SMIT Attch J-7 Service Level Requirements (SLR) Matrix_Final Rev1.xlsx

Title Page

SMIT SLRs & PLRs

Performance Level Requirements (PLRs)

Criteria: Measures the percentage of personnel, based on average staffing level(s), that separate from their current position. Personnel is defined as qualified individuals identified by the contractor to provide the Level of Effort (LOE) ordered via Task Order(s). Average staffing level(s) is defined as mean of the first Wednesday of the reporting period and the last Wednesday of the reporting period. A separation from current position is defined as any instance when personnel are not performing their required duties for a duration of 14 or more consecutive days.

Measurement Formula: Total number of employees separated from current position, during the reporting period ÷ the average staffing level(s) during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude personnel separations that are due to activation to active military service.

2. The contractor shall be allowed to exclude personnel separations that are due to promotion under the same task order (i.e. junior to mid / mid to senior / junior to senior).

3. The contractor shall be allowed to exclude personnel separations that are due to medical leave.

4. The contractor shall be allowed to exclude personnel separations that are due to moves approved in writing by the RCOR.

Target: ≤ 3%

Criteria: Measures the percentage of LOE provided based on total LOE required. LOE is defined as the number of work hours per labor category.

Measurement Formula: Total LOE provided at the work site by personnel with required clearance, education, experience, and certifications, during the reporting period ÷ total LOE ordered at the work site, during the reporting period * 100

Target: ≥ 95%

Criteria: Measures the percentage of Contract Data Requirements List (CDRL) items that are delivered on-time (based on periodicity) and accepted by the Government (without changes required due to quality).

Measurement Formula: Total number of CDRL items received on-time and accepted by the Government (without changes required due to quality), during the reporting period ÷ total number of CDRL items received by the Government during the reporting period * 100

Target: 100.00%

Criteria: Measures the percentage of assets records for devices in the Navy Marine Corps Intranet (NMCI) environment that are accurate, complete and in accordance with the approved Asset Management Implementation Plan (AMIP) and approved Configuration Management Implementation Plan (CMIP).

How Measured: Asset records shall be evaluated using the data attributes identified in Attachment 21; each of these attributes included in this measurement must be accurate within each asset record in order to achieve compliance with the accuracy rate. Accuracy rate shall be calculated independently for unclassified and classified / sensitive assets.

Measurement Formula: Total number of asset records without errors ÷ total number of asset records evaluated * 100

Exclusions:

1. The contractor shall be allowed to exclude each asset from the aggregated score that is on the Asset Audit/Inspections Exceptions List (e.g. assets that are not designated as serially managed, consumables, etc...).

2. The contractor shall be allowed to exclude each asset from the aggregated score that has been added or changed in the CMS due to a lifecycle event that occurred within the last 7 days (time stamp required to validate at inspection).

Target:

Classified = 100% Unclassified = 98% Enterprise Aggregate

NIPR

SIPR

Criteria: Measures the percentage of engineering solutions that complete the "Testing Phase" within the required time frame. Required time frame for completion of the "Testing Phase" shall be based on the timeline listed in the latest Government approved project schedule (prior to CDRL A025 (Test Plan) acceptance).

How Measured: The "Testing Phase" is defined as the time period commencing with Government approval of CDRL A025 (Test Plan) and ending with Government approval of CDRL A027 (Test Report). The "Testing Phase" is inclusive of both laboratory and production testing timeframes to include the development, review, and finalizing of CDRL A026 (Test Procedures); reviewing Installation and Configuration documents; installation of solution in the lab environment; execution of Test Plan and Procedures; and producing and finalizing CDRL A027 (Test Report).

Measurement Formula: Total number of solutions that complete the "Testing Phase" within the required time frame, during the reporting period ÷ total number of Test Reports received during the reporting period * 100

Target: ≥ 95.00%

Criteria: Measures the number of vulnerabilities in the network environment as identified using the Government's authorized vulnerability scanning tool, and reported monthly. During each reporting period 100% of online assets (e.g. workstations, servers, appliances, switches/routers) shall be tested/scanned.

How Measured:

a) The Contractor will scan the entire environment twice a month (or as directed via the Government Directed Action (GDA) table of the PWS) per PWS requirements for vulnerabilities using the authorized Government vulnerability scanning tool.

b) Following each Pass the Contractor will:

1. Deliver to the Government raw data in machine readable format including a report of vulnerabilities per CDRL A034 (Cyber Ops Status Report) by category and a Plan Of Action and Milestones (POA&M) to resolve identified vulnerabilities per CDRL A047 (SLR/PLR POA&M).

