ESBD_387108_1734647972541_08 - 3202500039 Attachment 8 Service Level Agreements.pdf

3202500039 – Career Exploration Assessment Services

Attachment 8 – Service Level Agreements (SLAs) The Successful Respondent shall meet or exceed the following SLAs. If TWC determines that any of the SLA standards are not met for any given calendar month, TWC will provide written notice to the Successful Respondent. This Attachment contains Service Levels the Successful Respondent must meet or exceed for its Technical Solution.

The Respondent must describe the proposed business and technical SLAs for Career Exploration Assessment Services subscription for services and detail how they will meet these SLAs.

Successful Respondent must demonstrate that the solution is fully operational on the Go-Live date and will continue for ninety (90) calendar days with no Severity 1 defects.

A. SERVICE CATALOGUE

The Successful Respondent will provide the following services to TWC:

Service Description Examples

User Support Receive, document, and prioritize issue tickets and help TWC staff in the use of subscription for services.

• Provide help desk support

• Answer queries about subscription for services.

• Receive and document bug reports.

• Collect and document requests for changes.

• Share status of requests.

Problem Correction

Bring the software (if SaaS) back to its original functionality before the problem arose. This may include a permanent fix or a temporary work around until a permanent fix is found as well as data corrections related to errors created as a result of the problem.

• Fix bugs.

• Retrieve functionality after abnormal program terminations.

• Complete root cause analysis.

Service Description Examples

Application Enhancement

Modify the functionality of the software (if SaaS) as per the Contract or negotiated Contract Amendments.

• Apply new functionality.

• Fulfill regulatory requirements including, but not limited to, modifying their Career Exploration Assessment Services for services as required to maintain compliance with state and/or federal regulatory changes.

• Enhance run-time efficiency.

• Modify services based on new releases of hardware or software.

Process and Improvement

Assist TWC in planning the better use of software (if SaaS) to meet business strategy and goals. This is a proactive attempt by the Successful Respondent to improve the software (if SaaS) and processes, based on the Successful Respondent’s increased application and business knowledge over time.

• Help TWC staff to make strategic decisions that meet program goals.

• Provide functional, architectural and process improvements as required for the support and maintenance of the Career Exploration Assessment Services for services areas in scope.

Solution Statistics

Monitoring staff usage to identify common issues that could be used to develop improved training.

• Frequency of errors of various types.

• Frequency of help calls by screen.

• Feedback on whether an issue was Texas specific or affected other customers of the Respondent using the Solution.

B. SERVICE LEVEL CREDIT (SLCs) TWC has chosen to address the majority of the after Go-Live risks related to the Successful Respondent’s performance through the following Service Level Agreements and the assignment of Service Level Credits (SLCs).

The SLCs described below represent the projected financial loss and expenditures that may occur because of Successful Respondent’s non-performance.

1. If at any time there are amounts payable to the Successful Respondent under the Contract, TWC shall have the right to deduct and/or withhold the amount of any SLC(s) assessed by TWC against the Successful Respondent from the amounts payable to the Successful Respondent.

2. If TWC determines that any of the SLAs are not met for any given month, TWC will provide written notice to the Successful Respondent of its intent to enact the SLCs listed the following month as a credit against the invoice.

Each SLA is measurable and associated with a financial Service Level Credit (SLC) if not met.

Service Level Credit - A deduction from the Successful Respondent’s monthly invoice expressed as a percentage of the agreed upon service delivery fee for the month in which an SLA was not met.

C. REPORTING

The following processes will be used to manage the services maintenance outsourcing agreement:

1. Monthly Status Report The Successful Respondent must maintain a full inventory of every incident reported by TWC by telephone or portal.

The Successful Respondent must provide a monthly report showing the Service Level Metrics by Incident Level for the Calendar Month and a rolling Report since AoC, The overall summary must include the following:

a. Software health;

b. On-going activities;

c. Completed tasks;

d. Upcoming milestones and releases;

e. Bug fixes;

f. Risk identification and mitigation plan;

g. Action items across different application areas; and

h. Recurring user training issues and whether the issue is on Texas-specific customization or affected other customers of the Respondent using the Solution.

2. Quarterly Review Meeting A quarterly review meeting will include the following:

a. The SLA will be reviewed with the I.T. contract manager involved, and an amendment addendum will be created if required;

b. Review process will be through teleconference or face-to-face meeting session which will be booked in advance;

c. Review document prepared by Successful Respondent will include overall project status, issues list, metrics reporting, supporting reasons for metrics deviation, and items that need adjustment within SLA (e.g. scope, metrics, etc.); and

d. SLA changes will be tracked by version number and date.

