLA Name: Production Environment Availability

• Available Minutes: [(24 * 30) * 60] – 240 = 42,960 minutes (assumes 30 days in the month and 4 hours of State approved downtime for the month)

• Availability: [(42,960 – 540) / 42,960] * 100 = 98.74%

(Assumes 9 hours of Unscheduled Downtime for the month, which took place over seven (7) different unplanned outages)

Measurement Period:

Monthly

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per SOW Section 8 - Project Tasks/Deliverables) if the Contractor continues to have unscheduled production environment outages.

Exceptions: N/A

Reporting: Contractor shall document and explain any outages to the State within 48 hours of outage start time. Contractor shall report on Availability metrics in regular monthly reporting (e.g., Monthly Status Report (ID:

DEL-13)), or as directed by the State.

Disaster Recovery Service Levels

A disaster refers to any event, natural or human-induced, that causes a significant disruption in the normal functioning of the CalTABS solution. This includes but is not limited to events such as earthquakes, floods, hurricanes, fires, cyber-attacks, network failures, and any other incidents that result in the inaccessibility of data or degradation of service performance to a level below the agreed-upon standards specified in the Recovery Time and Recover Point Objective Service Levels.

Recovery Time Objective Service Levels

SLA Name: Recovery Time Objective

SLA ID 3

Reference(s) SOW Section 8 - Project Tasks/Deliverables Task Group #9 – Maintenance and Operations Requirements, DEL-19 Requirements Traceability Matrix, DEL-14 Performance and Capacity Management Plan, DEL-12 Maintenance and Operations Plan

Performance Standard:

In the event of a Disaster which creates unplanned outage, the Contractor shall fully restore all system functionality within four (4) hours of the start of the Disaster. The date and time of the Disaster shall be the date and time captured either within the system or when reported to the State, whichever is earlier, per occurrence.

Effective Date: This SLA shall begin at CalTABS Go-Live.

Measurement Process:

The Recovery Time for each occurrence shall be calculated from the start of the Disaster until full system restoration. The Recovery Time Calculation (RTC) will round up each RTO to the nearest whole hour.

The calculation is as follows:

• RTO Occurrence (in hours): [Full System Restoration – Disaster]

• RTC (in hours): Roundup (RTO Occurrence)

Calculation example:

• Disaster: 2/10/2026 1:51 PM Pacific Time

• Full System Restoration: 2/10/2026 6:17 PM Pacific Time

SLA Name: Recovery Time Objective

• RTO Occurrence (in hours): 2/10/2026 6:17 PM – 2/10/2026 1:51 PM = 4.43 hours

• RTC (in hours): Roundup (4.43) = 5 hours

Measurement Period:

Per occurrence of a Disaster that creates an unplanned outage.

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per SOW Section 8 Project Tasks/Deliverables) if the Contractor continues to not meet this SLA.

Exceptions: An alternate RTO for a specific Disaster is mutually agreed upon in writing between the Contractor and State.

Reporting: Contractor shall report on RTO metrics in regular monthly reporting (e.g., Monthly Status Report (ID: DEL-13)), or as directed by the State.

Recovery Point Objective Service Levels

SLA Name: Recovery Point Objective

SLA ID 4

Reference(s) SOW Section 8 - Project Tasks/Deliverables Task Group #9 – Maintenance and Operations Requirements, DEL-19 Requirements Traceability Matrix, DEL-14 Performance and Capacity Management Plan, DEL-12 Maintenance and Operations Plan

Performance Standard:

The performance standard is no more than 15 minutes of data loss per incident. In the event of a Disaster where data become corrupted, damaged, or deleted, the Contractor shall restore all production data to the most recent Data Recovery Point prior to the start of the interruption. Performance will be measured by calculating the amount of data lost in minutes per occurrence.

Effective Date: This SLA shall begin at CalTABS Go-Live.

Measurement Process:

The Recovery Point duration shall be calculated as the time between the interruption and the most recent Data Recovery Point.

SLA Name: Recovery Point Objective

The calculation is as follows:

• RPO (in minutes): [Start of Interruption – Most Recent Data Recovery Point]

Calculation example:

• Start of the Interruption: 2/10/2026 10:48 AM Pacific Time

• Most recent Data Recovery Point: 2/10/2026 10:30 AM Pacific Time

• RPO (in minutes): [2/10/2026 10:48 AM – 2/10/2026 10:30 AM] = 18 minutes

Measurement Period:

Per occurrence of a Disaster.

