PWS Attachment 11 - PRS and Service Level Definitions.pdf

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Department of Defense

Defense Health Agency

Operations and Sustainment Information Technology (IT) Services Domain and Directory Services Branch (DDSB)

Performance Requirements Summary and Service Level Definitions

Date: 5/28/2025

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Table of Contents

1.0 Performance Requirements Summary

1.1 Basic Services PRS

PRS #1 – Information Security and Assurance

PRS #2 – Customer Service, Training, and Technology Knowledge Transfer

PRS #3 – Weekly and Monthly Activity Reports

PRS #4 – Ticket Management System

PRS #5 – Accurate and Viable Technical Documentation and Solutions

PRS #6 – Maintenance of Enterprise Infrastructure

PRS #7 – Evolving Business Requirements

PRS #8 – Staffing

1.2 Tier 3 Enterprise Management (EM) System Administration Services PRS

PRS #9 – Implementation and Sustainment of Enterprise Management Environment

PRS #10 – Operating System Images Creation and Deployment

PRS #11 – Hardware Driver Package Development and Distribution

PRS #12 – Patch Management Support and Maintenance Window Operations

PRS #13 – Zero-Day Patches Application

PRS #14 – Asset, Software, and Hardware Intelligence, Metering, and License Management Reports

PRS #15 – Enterprise Management Package Creation and Update

PRS #16 – ITC Environment Management and Operation

1.3 Tier 2 Level System Administration Services PRS

PRS #17 – Troubleshooting and Problem Resolution

1.4 Tier 3 Level System Administration Services PRS

PRS #18 – On-Premise and Cloud Solution Management

PRS #19 – EUD Data Encryption Services

PRS #20 – Enterprise System Monitoring

PRS #21 – PKE and PKI Management

1.5 Information Assurance Security Admin Support Services PRS

PRS #22 – System Security Administration and Information Assurance Support

PRS #23 – IS Accreditation Process Support and Update for Enterprise Assets

PRS #24 – Risk Assessment of Modifications and Additions to the System

1.6 IT Knowledge Management Support Services PRS

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #25 – Knowledge Management Framework Maintenance

PRS #26 – IOD DDSB SharePoint Portal Maintenance

PRS #27 – Centralized Repository to Maintain Organizational Foundation Documents

1.7 Configuration/Change Enablement Services PRS

PRS #28 – Configuration Management and Change Enablement

1.8 Senior Configuration/Change Enablement Services PRS

PRS #29 – Performance of Senior CE Duties

1.9 IT Architectural, Identity, and Endpoint Engineering Services PRS

PRS #30 – IT Architecture Engineering Services

PRS #31 – Identity Engineering Services

PRS #32 – Endpoint Engineering Services

2.0 Service Levels

2.1 Performance Category: Incident Management

Incident Response Time – Priority 1 (Critical)

Incident Response Time – Priority 2 (High)

Incident Response Time – Priority 3 (Medium)

Incident Response Time – Priority 4 (Low)

Incident Priority Reassessment Time – Priority 1 (Critical)

Incident Priority Reassessment Time – Priority 2 (High)

Incident Priority Reassessment Time – Priority 3 (Medium)

Incident Priority Reassessment Time – Priority 4 (Low)

Incident Resolution Time – Priority 1 (Critical)

Incident Resolution Time – Priority 2 (High)

Incident Resolution Time – Priority 3 (Medium)

Incident Resolution Time – Priority 4 (Low)

Re-open Incidents

After-Action Report Delivery

Customer Satisfaction – Incident

2.2 Performance Category: Knowledge Management

Knowledge Management Service Requests

2.3 Performance Category: Configuration/Change Enablement

Change Management Compliance

CMDB Reconciliation Accuracy

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Change Request Tracking Report Service Requests

2.4 Performance Category: Continual Improvement

Continual Service Improvement Register

2.5 Performance Category: Infrastructure and Platform Management

Security and Vulnerability Patching

Corrective Action Plan for Identified Security Issues

2.6 Performance Category: Availability

Server Availability (Example) ............................................................. Error! Bookmark not defined.

Appendix A – Severity Levels

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.0 Performance Requirements Summary

This Performance Requirements Summary describes the performance standards and Acceptable Quality Levels (AQL) for the tasks and deliverables required by the PWS. The Government will reference the information in the PRS when conducting surveillance of Contractor performance and determining incentives or remedies.

The Contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

This PRS defines performance standards and service levels for the following areas of the PWS.