2. Calculate Vulnerabilities Per Machine (VPM) using the formula specified in the "How Measured" formula below.

c) If 1st Pass Scan VPM is greater than the 1st Pass Target then the Contractor will perform a 2nd Pass Scan of non-Compliant Machines identified in the 1st Pass Scan, at the Target Correction Time Periods after the 1st Pass Scan.

d) The tracking and oversight of the components still not repaired after the second pass will shift to the problem resolution Service Level Requirement.

e) A hardware component (includes the overall software stack installed on the machines including, but not limited to, operating systems, middleware or application software, versions and patch levels, Information Assurance (IA) / Computer Network Defense (CND) / Security applications, and schema information for all relevant IA components) with one or more security misconfiguration represents a vulnerable component.

The following steps are used to compute a vulnerability scan technology area average using 10 / 4 / 1 weighting.

1. Finding counts and number of hosts scanned are collected via the vulnerability scanning tool.

2. The average findings per host is then calculated for each severity category.

3. The averages for each severity are combined using a weighted average formula, giving greater emphasis to higher severity findings, resulting in the weighted finding per host average.

Calculation:

Weighted Average = ( f1w1 + f2w2 + f3w3) / ( w1 + w2 + w3) fn = finding / host wn = weight (10/4/1).

*Calculation for VPM will be updated as a result of any changes made in support of Command Cyber Readiness Inspection (CCRI)s.

This Service Level shall be considered failed if the first pass weighted value is exceeded on the first pass scan. To meet the category level requirement, the overall score per category must meet or exceed the second pass requirement. Both the First Pass and Second Pass levels have to be met to meet compliance with the service level.

Categories:

Category 1 / High - Any vulnerability as identified by NNWC Cyber Security Division, the exploitation of which will, directly and immediately result in loss of Confidentiality, Availability, or Integrity.

Category 2 / Medium - Any vulnerability as identified by NNWC Cyber Security Division, the exploitation of which has a potential to result in loss of Confidentiality, Availability, or Integrity.

Category 3 / Low - Any vulnerability as identified by NNWC Cyber Security Division, the existence of which degrades measures to protect against loss of Confidentiality, Availability, or Integrity.

Target (based on Weighted Classification and Category):

First Pass: Weighted value of ≤ 1.49 vulnerabilities per machine Second Pass: Correction ≤ two (2) weeks; weighted value of ≤ 0.99 vulnerabilities per machine Category 1: Weighted value of x10 per vulnerability type found Category 2: Weighted value of x4 per vulnerability type found Category 3: Weighted value of x1 per vulnerability type found

Criteria: Measures the percentage of Information Assurance Vulnerability Alert (IAVA) and Information Assurance Vulnerability Bulletin (IAVB) compliance for all systems on the network. All systems will receive the appropriate vulnerability patches upon connection to the network. For implementations that require hardware changes, schedule compliance will be assessed against a Government-provided GDA and Government-approved Contractor-provided POA&M.

How Measured: Automated tool reporting of systems on the network. Time of measurement starts with issuance of the GDA. GDA issuance occurs after evaluation by the NNWC Cyber Security Division.

IAVM Compliance % = The number of systems that have the most current configuration and definition files / total online systems. IAVM report shall include the IAVM compliance % and the calculations used to obtain the IAVM compliance %.

Target:

Initial Acknowledgement for all IAVA and IAVB is less than 30 minutes (or as referenced as Sev 6 acknowledgment time in GDA table of the PWS) > 95.00% of the time. Status report for all IAVA and IAVB to be reported at least once in a 24 hour period until resolved.

IAVA Compliance ≥ 99.999% within IAVA Software Implementation Time POA&M Compliance for IAVA = 100% within IAVA POA&M timelines and completion date IAVB Compliance ≥ 99.999% within IAVB Software Implementation Time POA&M Compliance for IAVB = 100% within IAVB POA&M timelines and completion date

Criteria: Measures the percentage of pushes to all IA and security components (e.g. Host and Network Based) that are successfully completed within required time frames (exception reporting for updates that failed). A push shall be defined as the deployment of a signature, policy, content, etc., update to a singular device. A push shall be determined to be successfully completed once the singular device has the updated signature, policy, content, etc.

How Measured: Government approval for release of the signature, policy, content, etc. update file shall be the measurement start point; The client successfully receiving and enforcing the updated signature, policy, content, etc. shall be the measurement end point.

