Exhibit S, Information Technology Infrastructure Library (ITIL) Severity Levels.pdf

RFP No. HHS0016867 Exhibit S

Exhibit S, Information Technology Infrastructure Library (ITIL) Severity Levels

1. Severity Levels HHSC uses the Information Technology Infrastructure Library (ITIL) framework for service management. Each incident and problem is evaluated based on business Impact and Urgency to determine resolution or workaround. A severity level is assigned from this assessment. This section provides qualitative definitions for the Severity Levels associated with Services.

“Impact” is defined under ITIL as a measure of the business criticality of an incident, problem or request for change, often equal to the extent of a distortion of agreed or expected Key Performance Measures. Impact is assessed by considering the effect on HHSC’s business operations, including the number and roles of people affected, the business functions supported by the affected systems, and any mandates for delivering outputs within a specified timeframe.

“Incident” is defined under ITIL as an unplanned interruption of service or degradation in the quality of service, or a configuration failure that has not yet impacted service but has the potential to cause a service interruption.

“Urgency” is defined under ITIL as a measure of the business criticality of an incident or problem based on the Impact and on the business needs of the Customer. Urgency is determined by how quickly HHSC's business will be affected by a service loss. A high-impact incident may not require immediate action. For instance, a system with high impact on end-of-month processing may have low urgency if the issue occurs early in the cycle, but high urgency if it occurs near the end. Systems supporting real-time transactions for HHSC may always be considered high Urgency, even with moderate Impact.

Key Performance Measures for resolving an incident or problem may vary based on the assigned severity level.

1.1 Severity Level 1

1. A Severity Level 1 event significantly impacts the operation of an application or service and cannot be circumvented because no workaround is available. This includes errors or outages that disrupt service, affect compliance with regulatory timeframes, jeopardize information privacy, or may result in penalties, fines, or other financial impacts on

HHSC.

2. A Severity Level 1 event is further defined as:

a. A life-safety event or issue;

b. A critical impact on the security of data and information systems;

c. A business or mission-critical system, service, application, equipment, or network component that is substantially unavailable or seriously disrupts normal business operations;

d. An error or outage that affects groups of people or a single individual performing a business or mission-critical function;

RFP No. HHS0016867 Exhibit S

e. An error or outage which:

i. Negatively impacts compliance with regulatory-mandated mailing timeframes, or

ii. Jeopardizes the privacy of information, or

iii. Could lead to the imposition of penalties, fines, or other financial impacts on

HHSC.

3. An event that, due to its immediate effect on critical business functions, requires an immediate response and change.

1.2 Severity Level 2

1. A Severity Level 2 event can materially affect HHSC and cause a substantial impact, including missed output commitments not governed by regulatory mandates.

2. A Severity Level 2 event is defined as:

a. A department or group can use a business-critical system, service, application, equipment, or network component, but some functions are unavailable or not working properly, or

b. An error or outage affects a group or groups of people, or a single individual performing a critical business function.

3. A Severity Level 2 event does not require an immediate response, but a change must be made through the Change Management Process.

1.3 Severity Level 3

1. A Severity Level 3 event does not materially affect HHSC or cause a substantial impact, but could do so if not resolved quickly.

2. A Severity Level 3 event is defined as:

a. A group or individual experiences an issue accessing or using a system, service, application, network component, or key feature, but it does not prevent work.

3. The event does not require an immediate response, but a change must be made through the Change Management Process.

1.4 Severity Level 4

1. A Severity Level 4 event may require extended resolution time, but a reasonable workaround is available for the affected individual or group.

2. The event does not impact HHSC business operations because:

a. Of the nature or extent of the fault, and

b. An acceptable workaround is already in place.

3. The event does not require immediate resolution, but a change must be made through the Change Management Process.