5.1 Basic Services

5.2 Tier 3 Level Enterprise Management (EM) Administration Support Services

5.3 Tier 2 Level Systems Administration Support Services

5.4 Tier 3 Level Systems Administration Support Services

5.5 Information Assurance Security Admin Support Services

5.6 IT Knowledge Management Support

5.7 Configuration/Change Enablement Services

5.8 Senior Configuration/Change Enablement Services

5.9 IT Architectural Engineering Services

5.10 Identity Engineering Services

5.11 Endpoint Engineering Services

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.1 Basic Services PRS

PRS #1 – Information Security and Assurance

Reserved. See Information Assurance Security Admin Support Services PRS

PRS #2 – Customer Service, Training, and Technology Knowledge Transfer

PWS

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

5.1.11 Provide information papers, SOPs, and one-on-one training as assigned.

Accuracy: 98% of documentation and training material is accurate at initial submission.

Completeness: 100% meet agency requirements per the documentation guidelines.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Periodic Inspection:

Inspection of documentation deliverables

5.1.12 and 5.1.15

Participate in integrated project teams and task forces designed to streamline workflow or resolve issues.

Completeness: Participate in 80% of technical working groups that align to role, as directed by Government.

Government Input and Feedback: Government leadership critique and reviews

5.1.15 Communicate effectively with

customers.

Timeliness: 100% of communication must be conducted in a timely manner appropriate to the urgency of the circumstance or as determined by DHA.

Government Input and Feedback

5.1.16 Produce customized training

sessions and documentation, as requested.

Accuracy: 98% of documentation and training material is accurate at initial submission.

Completeness: 100% deliverables meet agency requirements per the documentation guidelines.

Periodic Inspection:

- Inspection of deliverables

- Training survey results

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #3 – Weekly and Monthly Activity Reports

PWS

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

5.1.10 Produce weekly reports per

the report delivery schedule.

Timeliness: 100% of the weekly reports are submitted on time.

The report is considered on time if submitted by Friday by 0800 Central Time.

Completeness: Reports are 100% complete at time of submission.

Government Input and Feedback

Periodic Inspection:

Inspection of weekly reports and submission times.

5.1.10 Produce monthly reports per

the report delivery schedule.

Timeliness: 100% of reports submitted on time. The report is considered on time if submitted by 0800 CT on the first Friday of each month.

Completeness: Reports are 100% complete at time of submission.

Government Input and Feedback

Periodic Inspection:

Inspection of monthly reports and submission times.

PRS #4 – Ticket Management System

PWS

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

5.1.3 Perform continuous service

improvement as defined in the Continual Improvement category of Service Level Definitions section 2.4.

Completeness: 100% of Service Improvements have targets and dates.

Government Input and Feedback

Periodic Inspection:

Inspection of deliverables

5.1.9 Create, monitor, update, and

resolve items within the TMS.

Accuracy: 95% of tickets are assigned, acknowledged, and resolved as defined in the Incident Management category of Service Level Definitions section 2.1.

Government Input and Feedback

Periodic Inspection:

Inspection of dashboards and tickets in TMS.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #5 – Accurate and Viable Technical Documentation and Solutions

PWS

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

5.1.13 and 5.1.19

Create and distribute SITREPs and EXSUMs.

Completeness: 100% of SITREPs and EXSUMs include all relevant information and updates.

Timeliness: SITREPs and EXSUMs within the timeframe specified in the Deliverable Schedule.

Government Input and Feedback

Periodic Inspection:

Inspection of deliverables

5.1.15 Produce error-free

documentation.

Timeliness and Accuracy: 95% of documentation is provided on time per the Deliverables Schedule or DHA instruction and acceptable upon initial submission.

Government Input and Feedback

Periodic Inspection:

Inspection of documentation deliverables

5.1.5 Upon request by Government, validate deployment plans for compliance with existing performance limitations of the enterprise servers’ software and report on any degradation of services that may occur as a result of deploying new solution(s).

Accuracy: 98% of reports accurately identify degradation risks.

Timeliness: 100% of communication must be conducted in a timely manner appropriate to the urgency of the circumstance or as determined by DHA.

Government Input and Feedback

Periodic Inspection:

Inspection of deliverables

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #6 – Maintenance of Enterprise Infrastructure

PWS

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

5.1.11 and 5.2.2

Conduct health checks, connectivity, troubleshooting and bandwidth and alert monitoring.

Timeliness: Conduct health checks, connectivity, troubleshooting and bandwidth and alert monitoring within 1 hour of being prompted by the Government-designated alerting tool.

Completeness: Troubleshooting completed for 100% of issues.

Accuracy: Deployed systems must maintain 100% compliance to performance specifications.

Government Input and Feedback

Periodic Inspection:

Monthly review of system uptime and resource availability reports.

PRS #7 – Evolving Business Requirements

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

5.1.12 Analyze evolving business

requirements and industry trends and provide input on new software products/solutions and recommended enhancements to policies, procedures, and technologies.

Timeliness: 100% of communication must be conducted in a timely manner appropriate to the urgency of the circumstance or as determined by DHA.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #8 – Staffing

PWS

REFERENCE MEASUREMENT AQL

METHOD OF

SURVEILLANCE

1.12 Timeliness: Contractor Key

Personnel specified in the Contract are continuously staffed.