Measurement Formula: Total number of pushes successfully completed within the required time frame, during the reporting period ÷ (total number of pushes performed during the reporting period - total number of excluded devices) * 100

Target:

– 100% within 8 hours, for all available components for which the signature update has been tested and approved for release. (Inoperable / inaccessible components shall be excluded). – 100% within 10 days after being directed to deploy, for Host Intrusion Prevention System (HIPS) content updates.

– 100% within 24 hours after release from the vendor, for signature files for all Commercial Off-The-Shelf (COTS) / Government Off-The-Shelf (GOTS) definition and content updates. (Offline assets shall be excluded)

– 100% within 10 days after being directed to deploy, for Custom HIPS signatures.

– 100% within 60 days from release in the HIPS content update, for DISA HIPS signatures tuned and prepared to be placed into their recommended setting.

– 100% within 4 hours after being directed to deploy, for Emergent and/or Cybersecurity Service Provider (CSSP) / Defensive Cyber Operations (DCO) signatures.

Criteria: Measures the percentage of time that identified instances of unwanted files are removed from the network and from the contractor's backup systems and media, within required time frames. Once the contractor identifies any unwanted files on the network, they shall alert the Government and request permission to remove. Measurements will be split into seven categories: Quarantine, Scan Intiation, File Removal, Scan Report, File Removal 2nd Pass, Government Notification, and POA&M Submission.

Quarantine is defined as isolation of an unwanted file by removing the file(s) rights and containing the file(s) in a manner where it cannot be accessed by regular file management utilities. File removal is defined as electronic spillage where classified information, Personally Identifiable Information (PII), Controlled Unclassified Information (CUI), Naval Nuclear Propulsion Information (NNPI), or Community of Interest (COI) information has been introduced on an IT system, network, or component that is not authorized to hold or process such information.

How Measured: Contractor receipt of the GDA shall be the measurement start point; initiation and/or completion of the required action shall be the measurement end point.

Measurement Formula: Total number of file removal actions initiated / completed within the required time frame, during the reporting period ÷ total number of file removal actions initiated / completed, during the reporting period * 100

Target: ≥ 95.00% for the following actions:

Quarantine ≤ 30 minutes Scan Initiation ≤ 30 minutes File Removal 1st Pass ≤ 24 hours Scan Report ≤ 96 hours File Removal 2nd Pass ≤ 120 hours Government Notification ≤ 168 hours POA&M Submission ≤ 24 hours after failure of any of the six other categories.

Quarantine Aggregate

Scan Initiation Aggregate

File Removal 1st Pass Aggregate

Scan Report Aggregate

File Removal 2nd Pass Aggregate

Govt. Notification Aggregate

POA&M Submission Aggregate SLR 8.1 Authentication and Authorization Services Site and Circuit Authorization Package Execution Criteria: Measures the percentage of accurate authorization packages, approved per the requisite process and submitted within the required time frame.

An authorization package shall be defined as a unique eMASS (or replacement) record processed through the SCA and/or NAO queues and receives a specific approval. An accurate authorization package shall be defined as one which is not returned to the contractor for updates or rework of information or deliverables from any queue. An accurate authorization package shall consist of all information and deliverables required by the defined PMW-205 process, at the time of submission. A queue shall be defined as an authorization process step through which the authorization package moves after the contractor submits an authorization package to the first government-controlled queue. A government-controlled queue shall be defined as one where an authorization package has been delivered outside of the contract company and into a queue where PMW205 controls the process and prioritization. Required time frames are as follows (unless separately negotiated): Full Authorizations / Reauthorizations / Decommissions (excluding circuit authorization) ≤ 70 days prior to impact date, Baseline Changes (excluding seat / space addition / change) ≤ 70 days prior to impact date, Administrative Updates ≤ 70 days prior to impact date, Circuit Authorizations ≤ 120 days prior to impact date, Seat / Space Additions / Changes (travel not required) ≤ 21 days from receipt of required artifacts, Seat / Space Additions / Changes (travel required) ≤ 60 days from receipt of required pre-travel artifacts. Seat / Space Additions / Changes shall qualify as (travel required) only for instances when field services have to travel in excess of 50 miles to perform the service.

How Measured: Authorization packages not submitted within the required time frame will be counted against every reporting period until they are submitted. Impact date for the reauthorization of an existing authorization is the termination (expiration) date. Impact date for anything other than what is defined above, is the provided/negotiated date.