4. Reporting Service Levels

Type Measurement Credit

Monthly Status Report

Delivered at monthly intervals and not less than two (2) business days before scheduled review meeting

<five percent (5%) of monthly invoice>

D. USER SUPPORT AND PROBLEM CORRECTION AFTER IMPLEMENTATION

The following procedures will be used to respond to problems that are received by the Successful Respondent’s help desk. A problem is defined as an unplanned system event which adversely affects the mobile application or subscription for services processing or mobile application or subscription for services deliverables.

Measurement period for User Support and Problem Correction SLAs is a calendar month. For example, if an SLA is not met during the month of April, one SLC deduction (as outlined in the SLA associated with that service) will be applied to the invoice for the month of April, and if it is not met for the month of May, an additional SLC deduction will be applied to the invoice for the month of May.

1. Prioritization Approach Service requests for problems received by the help desk will be given a Severity Code from 1 – 4 based on how important responding to the problem is to the primary business of TWC, as well as the availability of workarounds. The Severity Code will be the basis for scheduling work on the backlog and assigning resources to the request.

Incident Severity Levels

Severity 1 (Code Red)

Severity 2 (Critical)

Severity 3 (High)

Severity 4 (Medium)

Workaround [this carries the heaviest weighting of the characteristics for Severity 1 and 2]

There is no acceptable workaround to the incident (i.e., users cannot perform the services in any other way).

There may or may not be an acceptable workaround to the problem.

There likely is an acceptable workaround to the incident.

There is an acceptable workaround to the incident (i.e., users can perform the services in some other way).

Work Outage

The incident prevents users from accessing the services or using any of the services.

The incident prevents users from accessing the services or using some significant portion of services.

The incident prevents users from accessing some small portion of the services, but they still are able to complete most other tasks.

The incident prevents users from accessing a minor portion of the services, but they still are able to complete their tasks.

Number of Clients Affected

The incident affects the majority (over 50%) of users.

The incident affects a large number (over 25%) of users.

The incident affects a small number (greater than ten percent (10%) and less than

The incident affects Less than 10% of users

Incident Severity Levels

(Code Red)

Severity 2 (Critical)

Severity 3 (High)

Severity 4 (Medium) twenty-five percent (25%) of users.

Business and Financial Exposure

The incident creates a critical business and financial exposure.

The incident creates a serious business and financial exposure.

The incident creates a moderate business and financial exposure.

The incident creates a minimal business and financial exposure.

2. Response and Resolution Times

Severity codes are used to determine appropriate response and resolution times. Response and resolution times are measured from when the incident is opened by the help desk. If the problem is not resolved within the defined timeframe, continuous effort will be applied until the problem is resolved. Verification must be completed by the Awarded Vendor within thirty (30) minutes of the reporting of the incident.

Severity Code

Initial Response

Estimation Response

Subsequent Responses Resolution

1 1 hour 2 hours Every 2 hours

8 hours

2 1 hour 8 hours Every 2 hours

2 calendar days

3 2 hours 8 hours Every 4 hours

4 calendar days

4 2 hours Next business day

Weekly 20 calendar days

a. Initial Response is when a ticket is opened and acknowledged by help desk staff.

b. Estimation Response is when the User that logged the ticket is informed of an estimated resolution time. This response includes the time for root cause analysis.

c. Subsequent Responses is the frequency with which the User that logged the ticket is updated on the resolution status.

d. Resolution is the point at which the problem is resolved, and the services are returned to a usable and available state.

3. Application Function Type

The table below provides a brief definition of critical, important, and supportive application functions.

Application Function Type Description

Critical

These application functions are critical to ensuring business outcomes or TWC reputation.

Extended failure will impact ability to serve customers or damage TWC reputation.

Important

These application functions are important to business productivity but are not critical to ability to serve customers or TWC reputation.

Usually there is a workaround available to Users.

Supportive These applications support productivity but are not essential to business effectiveness.

4. Response and Resolution Service Levels

Type Measurement

Resolution

All Severity 1 problems are resolved in less than eight(8) hours.

Severity 1 Resolution

One or more Severity 1 problems are resolved in over eight (8) hours.

Severity 2 Resolution

Less than ninety-five percent (95%) of Severity 2 problems are resolved in two (2) calendar days.

Severity 3 Resolution

Less than ninety-five percent (95%) of Severity 3 problems are resolved in four (4) calendar days.

Severity 4 Resolution

Less than ninety-five percent (95%) of Severity 4 problems are resolved in twenty

(20) calendar days.

Response/Estimate Less than ninety-five percent (95%) of Initial Response, Estimation Response, and Subsequent Response times are met.

Type Measurement

End user satisfaction

More than ninety-five percent (95%) of completed scores on problem resolution satisfaction survey have a rating of satisfied or very satisfied.

Maximum Problem Aging

No problem is older than sixty (60) calendar days.

a. End user satisfaction is the rating provided by Users after the problem they logged is resolved.

b. Problem backlog is the maximum number of unresolved problems.

c. Problem aging tracks unresolved problems that are older than sixty

(60) calendar days.