Accuracy: Contractor Key Personnel meet the requirements of the role and the labor category to which they are assigned.

Timeliness: Key Personnel fulfillment rate of 100% at all times (no vacancy).

Completeness: 100% of Key Personnel meet the requirements of the assigned role.

Contractor Self-Reporting:

Monthly Contractor Personnel Listing.

Attachment 1 Labor Roles

Timeliness: Contractor personnel are staffed as required to successfully perform the Contractor Services.

Accuracy: Contractor personnel are qualified for their roles and, if applicable, meet the requirements of the labor categories to which they are assigned. Contractor personnel complete all onboarding requirements and submit a signed NDA.

Timeliness:

- 80% of vacancies are backfilled within five business days.

- 100% of vacancies are backfilled within 10 business days.

Accuracy: 100% of Contractor personnel meet all qualifications for their roles and the requirements of their labor categories.

Completeness: 100% of Contractor personnel complete all onboarding requirements and submit a signed NDA.

Contractor Self-Reporting:

- Monthly Contractor Personnel Listing

- Training certificates

- NDAs

- DD 2875 - System Authorization Access Request forms

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.2 Tier 3 Enterprise Management (EM) System Administration Services PRS

PRS #9 – Implementation and Sustainment of Enterprise Management Environment

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.2.1 Assist with the development

and submission of Ports and Protocols documentation.

Timeliness: 100% of PPS Load Sheets are reviewed, updated, and finalized within the designated calendar month.

Periodic Inspection:

Regular Ports and Protocol Monitoring

5.2.2 EM on-premise infrastructure

and client management tools are at the proper approved release levels.

Timeliness: Every 6 months, or per Microsoft release schedule, verify the EM on-premise infrastructure and client management tools are at the minimum approved level per system requirements.

Periodic Inspection:

- Client health is reviewed daily

- Power BI report

5.2.11 Create custom test

environments to provide proof of concept before implementing into production in support of on-premise and MED365 Cloud environments.

Timeliness: 100% of documentation (Continuity of Operations Plan) is submitted within the designated calendar month.

Periodic Inspection:

Inspection of documentation deliverables

PRS #10 – Operating System Images Creation and Deployment

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.2.15 Create initial task sequence

and maintain on a quarterly basis in accordance with operational and security requirements.

Timeliness: 100% of updates completed on or before the quarterly deadline.

Internal team audits

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #11 – Hardware Driver Package Development and Distribution

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.2.13 Develop and maintain process

for modifying EM software and driver packages into Intune packages.

Timeliness: 100% of drivers must be delivered within 7 calendar days of receiving the request.

Periodic Inspection:

Dashboards and tickets in

TMS

PRS #12 – Patch Management Support

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.2.9 Provide patch management

support and maintenance window operations in support of on-premise and MED365 Cloud environments.

Accuracy: 97% of on-premise and MED365 Cloud devices are patched to the compliant level within 2 weeks of deployment.

Internal MECM reporting

PRS #13 – Zero-Day Patches Application

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.2.9 Provide zero-day patch

management support and maintenance window operations in support of on-premise and MED365 Cloud environments.

Accuracy: 97% of on-premise and MED365 Cloud devices are patched to the compliant level within 48 hours of notice.

PRS #14 – Asset, Software, and Hardware Intelligence, Metering, and License Management Reports

PWS REFERENCE PERFORMANCE STANDARD AQL METHOD OF SURVEILLANCE

5.2.8 Utilize default and ad-hoc

reporting tools to provide asset, software, and hardware intelligence, software and hardware metering, and license

Completeness: 100% meet agency requirements.

Timeliness: 100% of reports delivered within the

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PWS REFERENCE PERFORMANCE STANDARD AQL METHOD OF SURVEILLANCE

management reports in support of on-premise and MED365 Cloud environments.

timeline directed by Government.

PRS #15 – Enterprise Management Package Creation and Update

5.2.12 Design and deliver

applications and application packages using available enterprise management products and tools that provide scripting capabilities for MHS/DHA enterprise delivery for both on-premise and MED365 Cloud environments.

Accuracy:

- Maintain 100% compliance to STIG and IAVM specifications.

- All applications and application packages must be at 100% functionality at delivery.

Contractor Self-Reporting:

- Security Audits of the software package before it is delivered

- Review of release notes

PRS #16 – ITC Environment Management and Operation

5.2.18 Manage and operate the

on-premise ITC environment, ensuring system performance and availability requirements are met.

Availability: Systems in the on-premise ITC environment are more than 99% Available, as defined in the Availability Service Level Definition.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.3 Tier 2 Level System Administration Services PRS

PRS #17 – Troubleshooting and Problem Resolution

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.3.1 Maintain and troubleshoot

enterprise level products and services, firmware, and software for both on-premise and MED365 Cloud/Tenant environments.