Measurement Formula: Total number of accurate authorization packages approved through the first government-controlled queue, submitted within the required time frame, during the reporting period ÷ (total number of authorization packages approved through the first government-controlled queue, submitted within the required time frame, during the reporting period + total number of authorization packages not submitted and past the required submission date) * 100

Enterprise Aggregate

NIPR

SIPR

SLR 8.1 continued Authentication and Authorization Services Site and Circuit Authorization Package Execution

Target: ≥ 95.00% for required time frames are as follows (unless separately negotiated):

Full Authorizations / Reauthorizations / Decommissions (excluding circuit authorization) ≤ 70 days prior to impact date Baseline Changes (excluding seat / space addition / change) ≤ 70 days prior to impact date Administrative Updates ≤ 70 days prior to impact date Circuit Authorizations ≤ 120 days prior to impact date Seat / Space Additions / Changes (travel not required) ≤ 21 days from receipt of required artifacts Seat / Space Additions / Changes (travel required) ≤ 60 days from receipt of required pre-travel artifacts.

Seat / Space Additions / Changes shall qualify as (travel required) only for instances when field services have to travel in excess of 50 miles to perform the service.

Enterprise Aggregate

NIPR

SIPR

SLR 8.2 Authentication and Authorization Services Solution Authorization Package Execution Criteria: Measures the percentage of accurate authorization packages, approved per the requisite process and submitted within 70 days of the Impact Date.

An authorization package shall be defined as a unique eMASS (or replacement) record processed through the SCA and/or NAO queues and receives a specific approval. An accurate authorization package shall be defined as one which is not returned to the contractor for updates or rework of information or deliverables from any queue. An accurate authorization package shall consist of all information and deliverables required by the defined PMW-205 process, at the time of submission. A queue shall be defined as an authorization process step through which the authorization package moves after the contractor submits an authorization package to the first government-controlled queue. A government-controlled queue shall be defined as one where an authorization package has been delivered outside of the contract company and into a queue where PMW205 controls the process and prioritization.

How Measured: Authorization packages not submitted within the required time frame will be counted against every reporting period until they are submitted. Impact date for the reauthorization of an existing authorization is the termination (expiration) date. Impact date for anything other than what is defined above, is the provided/negotiated date.

Measurement Formula: Total number of accurate authorization packages approved through the first government-controlled queue, submitted within the required time frame, during the reporting period ÷ (total number of authorization packages approved through the first government-controlled queue, submitted within the required time frame, during the reporting period + total number of authorization packages not submitted and past the required submission date) * 100

Target: ≥ 80.00%

Enterprise Aggregate

NIPR

SIPR

SLR 8.3 Authentication and Authorization Services Authorization Package Validation Criteria: Measures the percentage of accurate authorization packages, approved per the requisite process and validated within 21 days of receipt of the package.

An authorization package shall be defined as a unique eMASS (or replacement) record processed through the SCA and/or NAO queues and receives a specific approval. An accurate authorization package shall be defined as one which is not returned to the validator for updates or rework of information or deliverables from any queue. An accurate authorization package shall consist of all information and deliverables required by the defined PMW-205 process, at the time of submission. A queue shall be defined as an authorization process step through which the authorization package moves after the contractor submits an authorization package to the first government-controlled queue.

How Measured: Authorization packages not validated within the required time frame will be counted against every reporting period until they are validated.

Measurement Formula: Total number of accurate authorization packages approved through the SCA and NAO queues, validated within the required time frame, during the reporting period ÷ (total number of authorization packages approved through SCA and NAO queues, validated within the required time frame, during the reporting period + total number of authorization packages not validated and past the required validation date) * 100

Target: ≥ 95.00%

Enterprise Aggregate

NIPR

SIPR

SLR 9 Authentication and Authorization Services Authentication and Authorization Criteria: Measures the percentage of initial end-user cryptographic logon requests that validate the end-user's identity and successfully permit access to network resources, within the required time frame, ≤ 30 seconds. Initial end-user cryptographic logon requests shall be defined as each users first logon attempt per day.

Measurement Formula: Total number of initial logon requests that are successfully processed within the required time frame, during the reporting period ÷ total number of initial logon requests that occur during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when Defense Information Systems Network (DISN) service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during (pre-approved / authorized) maintenance/service down-times.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that originates via Remote Access Service (RAS).

Target: ≥ 99.00%

Enterprise Aggregate

NIPR

SIPR

HIT Sites

Site Level

Peak Service Hours

SLR 10.1 Security Event Management Services Security Event Detection Criteria: Measures the percentage of security events / incidents detected at all severity and priority levels on both unclassified and classified networks in accordance with CJCSM 6510.01 (series). Once classified into a severity level or a priority level, Incidents and Events will remain at that severity level or priority level until they have been resolved.

