Exhibit 3.1 - Service Level and Deliverable Matrix

Title Page

Introduction Introduction

This Exhibit 3.1 (Service Level and Deliverable Matrix) sets forth the following:

&"Calibri,Regular"&K000000Exhibit 3.1 (Service Level Matrix)

&"Calibri,Regular"&K000000Page &P of &N

1. Critical Service Levels Critical Service Levels

Exhibit 3.2 Section Reference Service Level Categories Comm + mos(1) Performance Target (PT) (2)

Exhibit 3.1 (Service Level Matrix)

2. Key Service Levels Key Service Levels

Exhibit 3.2 Section Reference Service Level Categories Comm + mos(1) Performance Target (PT) (2)

3. One Time Delivery

(mm/dd/yy)

- Detailed task/Work Breakdown Structure for transition, inclusive of all activities, deliverables, dependencies;

- Risk Register;

- Project Integration – among PennDOT, reliant or dependent Service Components;

- Stakeholder goals and expectations;

- Project Scope, Project Time, Project Schedule Management Plan, Project Change Management;

- Project Quality Measures and Management Plan, Project/Transition Staffing Plan, Project Communications;

- Documentation of required 2 reviews conducted with PennDOT prior to final submission.

- Plan for validating inventory, and implementing automated discovery tools for tracking and reporting on all operational hardware, software, appliances, etc. on supported Service elements and devices;

- Plan and associated timelines for developing APIs and other system integrations to support automated reporting, data feeds, etc. into the PennDOT tools, including any known interdependencies or resource requirements PennDOT or other Service Components.

- A description of the documentation, methods and procedures, personnel and organization the Service Provider will use to perform the Transition;

- Validation of successful Transition inclusive of user acceptance and assessment of acceptable performance with respect to comparison to baseline operational and performance attributes collected during preceding phases (i.e., design, build, test) outlined herein;

- Project Communications, Action Items, Decisions and Risks/Issue Management; and Project Procurement

- Completed Deliverable Table document capturing transition milestone objectives, Acceptance Criteria, dates, dependencies, owners, and review teams.

This documentation requires 1 review conducted with PennDOT prior to final submission.

This documentation requires 2 reviews conducted with PennDOT prior to final submission.

The documentation includes .doc documents that detail the processes support the SMM requirements, including:

- Publication of required Phase 2 SMM documents;

- SMM content is aligned with the SMM contents and structure (e.g., Process, Procedure, Work Instruction);

- Processes reflect the requirements of the this contract;

- Detailed descriptions of policies, processes, and procedures are documented in the manual;

- Roles and responsibilities are defined for Service Provider, PennDOT, and/or other Service Components as appropriate;

- Dependencies and relationships are documented;

- Risks associated with procedures are identified and mitigation strategies documented for each risk;

- The policies and procedures are consistent with the proposed transition and solution.

This documentation requires 2 reviews conducted with PennDOT prior to final submission.

The documentation includes support for .doc documents, developed by PennDOT, that detail the processes support the SMM requirements, including:

- Publication of required Phase 3 SMM documents;

- SMM content is aligned with the SMM contents and structure (e.g., Process, Procedure, Work Instruction);

- Processes reflect the requirements of the this contract;

- Detailed descriptions of policies, processes, and procedures are documented in the manual;

- Roles and responsibilities are defined for Service Provider, PennDOT, and/or other Service Components as appropriate;

- Dependencies and relationships are documented;

- Risks associated with procedures are identified and mitigation strategies documented for each risk;

- The policies and procedures are consistent with the proposed transition and solution.

1) Detailed Disaster Recovery Strategy and target Disaster Recovery design document that describes the strategy and design requried to achieve the PennDOT-approved disaster recovery levels for Mainframe Services.

2) Detailed Disaster Recovery Plan, including detailed Disaster Recovery Plans (DRPs), Technical Recovery Guides (TRGs), and SMM processes for use in recovering Service Provider Services as defined in Exhibit 2.1 Mainframe Services SOW, Section 6.13 IT Service Continuity Management, including:

- DRPs and TRGs for Service Provider Services upon Commencement.

- Published IT Service Continuity Management SMM documents.

- security control status including those that are in place or planned for deployment,

- plans of actions to achieve control compliance, and

- plans to correct deficiencies in the System Security Plan. Create or update a System Security Plan, in PennDOT agreed format(s), including:

- System description including its architecture, components, and data it handles.

- System boundaries specifying what is included and what is not.

- Security objectives including the security goals and objectives of the system.

- Security controls as required including Exhibit 2.1 Mainframe Services SOW, Article 3 Security Services and Article 8 Information Security Management for Service Provider Services

- Risk assessment including the risks and threats that the system faces and how they will be mitigated.

- Incident response referring to the SMM processes and procedures for detecting, reporting, and responding to security incidents.

- Security training and awareness programs for personnel involved with the system.