Accuracy: 100% of tickets are assigned, acknowledged, and resolved as defined in the Incident Management Service Level Definitions.

Periodic Inspection:

- Dashboards and tickets in TMS

- System Center Operations Manager (SCOM)

- Other reports as needed to manage Cloud technology

5.3.7 Create and distribute

Unscheduled Downtime Report (UDR), SITREPs, After Action Reports (AAR), Information Papers and EXSUM documents for critical service outages and/or unplanned interruptions.

Completeness: 100% of unscheduled downtime is acknowledged with appropriate reports with relevant information and updates.

Timeliness: Reports provided within the timeframe specified in the Deliverable Schedule.

Government Input and Feedback

100% Inspection:

Inspection of deliverables

5.3.8 Support DHA’s MED365

eDiscovery in data collection, preservation, processing, review, and production for litigation, investigations, and audits.

Accuracy, Completeness, and Timeliness: 100% of tickets are assigned, acknowledged, and resolved per request from Government

Periodic Inspection:

- Dashboards and tickets in TMS

- MS Purview/ eDiscovery audit

5.3.9 Support DHA’s MED365

eDiscovery in the purging or preservation of data related to spillage, leakage, phishing, or investigations.

Accuracy, Completeness, and Timeliness: 100% of tickets are assigned, acknowledged, and resolved per request from Government

Periodic Inspection:

- Dashboards and tickets in TMS

- MS Purview/ eDiscovery audit

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.4 Tier 3 Level System Administration Services PRS

PRS #18 – On-Premise and Cloud Solution Management

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.10, 5.4.15

Analyze, validate, install, implement, maintain, monitor, and configure current services and tools to manage the encryption services; on-premise; mJAD; Exchange Online; eDiscovery; and MED365 environment.

Availability: Ensure 95% production infrastructure availability, as defined in the Availability Service Level Definition.

Periodic Inspection:

- Dashboards and tickets in TMS

- System Center Operations Manager (SCOM)

- Other reports as needed to manage Cloud technology

5.4.8, 5.4.11 Develop, maintain, validate, and document Disaster Recovery (DR) procedures for all supported device types within the on-premise enterprise.

Completeness: 100% meet agency requirements.

Timeliness: 100% of reports delivered within timeframe requested by Government.

Government Input and Feedback

Periodic Inspection:

- Inspection of deliverables

- Annual DR Tabletop Exercise Results

5.4.13 Prepare After Action Reports

for submitted SITREPs, EXSUMs and UDRs.

Accuracy: 98% of documentation and training material is accurate at initial submission.

Completeness: 100% meet agency requirements per the documentation guidelines.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #19 – EUD Data Encryption Services

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.4.3 Validate data encryption

services on desktops and laptops for adherence with DHA and DoD regulations and policies.

Completeness:

- 100% compliance with security and certification procedures that are attributable to Contractor performance.

- Solution is up to date and operational on 99% of all supported devices.

Government Input and Feedback

Periodic Inspection:

- Inspection of deliverables

- NODAR Report

PRS #20 – Enterprise System Monitoring

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.4.6 Before and after any

remediation actions are engineered and executed, analyze DHA enterprise system monitoring implementation and provide a status report.

Completeness: 100% of status reports at time of submission include adequate information about system availability before and after remediation actions.

Timeliness: 100% of reports delivered within the contracted delivery timeline.

Periodic Inspection:

- Inspection of deliverables

- System Center Operations Manager (SCOM)

5.4.7 Customize enterprise

monitoring rules, alerting, and reporting functions for applicable DHA applications and servers, and produce reports depicting the performance indicators for these applications and servers, such as “uptime” and “downtime.”

Timeliness: 100% of reports delivered within the contracted delivery timeline.

Periodic Inspection:

- Inspection of deliverables

- System Center Operations Manager (SCOM)

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #21 – PKE and PKI Management

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.4.9 Implement digital signature

and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling.”

Manage, and maintain Public Key Encryption (PKE) and Public Key Infrastructure (PKI) in a Windows environment for compliance.

Completeness: 100% meet agency requirements.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.5 Information Assurance Security Admin Support Services PRS

PRS #22 – System Security Administration and Information Assurance Support

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.1.4 Conduct vulnerability scans to

determine the system status by the deadline specified in the Security and Vulnerability Patching Service Level Definition.

Completeness:

- 100% full vulnerability scan of all the required systems.

- 100% compliance in generating and delivering vulnerability scan reports as specified in the Security and Vulnerability Patching Service Level Definition to the system administrator for all designated systems.

Timeliness: Communication within 24 hours to the system administrator the results of the vulnerability scan report.

100% Inspection: Rescan of identified vulnerabilities to verify accuracy and completeness of vulnerability report to ensure 100% compliance.