Measurement Formula: Total number of all security events / incidents that were detected, during the reporting period ÷ total number of all security events / incidents (determined by the govt.) to have occurred during the reporting period * 100

Target:

SEV 01 GDA ≥ 95.00%

SEV 02-06 GDA ≥ 85.00%

SEV 1 Aggregate

SEV 2-6 Aggregate SLR 10.2 Security Event Management Services Security Event Reporting Criteria: Measures the percentage of security events / incidents that are reported to the Navy Cyber Defense Operations Command (NCDOC) / Marine Corps Network Operations and Security Center (MCNOSC) within the required timeframes as specified by CJCSM 6510.01 and SECNAVINST 5239.19 (or latest available instruction). Events / incidents have been split into 9 separate categories, listed in order of priority, and definitions for each can be found in CJCSM 6510.01B. For all categories of events / incidents an update is required at least once every 24 hours until resolved. Once classified into a severity level or a priority level, events / incidents will remain at that severity level or priority level until they have been resolved.

Measurement Formula: Total number of all security events / incidents reported to NCDOC / MCNOSC within the required time frame, during the reporting period ÷ total number of all security events / incidents reported to NCDOC / MCNOSC during the reporting period * 100

Target:

1. Root Level Intrusion (Incident) ≥ 95.00% in ≤ 30 min

2. User Level Intrusion (Incident) ≥ 95.00% in ≤ 1 hour

3. Unsuccessful Activity Attempt (Event) ≥ 75.00% in ≤ 4 hours

4. Denial of Service (Incident) ≥ 95.00% in ≤ 30 min

5. Non-Compliance Activity (Event) ≥ 95.00% in ≤ 4 hours

6. Reconnaissance (Event) ≥ 75.00% in ≤ 4 hours

7. Malicious Logic (Incident) ≥ 95.00% in ≤ 30 min

8. Investigating (Event) ≥ 75.00% in ≤ 2 hours

9. Explained Anomaly (Event) ≥ 75.00% in ≤ 4 hours

Criteria: Measures the percentage of time that security events / incidents are effectively responded to, following detection and priority / severity level classification, within the required time frame. An "effective response" is defined as being able to attain an outcome as prescribed by CJCJM 6510.01 (series) within a specified period of time. Once classified into a severity level or a priority level, events / incidents will remain at that severity level or priority level until they have been resolved.

Measurement Formula: Total number of security events / incidents that are effectively responded to within the required time frame, during the reporting period ÷ total number of all security events / incidents responded to during the reporting period * 100

Target:

SEV 01 GDA (Category 1, 2, 4, 7) ≥ 99.00% in ≤ 1 hour SEV 02-06 GDAs (Category 3, 5, 6, 8, 9) ≥ 98.00% in ≤ 3 hour

SEV 1 Aggregate

SEV 2-6 Aggregate SLR 11 Order to Delivery Account Creation Criteria: Measures the percentage of time that an active and useable account is created within the required time frame. Will not exceed 500 accounts per service request.

How Measured: Receipt of the service request shall be the measurement start point; and notification of an active (visible in Active Directory) account being created shall be the measurement end point.

Measurement Formula: Total number of accounts created within the required time frame, during the reporting period ÷ total number of accounts created during the reporting period * 100

Target: ≥ 50.00% in ≤ 24hours; ≥ 99.00% in ≤ 48hours

24hours 48hours

NIPR

24hours 48hours

SIPR

24hours 48hours

SLR 12.1 Order to Delivery Print Services Delivery/Installation (Tier I & II) Criteria: Measures the percentage of time that a network printer / plotter / scanner is delivered and installed at an NMCI site within the required time frame, ≤ 21 days. Successful installation is defined as the device being fully functional for end users to include any required configuration and mapping.

How Measured: Receipt of an approved / accepted task order shall be the measurement start point; and notification of printer / plotter / scanner availability shall be the measurement end point. Measurements will pause for any actions required on the part of the Government.

Measurement Formula: Total number of network printer / plotter / scanner orders that are completed within the required time frame, during the reporting period ÷ total number of network printer / plotter / scanner orders, scheduled to be delivered and installed during the reporting period * 100

Exclusions:

The contractor shall be allowed to exclude each network printer / plotter / scanner service request from the aggregated score where a wall jack is not available for installation.