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per SOW Section 8 Project Tasks/Deliverables) if the Contractor continues to fail to meet this SLA.

Exceptions: If no data was lost during an RPO, this SLA will not apply.

Reporting: Contractor shall report on RPO metrics in regular monthly reporting (e.g., Monthly MST Report (ID: DEL-13)), or as directed by the State.

Incident Resolution Service Levels

SLA Name: Incident Severity Levels

SLA ID 5

Reference(s) SOW Section 8 - Project Tasks/Deliverables Task Group #9 – Maintenance and Operations Requirements, SOW Attachment 1 – Detailed System Requirements, DEL-10 Incident Management Plan

Performance Standard:

Incidents shall be resolved within the Resolution Time defined for each severity level. The State shall assign the severity level to each incident pursuant to the definitions shown in Table 1 – Severity Levels below.

SLA Name: Incident Severity Levels

Effective Date: This SLA shall begin at CalTABS Go-Live.

Measurement Process:

Incident severity levels shall be calculated from the time the ticket is submitted to the Contractor, either via phone, email, or other online ticketing tool, to the time the ticket is fully resolved for the incident. If multiple options exist for a ticket to be submitted, the Ticket Submission Time shall be the earliest time stamp of any option captured.

The calculation is as follows:

• Incident Resolution Time (in minutes): [Ticket Resolution Time – Ticket Submission Time]

Calculation example:

• Ticket Submission Time: 2/10/2026 8:11 AM Pacific Time

• Ticket Resolution Time: 2/11/2026 6:15 AM Pacific Time

• Incident Resolution Time (in minutes): 2/14/2026 6:15 AM – 2/10/2026 8:11AM = 1,324 minutes (or 22 hours 4 minutes)

Measurement Period:

Per occurrence of reported incident.

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per requirements in SOW Section 14.1.6.1 Corrective Action Plans) if the CalTABS solution continues to experience a high number of unresolved Severity 1 and/or Severity 2 incidents. The high number of unresolved Severity 1 and 2 incidents will be calculated at greater than 15% of all unresolved defects.

Exceptions: An alternate time frame, which is mutually agreed upon in writing between the Contractor and State (e.g., adherence to the Maintenance Deployment schedule).

Reporting: Contractor shall summarize all incident resolution metrics in regular monthly reporting (e.g., Monthly Status Report (ID: DEL-13)), or as directed by the State.

Table 1 – Incident Severity Levels

Severity Level

Severity Description Resolution Time

1 Critical production issues affecting all users, including system unavailability and data integrity issues with no workaround available.

• 100% resolution to the State’s satisfaction completed within one (1) business day of ticket submission.

• Coordination with the State Project Director or designee with initial response provided within two (2) hours of ticket submission and updates no less than every four (4) hours shall be provided until Incident is resolved.

2 Major functionality is impacted, or performance is significantly degraded. Issue is persistent and affects many users and/or major functionality. No reasonable workaround is available. Also includes time-sensitive requests.

• 100% resolution to the State’s satisfaction completed within three

(3) business days of ticket submission.

• Coordination with the State Project Director or designee with initial response provided within four (4) hours of ticket submission and updates no less than every twelve

(12) hours shall be provided until Incident is resolved.

3 System performance issue or bug affecting some but not all users.

Short-term workaround is available, but not scalable.

• 100% resolution to the State’s satisfaction completed within five (5) calendar days of ticket submission.

• Daily updates shall be provided through resolution.

Level

Severity Description Resolution Time

4 Inquiry regarding a routine technical issue; information requested on application capabilities, navigation, installation, or configuration; bug affecting a small number of users. Reasonable workaround available. Resolution is required as soon as reasonably practicable.

• 100% resolution to the State’s satisfaction completed in fourteen

(14) calendar days of ticket submission.

• Weekly updates shall be provided through resolution.

Problem Management & Root Cause Analysis Service Levels

SLA Name: Problem Management & Root Cause Analysis (RCA)

SLA ID 6

Reference(s) SOW Section 8 - Project Tasks/Deliverables Task Group #9 – Maintenance and Operations Requirements, DEL-19 Requirements Traceability Matrix, DEL-10 Incident Management Plan

Performance Standard:

Contractor shall manage solution problems and perform RCA for incidents defined in SLA #5 Incident Severity Levels, as Severity 1 and Severity 2. An incident categorized as a Severity 2 incident shall follow the measurement methods listed below.