5.1.4 Report detailed analysis of

missing patches as discovered during vulnerability scan by the deadline specified in the Security and Vulnerability Patching Service Level Definition.

Timeliness: 100% of the time, the report is completed and delivered to the Cyber Security Office via eMASS on a weekly basis by 0800 C.T. unless otherwise specified by DHA.

Completeness: 100% of missing patches are included in the report.

100% Inspection:

- Rescan of identified vulnerabilities to verify accuracy and completeness of vulnerability report to ensure 100% compliance.

- Rescan results must be documented and submitted via a report to the system administrator.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.1.4 Complete POA&Ms for

vulnerabilities that cannot be immediately addressed by deadline specified in the Corrective Action Plan for Identified Security Issues Service Level Definition.

Timeliness: 100% of POA&Ms are complete by the deadline.

Completeness: 100% of POA&Ms include a description of the issue; milestones required for resolution; and corresponding justification for each milestone.

Accuracy:

- 100% of POA&Ms are accepted by the AO-DR and AO upon initial submission.

- 100% of POA&Ms are entered in eMASS.

100% Inspection: eMASS

Government Input and Feedback

5.5.2 Reports status of major

Information Assurance system projects and deliverables.

Accuracy: Report must be 100% complete to reflect actual status without discrepancies.

Completeness: Reports must include all key deliverables.

Timeliness: 100% of reports are submitted as per the designated reporting period.

Periodic Inspection: eMASS

Government Input and Feedback

PRS #23 – IS Accreditation Process Support and Update for Enterprise Assets

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.5.4 Perform routine and random

testing of servers and devices to ensure 100% security compliance per the PWS.

Timeliness: 100% of server tests (routine and/or random) performed within three months.

Periodic Inspection: ACAS and eMASS

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.5.4 Maintain and validate asset

lists within ACAS and eMASS.

Completeness: Asset lists include 100% of assets with no omissions and be updated as needed.

Accuracy: Asset information is precise with details verified against source records or inventory systems.

Periodic Inspection: ACAS and eMASS

5.5.4 Maintain 100% of credentialed

scans by resolving non-credentialing, dead, or misconfigured assets.

Completeness: Maintain 100% credential scan success rate across all applicable assets.

Timeliness: Identify and resolve issues with non-credentialing, dead, or misconfigured assets within 12 hours of detection.

Accuracy: Track and monitor report progress towards maintaining the 100% credential scan success rate while logging actions taken to resolve non-credentialing, dead, or misconfigured assets.

5.5.5 All security violations and

incidents reported up the chain of command immediately.

Timeliness: 100% of violations and incidents must be reported within one hour.

Completeness: Document violations and incidents must include timestamps, and relevant details.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #24 – Risk Assessment of Modifications and Additions to the System

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.1.4 Complete Risk Management

Assessment packages.

Completeness: 100% compliance with risk management assessment package and required security related artifacts and documentation.

Timeliness:

- All packages and documentation reviewed within five business days.

- 100% compliance in reviewing/correcting documentation with 12 hours of receiving feedback.

Accuracy:

- All packages in 100% compliance with security requirements.

- 95% of technical documentation submitted is acceptable before forwarding RA package for approval.

Periodic Inspection: eMASS

Government Input and Feedback

5.5.7 Evaluate and document the

effects of all security system changes, including interfaces.

Accuracy: 100% of evaluations are conducted systematically following DHA Change Management Standards and Procedures and other best practices at time of change.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.6 IT Knowledge Management Support Services PRS

PRS #25 – Knowledge Management Framework Maintenance

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.6.4 and 5.6.7

Create and update technical, procedural, and agreement documentation, transforming technical jargon into fluid, organized, cohesive, and comprehensible documents.

Timeliness: 100% of documentation created as requested by Government or following Knowledge Management Service Requests Service Level Definition.

Accuracy: 98% of documentation material is accurate at initial submission.

Government Input and Feedback

Periodic Inspection:

Government acceptance and signature of final documentation, as required

5.6.5 and 5.6.6

Provide broad-based technical editing and writing skills following DoD guidance on templates and style guides.

Accuracy: 98% of documentation and training material is accurate at initial submission.

Completeness: 100% meet agency requirements per the documentation guidelines.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Periodic Inspection:

Inspection of deliverables

5.6.11 Promote situational awareness

of changes and implementation activities which impact the production environment.

Timeliness: Change notifications published following Knowledge Management Service Requests Service Level Definition.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #26 – IOD DDSB SharePoint Portal Maintenance

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.6.1 Resolution or reassignment to

web services (if necessary) of all SharePoint Portal support requests follows the Knowledge Management Service Requests Service Level Definition.

Timeliness: 100% acknowledgement of all portal support requests within 2 business days.