Target: ≥ 99.00%

Enterprise Aggregate

HIT Sites

Site Level SLR 12.2 Order to Delivery Network Printer Delivery (Tier III) Criteria: Measures the percentage of network printer / plotter / scanner orders that are delivered to the specified location with the required time frame, ≤ 30 days. Delivery shall be defined as complete once the Government receives and accepts a shipment.

How Measured: Receipt of an approved / accepted task order shall be the measurement start point; arrival of the network printer / plotter / scanner at the specified site shall be the measurement end point.

Measurement Formula: Total number of deliveries that are completed within the required time frame, during the reporting period ÷ total number of deliveries scheduled to occur during the reporting period * 100

Exclusions:

Applies only to those printers purchased off of the SMIT contract.

Target: ≥ 99.00%

Enterprise Aggregate

HIT Sites

Site Level SLR 12.3 Printing Services Network Printer Installation (Tier III) Criteria: Measures the percentage of network printer / plotter / scanner installations that have been completed within the required time frame, ≤ 7 days. Installation shall be defined as complete once the network printer / plotter / scanner(s) has been placed on the network and is fully operational.

How Measured: Receipt of an approved / accepted task order shall be the measurement start point; completed installation of the network printer / plotter / scanner shall be the measurement end point.

Measurement Formula: Total number of installations that are completed within the required time frame, during the reporting period ÷ total number of installations scheduled to occur during the reporting period * 100

Target: ≥ 99.00%

Enterprise Aggregate

HIT Sites

Site Level SLR 13 Printing Services Print Service Availability Criteria: Measures the percentage of print transactions, between 1MB - 5MB in size, that are successfully sent from NMCI connected devices and their (assigned) print server, within the required time frame, ≤ 5.00 seconds.

Measurement Formula: Total number of print transactions, between 1MB - 5MB in size, that are successfully sent within the required time frame, during the reporting period ÷ total number of print transactions, between 1MB - 5MB in size that occur during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when the Cloud service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

4. The contractor shall be allowed to exclude each transaction from the aggregated score that originates from a Tier 5 site.

Target: ≥ 99.70%

Enterprise Aggregate

NIPR

SIPR

HIT Sites

Site Level

Peak Service Hours

SLR 14 Enterprise Messaging Services Email Service Availability Criteria: Measures the percentage of email transactions, between 1MB - 5MB in size, that are successfully sent or received between NMCI connected devices and their (assigned) email server, within the required time frame, ≤ 5.00 seconds.

Measurement Formula: Total number of email transactions, between 1MB - 5MB in size, that are successfully sent or received within the required time frame, during the reporting period ÷ total number of email transactions, between 1MB - 5MB in size that occur during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when the Cloud service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

4. The contractor shall be allowed to exclude each transaction from the aggregated score that originates from a Tier 5 site.

Target:

ENT ≥ 99.70%

MOC C2 ≥ 99.90%

Enterprise Aggregate

NIPR

SIPR

HIT Sites

Site Level

Peak Service Hours SLR 15 Data Storage Services File Share Service Availability Criteria: Measures the percentage of file share transactions, between 50MB - 100MB in size, that are successfully sent or received between NMCI connected devices and their (assigned) file share server, within the required time frame, ≤ 10.00 seconds.

Measurement Formula: Total number of file share transactions, between 50MB - 100MB in size, that are successfully sent or received within the required time frame, during the reporting period ÷ total number of file share transactions between 50MB - 100 MB in size that occur during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when the Cloud service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

4. The contractor shall be allowed to exclude each transaction from the aggregated score that originates from a Tier 5 site.

Target:

ENT ≥ 99.70%

MOC C2 ≥ 99.90%

NIPR

SIPR

HIT Sites

Site Level

SLR 16 Enterprise Web Portal Services Web Server Responsiveness Criteria: Measures the percentage of web access transactions that are successfully processed and returned within the required time frame. If the website is Public Key Infrastructure (PKI) enabled, then the web server uses PKI services to authenticate the end user. This results in an authenticated website displayed in the end user’s internet browser.

Measurement Formula: Total number of web access transactions that are successfully completed within the required time frame, during the reporting period ÷ total number of web access transactions that occur during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when the Cloud service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

4. The contractor shall be allowed to exclude each transaction from the aggregated score that originates from a Tier 5 site.

Target:

ENT ≥ 98.50% in ≤ 4 seconds; ≥ 99.50% in ≤ 6 seconds MOC C2 ≥ 99.50% in ≤ 4 seconds; ≥ 99.90% in ≤ 6 seconds

NIPR

SIPR

HIT Sites

Site Level

SLR 17 Application Hosting Services (AHS) Application Responsiveness (Government Apps) Criteria: Measures the percentage of application access transactions that are successfully processed and returned within the required time frame. Access transactions can occur for both a web-based or non-web enabled application. If the application is PKI enabled, then the application uses PKI services to authenticate the end user.