The following table summarizes the service level credits for incident resolution:

Service Level Agreement

Assessment of Noncompliance

Frequency of Assessment

Vendor Assessment of Service Level Credit (SLC)

The service provider must resolve Severity 1 Incidents within 8 hours.

Failure to resolve a Severity 1 incident within 8 hours

Monthly after deployment of System

$1,000 per occurrence

The service provider must resolve Severity 2 Incidents within 2 calendar days.

Failure to resolve a Severity 2 incident within 2 calendar days

Monthly after deployment of System

$500 per occurrence

The service provider must resolve Severity 3 Incidents within 4 calendar days.

Failure to resolve a Severity 3 incident within 4 calendar days

Monthly after deployment of System

$100 per occurrence

5. Services availability is defined as the ability of an end user to access and execute any of the included services functions from a functioning workstation and live network connection. For the services to be available, all its supporting systems must be operational.

Application Level

Business Hour Availability

Off-Hour Availability

Scheduled Down-Time

Definition Sunday - Saturday 12:00 am-11:59 pm CST, Critical 99.5%

Important 99%

Supportive 98%

Any outages must be scheduled and approved by the TWC at least two

(2) weeks in advance unless there is an emergency.

The following table summarizes the service level credits for application availability:

Service Level Agreement

Assessment of Noncompliance

Frequency of Assessment

Vendor Assessment of Service Level Credit

(SLC)

The services shall be available as defined in the table above

Each percentage point less than the availability for the month.

Monthly after deployment of System

$100 for each percentage point below the required availability for the month.

For purposes of this SLA, a portion of a percentage below the required level will be considered a full percentage point below the required level.

E. PROCESS AND IMPROVEMENT

The Successful Respondent will help TWC to improve its mobile application or subscription for services and mobile application or subscription for service maintenance processes over time, in line with TWC’s program goals and strategy. As Successful Respondent gains increased mobile application or subscription for services and program knowledge, it is expected that Successful Respondent will help TWC to plan the better use of applications to meet program goals.

There are no SLAs associated with Process and Improvement. These will be negotiated at the time of procurement for these services.

F. KEY METRICS FOR CLOUD SECURITY MODELS

The Successful Respondent must describe the key security SLA metrics for their Career Exploration Assessment Services for their proposed cloud model(s). The authoritative sources that are identified and align with the proposed metrics are NIST SP800-53r4, Cloud Security Alliance Cloud Control Matrix v3.01 (CSA), and ISO 27001-2013 (ISO).

References to the specific section of each authoritative source are provided with each SLA recommendation for additional guidance.

Software as a Service:

# Key Security SLAs NIST CSA ISO 1 Change and Release Management CM CCC A.12.1.2 2 Secure Application and Program Interfaces SC AIS A.14.1.2

3 Disaster Recovery and Business Continuity Planning CP BCR A.17.1.3

4 Secure Configuration CM IVS A.12.5.1 5 Intrusion Prevention SI TVM A.14.1.2 6 Vulnerability and Penetration Testing RA IVS A.14.2.3 7 Software Lifecycle and Patch Management SI TVM A.12.6.1 8 Security Coding Practices AT HRS A.14.2 9 Identity Access Management AC IAM A.9.2

The Successful Respondent must provide a monthly report showing the Service Level Metrics by Incident Level for the Calendar Month and a rolling Report since AoC, G. MALWARE/VIRUS CONTAMINATION

Service Level

Agreement Assessment of Noncompliance

Frequency of Assessment

Vendor Assessment of Service Level Credit

(SLC)

All software developed and delivered by the Vendor for installation on the State of Texas’ servers must be free of malware/viruses as flagged by malware/virus detection software.

Each malware/virus that is included in software developed and delivered by the Vendor for installation on the State of Texas’ servers.

Monthly after any software has been accessed by TWC staff

$2,000 per malware/virus incident per day once a resolution is discovered.

H. DISASTER RECOVERY SERVICE LEVELS

The following table summarizes the service level credits for Disaster Recovery:

Service Level Agreement

Assessment of Noncompliance

Frequency of Assessment

Vendor Assessment of Service Level Credit

(SLC)

The Services shall be restored in less than 48 hours from the point in time the disaster is reported

Each complete hour beyond 48 hours from the disaster being reported

Per incident $5000 for each complete hour beyond 48 hours from the disaster being reported.

e.g. - 48:55 = $0 e.g. - 52:15 = $20,000

Service Level Agreement

Assessment of Noncompliance

Frequency of Assessment

Vendor Assessment of Service Level Credit

(SLC)

The Services shall be restored in case of a disaster and only experience the loss of no more than one hour of transactions.

Any portion of an additional hour of loss beyond the requirement for one hour of transactions.

Per incident $1,000 for any portion of an additional hour’s transaction loss beyond the loss of only one hour of transactions and each thereafter.