Government Input and Feedback

Periodic Inspection:

Government acceptance of site

PRS #27 – Centralized Repository to Maintain Organizational Foundation Documents

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.6.12 Ensures that backup and

prevention/recovery files are maintained in a versioned-controlled repository.

Accuracy: 100% of backup and prevention/recovery files are maintained in a version-controlled repository, as required by Government.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.7 Configuration/Change Enablement Services PRS

PRS #28 – Configuration Management and Change Enablement

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.7.1 Document the approval, deployment, and configuration of all Infrastructure system and service CI per the Change Management Compliance Service Level Definition.

Completeness: 100% of approved configuration modifications are documented and tracked in the TMS.

Periodic Inspection:

Dashboards and tickets in

TMS

5.7.2 Manage and maintain the ITSM

CMDB per the CMDB Reconciliation Accuracy Service Level Definition.

Accuracy: 100% of configuration items are maintained in the

ITSM CMDB.

Periodic Inspection: Audits to find undocumented changes

5.7.3 Establish and maintain the

CMDB Dashboard.

Accuracy: CMDB Dashboard must maintain 98% accuracy.

Periodic Inspection:

- Review of CMDB Dashboard

- Review of CM WAR Report

5.7.4 Provide information to

customers and government lead about infrastructure system and service CIs.

Accuracy: 100% of information provided about Cis is accurate.

Timeliness: Requested information is provided within 24 hours or as requested.

Periodic Inspection:

- Review of CMDB Dashboard

- Audits

5.7.5 Create, monitor, update, and

resolve 100% of qualified changes within the TMS.

Completeness: 100% of changes are assigned, assessed, and tracked through final disposition as defined in the Configuration/Change Enablement Service Level Definitions.

Periodic Inspection:

Dashboards and tickets in

TMS

5.7.6 Provide CMDB training to

change coordinators and initiators.

Timeliness: 100% of training is conducted on a quarterly basis.

Periodic Inspection:

- CM WAR

- Training survey results

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.7.6 Track all infrastructure

hardware and software baseline configurations.

Accuracy and Completeness: All IOD System baselines are maintained.

Periodic Inspection: CMDB reporting, audits

5.7.7 Conduct configuration audit

and verification activities to determine undocumented changes and validate accuracy of baseline configurations.

Timeliness: Perform system audits biannually and/or periodically, per IOD Change Advisory Board Charter.

Periodic Inspection:

Inspection of audit results

5.7.8 Conduct configuration status

accounting to track change requests throughout their lifecycle and increase transparency following the Change Request Tracking Report Service Requests Service Level Definition

Timeliness:

- Response to all requests for Change Request Tracking Report within 24 business hours.

- Response to all requests for Configuration Management Status Accounting Reports within 24 hours.

Periodic Inspection:

- CM WAR

- Dashboards and tickets in TMS

5.7.9 Conduct Change Ticket

assessments in order to standardize and strengthen change ticket content.

Accuracy: 100% of assessed changes meet the standards in the CM Work Information Guide.

Periodic Inspection:

Inspection of assessed changes

5.7.10 Conduct Post Implementation

Reviews (PIRs) with teams implementing the change and ensure any unexpected results are recorded prior to closing change request tickets.

Completeness: 100% of High and Medium Risk Changes must have a PIR.

Timeliness: PIR submitted within 36 hours of change reaching the Review state.

Periodic Inspection:

- CM WAR

- CMDB Audits

Contractor Self-Reporting:

Team meeting report outs

5.7.11 Store relevant document CIs in

the Infrastructure KM Centralized repository.

Completeness: 100% of updated configuration files stored in the KM Centralized repository.

Timeliness: Updated configuration files sent to KM Centralized repository within 48 hours of change reaching the Review state.

Periodic Inspection:

- CM WAR

- KM Centralized Repository Audits

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.7.12 Produce, sustain, and support

CE foundational documents.

Accuracy: All change records are reviewed to ensure an accuracy rate of 100% and be free or errors or omissions.

Periodic Inspection:

Inspection of deliverables

5.7.13 Facilitate Change Advisory

Board Meetings, including distributing meeting invitations and meeting minutes.

Timeliness: 95% of meetings held per defined schedule with follow-up within one business day.

Government Input and Feedback: Feedback on meeting facilitation

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.8 Senior Configuration/Change Enablement Services PRS

PRS #29 – Performance of Senior CE Duties

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.8.1 Develop and manage

Infrastructure CE policies, processes, procedures, and plans.

Accuracy: 98% of documentation and artifacts are accurate at initial submission.

Completeness: 100% of submitted items contents meet agency requirements per the documentation guidelines.

Timeliness: 100% of documents and artifacts are delivered within the contracted delivery timeline.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

1.9 IT Architectural, Identity, and Endpoint Engineering Services PRS

PRS #30 – IT Architecture Engineering Services

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.9.1 Develop architectural and

technical designs for IT infrastructure systems or solutions that meet or exceed identified functional and technical requirements.