Measurement Formula: Total number of application access transactions that are successfully completed within the required time frame, during the reporting period ÷ total number of application access transactions that occur during the reporting period * 100.

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when the Cloud service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

4. The contractor shall be allowed to exclude each transaction from the aggregated score that originates from a Tier 5 site.

Target:

ENT ≥ 98.50% ≤ 4 seconds; ≥ 99.50% ≤ 6 seconds MOC C2 ≥ 99.50% ≤ 4 seconds; ≥ 99.90% ≤ 6 seconds

NIPR

SIPR

HIT Sites

Site Level

Criteria: Measures the percentage of requests submitted by the Government for movement and / or changes to existing services that are successfully completed within the required timeframe, ≤ 3 Days. Move / change requests can apply to both the unclassified and classified NMCI environments.

How Measured: The receipt date / time stamp of the service request shall be the measurement start point; customer confirmation of the request being satisfactorily completed shall be the measurement end point.

Measurement Formula: Total number of requests processed within the required time frame during the reporting period ÷ total number of requests during the reporting period * 100.

Target: ≥ 98.00%

NIPR

SIPR

HIT Sites

SLR 19 Remote Access Services Remote Access Services (RAS) Client Responsiveness:

Criteria: Measures the percentage of RAS connection attempts where the user is granted access to the network within the required time frame. A successful RAS connection is defined as taking ≤ 2 minutes from the last required end user prompt.

Measurement Formula: Total number of successful RAS connections established within the required time frame, during the reporting period ÷ total number of RAS connection attempts during the reporting period * 100.

Target: ≥ 99.00%

Regional Aggregates

(NRFK, SDNI, PRLH)

SLR 20.1 Voice Over IP (VOIP) Options and Services Voice Over Internet Protocol (VoIP) Availability Criteria: Measures the percentage of time that VoIP is available at NIPR end user workstations. This is a measured transaction that is generated from the end user workstation across the full connection infrastructure. VoIP availability shall be measured based on the accumulative total of all "Unavailable Time" derived from all VoIP trouble tickets closed during the reporting period, for the affected systems.

Measurement Formula: (Total number of minutes in the reporting period - total "Unavailable Time" derived from VoIP trouble tickets closed during the reporting period) ÷ total number of minutes in the reporting period * 100.

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when the Cloud service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

3. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

Target: ≥ 99.90%

Enterprise Aggregate

NIPR

HIT Sites

Site Level

Peak Service Hours SLR 20.2 Voice Over IP (VOIP) Options and Services Voice Over Secure Internet Protocol (VoSIP) Availability Criteria: Measures the percentage of time that VoSIP is available at SIPR end user workstations. This is a measured transaction that is generated from the end user workstation across the full connection infrastructure. VoSIP availability shall be measured based on the accumulative total of all "Unavailable Time" derived from all VoSIP trouble tickets closed during the reporting period, for the affected systems.

Measurement Formula: (Total number of minutes in the reporting period - total "Unavailable Time" derived from VoSIP trouble tickets closed during the reporting period) ÷ total number of minutes in the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude each transaction from the aggregated score when DISN service is un-available.

2. The contractor shall be allowed to exclude each transaction from the aggregated score that occurs during maintenance/service down-times.

Target: ≥ 99.90%

Enterprise Aggregate

SIPR

HIT Sites

Site Level

Peak Service Hours SLR 21.1 Electronic Software Delivery Services Electronic Software Delivery Performance - Baseline Software Criteria: Measures the percentage of software products (patches, updates and upgrades) that are successfully delivered to, and installed on, entitled network connected devices. Successful delivery shall be defined as uninterrupted/complete transmission of all required data to an NMCI device. Successful installation shall be defined as the delivered product being fully functional and in the expected useable state.

How Measured: Information will be collected/submitted based on Electronic Software Distribution (ESD) delivery statistics. This data will be audited by the Government or designated third party and tracked via ESD management tools. A successful baseline software change is one in which >93% of entitled End Points have the product completely and successfully installed at the end of the Deployment Period AND in which >98% have the product completely and successfully installed at the end of the Remediation Period.

Measurement Formula: Total number of successful Enterprise Changes during the reporting period ÷ total number of attempted Enterprise Changes during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude changes that result from a directed security push i.e. (IAVA, STIG, GPO, etc.) from the aggregated score.