- Security policies, procedures and standards relevant to system security.

- Security testing including how security testing, vulnerability assessments and penetration testing, will be conducted.

- Authorization including description or reference to the SMM describing the process for obtaining authorization to operate the system.

- System Monitoring and Audit including details how the system will be monitored and audited to ensure ongoing security.

- Contingency and Disaster Recovery including the architecture and plans for system recovery and continuity in the event of disruptions.

4. Recurring Delivery

As a part of the refresh plan, the Service Provider shall provide a recommendation to upgrade Software to supported levels and to refresh Infrastructure in accordance with the Technology Plan and technology roadmap. Provide PennDOT with the Service Provider's annual refresh plan in the required format, to be included in the complete annual refresh plan deliverable submission to PennDOT.

Publication and agreement on the annual refresh plan captured in a .docx document and project plan that includes:

- Refresh forecast eligibility, dependencies, and recommendations for refreshing technology (infrastructure and software) in the Services environment for the upcoming year.

- Preliminary business-level assessment of the solutions, plans, cost estimates, and schedules for achieving refresh goals (including software to n/n-1 levels) for Services or as required in Exhibit 4.2 Financial Responsibility Matrix.

- Refresh progress, dependencies, and recommendations for accomplishing objectives set forth in the annual refresh plan.

- Identify delays caused by Change Management or other Service Provider dependencies..

Publication and agreement with PennDOT Information Security requirements as described in Exhibit 2.1 Mainframe Services SOW, Article 8 Information Security Management for Service Provider Services and captured in a PennDOT agreed format that includes:

The Service Provider shall document the System Security Plan that provides an overview of the security requirements and describes the security controls, in alignment with Exhibit 2.1 Mainframe Services SOW, Article 3 Security Services and Article 8 Information Security Management for Service Provider Services, including:

- those that are in place or planned for deployment,

- plans of actions to achieve control compliance, and

- plans to correct deficiencies in the System Security Plan. Provide PennDOT the Service Provider's completed System Security Plan in the required format, including:

- System description including its architecture, components, and data it handles.

- System boundaries specifying what is included and what is not.

- Security objectives including the security goals and objectives of the system.

- Security controls as required including Exhibit 2.1 Mainframe Services SOW, Article 3 Security Services and Article 8 Information Security Management for Service Provider Services.

- Risk assessment including the risks and threats that the system faces and how they will be mitigated.

- Incident response referring to the SMM processes and procedures for detecting, reporting, and responding to security incidents.

- Security training and awareness programs for personnel involved with the system.

- Security policies, procedures and standards relevant to system security.

- Security testing including how security testing, vulnerability assessments and penetration testing, will be conducted.

- Authorization including description or reference to the SMM describing the process for obtaining authorization to operate the system.

- System Monitoring and Audit including details how the system will be monitored and audited to ensure ongoing security.

- Contingency and Disaster Recovery including the architecture and plans for system recovery and continuity in the event of disruptions.

- SMM review plan, agreed by PennDOT, by topics (e.g., sections, processes or functional area) with timeline and participants. Plan is to include a listing of all documents or content included in the review (e.g., policies, processes, procedures, work instructions, templates).

- Report of the review findings and updates made over the previous quarter.

Service Provider shall plan and lead PennDOT and Service Components in disaster recovery exercises and providing any needed information for the disaster recovery test plan and schedule. Publish .doc/.xls document(s) that describes the annual Disaster Recovery test plan and schedule including:

- Improvements from Previous year - A narrative evaluation of the previous years' testing against the DR program objectives to determine areas of risk, indicating any DR program or process changes to be incorporated in the next years' test plan schedule.

- Scope changes - List of major changes in requirements and new Applications implemented since the previous year's test, and a list of eligible Applications not scheduled for testing

- Proposed new schedule developed for the upcoming year inclusive of RTO/RPO for each System/Application

- Proposed test objectives and criteria for demonstrating RTO/RPO achievement

- Proposed test roles and responsibilities for Service Provider, PennDOT, and Service Components.

After PennDOT approval, publish DR test plan and schedule.

Report including but not limited to:

- Release Notes showing specific application upgrade details

- Training design, schedule, logistics, and post-training feedback plan;

- List of training attendees;

- Documentation resulting from training, including handbooks, self-service materials, and evidence of sharing on PennDOT learning management platform;

- Materials to support training, e.g., posters; video, communication plan, training plan

- Recommendations for next steps for the Service Provider and for PennDOT;

- Lessons learned to be implemented into following trainings.

- Service Desk support process

- Schedules, dependencies, and requirements for introduction of new technology changes into the environment including the acquisition, support, and retirement of Software and Hardware.

- Specification of the solutions, plans, cost estimates and schedules for achieving Technology Evolution goals

- CMDB extract of Software and tools used in providing Services along with the targeted vision for each

image1.emf