Create guidance and strategies to build architectures for MHS/DHA systems.

Accuracy: 90% of deliverables is accurate at initial submission.

Completeness: 100% meet agency requirements per Government direction.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Periodic Inspection:

Inspection of deliverables

5.9.4 Review and provide input to

the Initial Request Analysis Meeting (iRAM) and Request Analysis Meeting (RAM) through the Customer Request Review Team (CRRT) initial Customer Request Management (CRM) approval process, including for project funding, requirements, and timelines.

Accuracy: 90% of deliverables is accurate at initial submission.

Completeness: 100% meet agency requirements per Government direction.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Periodic Inspection:

Inspection of deliverables

5.9.5 Develop functional

requirements based on Requirements Worksheets;

coordinate functional requirements validation; and initiate feasibility assessment studies.

Accuracy: 90% of deliverables is accurate at initial submission.

Completeness: 100% meet agency requirements per Government direction.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.9.7 Review and provide input to

incoming project’s configuration and architecture documentation received from engineering.

Verify an incoming solution’s architectural and technical designs for IT infrastructure systems or solutions to ensure they meet identified functional and technical requirements.

Accuracy: 90% of deliverables is accurate at initial submission.

Completeness: 100% meet agency requirements per Government direction.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

PRS #31 – Identity Engineering Services

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.10.1 Create standardized, forward-

looking, compliant designs and solutions for directory services, identity, credentialing, and access management, Cryptographic Key Management, Privileged Identity Management, Privileged Access Management, Identity Automation, Attribute aggregation, PKI, and PKE engineering activities.

Accuracy: 90% of deliverables is accurate at initial submission.

Completeness: 100% meet agency requirements per Government direction.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

PRS #32 – Endpoint Engineering Services

PWS

REFERENCE PERFORMANCE STANDARD AQL

METHOD OF

SURVEILLANCE

5.11.1 Provide engineering, architectural, and Tier 3/4 expertise to deliver forward-looking, compliant, solutions for the MHS hybrid environment in support of standard Application Integration, Application Security, Desktop Engineering, and Service Monitoring functions that enable management to the endpoint.

Develop and engineer a standard framework for centrally deploying and supporting applications and systems within the DHA hybrid production environment and provide a common system and monitoring framework and capability used by other teams to maintain applications, services, and systems.

Accuracy: 90% of deliverables is accurate at initial submission.

Completeness: 100% meet agency requirements per Government direction.

Timeliness: 100% of documents delivered within the contracted delivery timeline.

Government Input and Feedback

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

2.0 Service Levels

This section sets forth qualitative descriptions of the Service Levels. Specific details regarding reporting requirements are to the Government’s discretion.

The Contractor shall follow the DHA Global Service Center (GSC) Priority Definitions to calculate the priority of incidents in the Ticket Management System. Priority is derived from the Impact and Urgency entries in the Ticket Management System. The guidelines for the GSC setting of priorities is described in Appendix A of this

PRS.

2.1 Performance Category: Incident Management

The following tables provide an overview of the Service Levels categorized by tier levels. The Service Levels define the expected timeframes for response, priority reassessment, and resolution of incidents.

Tier 2 Level System Administration Services – 24x7x365

INCIDENT PRIORITY Response Priority Reassessment Resolution P1 - Critical 30 minutes N/A <Follow MIM process> P2 - High 1 hour 2 hours 2 hours P3 - Medium 2 hours 8 hours 24 hours P4 - Low 2 hours 8 hours 48 hours

Enterprise Management and Tier 3 Level System Administration Services – Business Hours/On-Call

INCIDENT PRIORITY Response Priority Reassessment Resolution P1 - Critical 30 minutes N/A <Follow MIM process> P2 - High 1 hour 8 hours 24 hours P3 - Medium 8 business hours 3 business days 5 business days P4 - Low 1 business day 8 hours 10 business days

See following subsections for details about each Incident Management Service Level Definition.

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Response Time – Priority 1 (Critical)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor Acknowledges Priority Level 1 Incidents within the applicable timeframes.

Response refers to the confirmation that the incident is received and logged by the support team.

If an Incident is escalated to Priority 1, then the Response Time measurement restarts upon escalation to Priority 1. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 1 Incidents assigned to the Contractor in Ticket Management System.

Measured as per the listed schedule.

Applicable timeframes below, unless otherwise specified by the Government.

Schedule Timeframe

Tier 2 System Administration

24x7x365 30 minutes

Tier 3 System Administration

Business Hours/On-Call 30 minutes

Enterprise Management System Administration

Business Hours/On-Call 30 minutes

MEASUREMENT

WINDOW Monthly

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Response Time – Priority 2 (High)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor Acknowledges Priority Level 2 Incidents within the applicable timeframes.