Depending on the nature of incident or issue, information in the initial and completed RCA documents may be confidential and will therefore first be provided to the State Project Director and predetermined audiences with the State.

The initial RCA document shall provide, as it is understood at the time of submission, the issue, identification date/time, an estimate of impacts (to the system, the data, and users), an estimate of the duration to resolve, and any relevant actions taken or planned.

The completed RCA document shall provide at a minimum the issue, date/time for the identification, date/time for the resolution, description of the issue and its impacts, actions taken, and any resulting outcomes and follow up actions required.

Effective Date: This SLA shall begin at CalTABS Go-Live.

Measurement Process:

This SLA will be measured on the type of RCA (i.e., Initial or Completed) and the time duration from required to actual submission as shown in Table 3 – Root Cause Analysis Severity levels.

The calculation is as follows:

• Type of RCA: Initial or Completed

• Submission Due: See table below. Initial RCA is due prior to Resolution Time requirement for the given Severity level defined in SLA #5, Incident Severity Levels. The Completed RCA is due within a given timeframe following the resolution of the problem, and timeframe is based on Severity Level

• Submission Duration Difference (in hours): [RCA Actual Submission – RCA Submission Due]

Measurement Period:

Monthly

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per SOW Section 8 Project Tasks/Deliverables) if the Contractor continues to fail to meet this SLA.

Exceptions: The Root Cause Analysis Submission SLA shall not be measured during periods where an extension has been approved by State Project Director or designee.

Reporting: The Contractor shall report the Root Cause Analysis submission performance metrics in regular monthly reporting (e.g., Monthly Status Report (ID: DEL-13)), or as directed by the State.

Table 3 – Root Cause Analysis Severity Levels

Level

RCA Type RCA Submission Due

1 Initial Within one (1) hour of ticket submission from the end user

1 Completed Within 24 hours of incident resolution

2 Initial Within two (2) hours of ticket submission from the end user

2 Completed Within 24 hours of incident resolution

System Maintenance and security Service Levels

System Maintenance Service Levels

SLA Name: System Maintenance – Software Patches

SLA ID 7

Reference(s) DEL-13 Maintenance and Operations Plan, DEL-20 Release Management Plan

Performance Standard:

Contractor shall apply critical software application patches to the CalTABS solution upon notification from the manufacturer or the State in the period required to minimize or avoid vulnerabilities to the solution or as defined in the State-approved Release Management Plan. The Contractor shall work with the State to apply non-critical application patches and upgrades to software and hardware in alignment with project approved plans and processes.

Contractor, in coordination with the State, shall upgrade and install system software including, but not limited to, enterprise management agents, open-source software, commercial software, and middleware tools as specified in the Contractor’s System Maintenance Plan.

Contractor shall monitor and notify the State Project Director or designee when any software product used in any part of the solution is within eighteen (18) months of losing support from the software vendor.

Contractor shall monitor and notify the State of any system software patches and upgrades that have not been applied as planned and the reason they were not applied.

Effective Date: This SLA shall begin at CalTABS Go-Live.

Measurement Process:

System Maintenance reporting time shall be calculated between the date a software/hardware maintenance update or notification is required and the date the upgrade is completed, or notification is provided.

The calculation is as follows:

SLA Name: System Maintenance – Software Patches

• System Maintenance Required: Date update or notification is required as determined by the State based on Contractor’s Software Maintenance Plan or other independent sources.

• System Maintenance Completed: Date update or notification is completed by Contractor

• System Maintenance Gap: System Maintenance Completed – System Maintenance Required

Calculation example:

• System Maintenance Required: 2/10/2026

• System Maintenance Completed: 2/20/2026

• System Maintenance Gap: 2/20/2026 – 2/10/2026 = 10 days

Measurement Period:

Per occurrence of failure to meet System Maintenance SLA.

Escalation: The State may require the Contractor to submit a Corrective Action Plan (CAP) (per SOW Section 8 Project Tasks/Deliverables) if the Contractor continues to fail to meet this SLA.

Exceptions: This Sla shall not apply if failure to notify the State of software support termination is due to late notification by the software vendor.

Reporting: Contractor shall report to the level of detail necessary and as agreed to by the State on System Maintenance reporting metrics in regular monthly reporting (e.g., Monthly Status Report (ID: DEL-13)), or as directed by the State.