Response refers to the confirmation that the incident is received and logged by the support team.

If an Incident is escalated to Priority 2, then the Response Time measurement restarts upon escalation to Priority 2. The SLA clock continues to run if the incident's priority is downgraded. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 2 Incidents assigned to the Contractor in Ticket Management System.

Administration

24x7x365 1 hour

Tier 3 System Administration

Business Hours/On-Call 1 hour

Enterprise Management

Business Hours/On-Call 1 hour

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Response Time – Priority 3 (Medium)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor Acknowledges Priority Level 3 Incidents within the applicable timeframes.

Response refers to the confirmation that the incident is received and logged by the support team.

If an Incident is escalated to Priority 3, then the Response Time measurement restarts upon escalation to Priority 3. The SLA clock continues to run if the incident's priority is downgraded. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 3 Incidents assigned to Contractor in Ticket Management System.

Administration

24x7x365 2 hours

Tier 3 System Administration

Business Hours/On-Call 8 business hours

Enterprise Management

Business Hours/On-Call 8 business hours

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Response Time – Priority 4 (Low)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor Acknowledges Priority Level 4 Incidents within the applicable timeframes.

Response refers to the confirmation that the incident is received and logged by the support team.

The SLA clock continues to run if the incident's priority is downgraded to Priority

4. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 4 Incidents assigned to the Contractor in Ticket Management System.

Administration

24x7x365 2 hours

Tier 3 System Administration

Business Hours/On-Call 1 business day

Enterprise Management

Business Hours/On-Call 1 business day

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Priority Reassessment Time – Priority 1 (Critical)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor reassesses Priority Level 1 Incidents within the applicable timeframes.

Priority Reassessment refers to the adjustment of the priority level assigned to the incident. Reassessment of an incident record ensures that the incident is accurately prioritized based on its impact on users or business and its urgency.

If an Incident is escalated to Priority 1, then the Reassessment Time measurement restarts upon escalation to Priority 1. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 1 Incidents assigned to Contractor in Ticket Management System.

Administration

24x7x365 N/A

Tier 3 System Administration

Business Hours/On-Call N/A

Enterprise Management

Business Hours/On-Call N/A

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Priority Reassessment Time – Priority 2 (High)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor reassesses Priority Level 2 Incidents within the applicable timeframes.

Priority Reassessment refers to the adjustment of the priority level assigned to the incident. Reprioritizing an incident record ensures that the incident is accurately prioritized based on its impact on users or business and its urgency.

If an Incident is escalated to Priority 2, then the Reassessment Time measurement restarts upon escalation to Priority 2. The SLA clock continues to run if the incident's priority is downgraded. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 2 Incidents assigned to Contractor in Ticket Management System.

Administration

24x7x365 2 hours

Tier 3 System Administration

Business Hours/On-Call 8 hours

Enterprise Management

Business Hours/On-Call 8 hours

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Priority Reassessment Time – Priority 3 (Medium)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor reassesses Priority Level 3 Incidents within the applicable timeframes.

Priority Reassessment refers to the adjustment of the priority level assigned to the incident. Reprioritizing an incident record ensures that the incident is accurately prioritized based on its impact on users or business and its urgency.

If an Incident is escalated to Priority 3, then the Resolution Time measurement restarts upon escalation to Priority 3. The SLA clock continues to run if the incident's priority is downgraded. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 3 Incidents assigned to Contractor in Ticket Management System.

Administration

24x7x365 8 hours

Tier 3 System Administration

Business Hours/On-Call 3 business days

Enterprise Management

Business Hours/On-Call 3 business day

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Priority Reassessment Time – Priority 4 (Low)

This Service Level measures the percentage of time the Contractor reassesses Priority Level 4 Incidents within the applicable timeframes.

Priority Reassessment refers to the adjustment of the priority level assigned to the incident. Reprioritizing an incident record ensures that the incident is accurately prioritized based on its impact on users or business and its urgency.

The SLA clock continues to run if the incident's priority is downgraded to Priority

4. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 4 Incidents assigned to Contractor in Ticket Management System.

Administration

24x7x365 8 hours

Tier 3 System Administration

Business Hours/On-Call 8 hours

Enterprise Management

Business Hours/On-Call 8 hours

Domain and Directory Services Branch (DDSB) Performance Requirements Summary and Service Level Definitions

Incident Resolution Time – Priority 1 (Critical)

METRIC DESCRIPTION

This Service Level measures the percentage of time the Contractor resolves Priority Level 1 Incidents within the applicable timeframes.

Resolution refers to closing the incident and implementing a solution.

If an Incident is escalated to Priority 1, then the Resolution Time measurement restarts upon escalation to Priority 1. The Government will provide specific procedures for updating, escalating, canceling, or closing tickets.

METRIC DETAILS

Includes all Priority 1 Incidents assigned to Contractor in Ticket…