2. The contractor shall be allowed to exclude all anti-Malware signatures from the aggregated score.

3. The contractor shall be allowed to exclude all devices that are offline during the entire Deployment Period and Remediation Period from the aggregated score.

Target: ≥ 98.00%

Enterprise Aggregate

NIPR

SIPR

SLR 21.2 Electronic Software Delivery Services Electronic Software Delivery Performance - Above Baseline Software Criteria: Measures the percentage of Endpoints (workstations) that have the requested software successfully delivered to, and installed on, entitled network connected devices. Successful delivery shall be defined as uninterrupted/complete transmission of all required data to an NMCI device. Successful installation shall be defined as the delivered product being fully functional and in the expected useable state.

How Measured: Information will be collected/submitted based on Electronic Software Distribution (ESD) delivery statistics. This data will be audited by the Government or designated third party and tracked via ESD management tools. A successful above baseline software change is one in which >95% of entitled End Points have the product installed at the end of the Deployment Period AND in which 100% have the product installed at the end of the Remediation Period.

Measurement Formula: Total number of endpoints with the ordered/requested software successful installed during the reporting period ÷ total number requested endpoints during the reporting period * 100

Exclusions:

1. The contractor shall be allowed to exclude changes that result from a directed security push i.e. (IAVA, STIG, GPO, etc.) from the aggregated score.

2. The contractor shall be allowed to exclude all anti-Malware signatures from the aggregated score.

3. The contractor shall be allowed to exclude all devices that are offline during the entire Deployment Period and Remediation Period from the aggregated score.

Target: 100%

Enterprise Aggregate

NIPR

SIPR

SLR 22.1 Operations GDA Acknowledgement Criteria: Measures the percentage of GDAs issued by the Government where the contractor acknowledges receipt within the required time frame. GDAs will be established and prioritized using Severity Levels One through Six (SEV 01 - SEV 06) with SEV 01 being the most urgent and SEV 06 being least urgent.

Measurement Formula: Total number of GDAs that have been received and acknowledged by the Contractor within the required time frame, during the reporting period ÷ total number of GDAs issued during the reporting period * 100

Target:

SEV 01 GDA = 100.00%

SEV 02-06 GDA ≥ 95.00%

Criteria: Measures the percentage of GDAs where the Contractor has fully complied with all required steps or actions, within the required timeframe. Full compliance includes both acknowledging receipt and completing all associated tasks within the required time frames, as outlined in the GDA table of the PWS. GDAs will be established and prioritized using Severity Levels One through Six (SEV 01 - SEV 06) with SEV 01 being the most urgent and SEV 06 being least urgent.

Measurement Formula: Total number of fully compliant GDAs with a "be completed by" date that occurs during the reporting period ÷ total number of GDAs with a "be completed by" date that occurs during the reporting period * 100

Target:

SEV 01 GDA ≥ 95.00%

SEV 02-06 GDA ≥ 80.00%

Criteria: Measures the percentage of problem tickets where root cause has been identified through diagnosis and error control, within the required timeframe. Root cause identification is defined as documenting the underlying issue or original event causing a problem to include making all supporting technical information available to the Government.

Measurement Formula: Total number of problem tickets where root cause has been identified within required time frame, during the reporting period ÷ total number of problem tickets created during the reporting period * 100

Target:

NIPR ≥ 90.00% in ≤ 20 days SIPR ≥ 98.00% in ≤ 4 days MOC C2 ≥ 98.00% in ≤ 3 days

Enterprise Aggregate

NIPR

SIPR

HIT Sites SLR 23.2 Operations Critical Error - Root Cause Identification Criteria: Measures the percentage of critical problem tickets where root cause has been identified through diagnosis and error control, within the required timeframe. Root cause identification is defined as documenting the underlying issue or original event causing a problem to include making all supporting technical information available to the Government. Critical errors are defined as having significant impact on major systems or resulting in component failures. A major system or component failure is defined as the loss of a core build application, email, VTC, VoIP, VoSIP, computer access or network connectivity where the combined impact meets a Criticial Incident Report (CIR) 1 incident criteria.

Measurement Formula: Total number of critical problem tickets where root cause has been identified within required time frame, during the reporting period ÷ total number of critical problem tickets created during the reporting period * 100

Target:

NIPR ≥ 95.00% in ≤ 7 days SIPR ≥ 98.00% in ≤ 3 days MOC C2 ≥ 98.00% in ≤ 2 days

Enterprise Aggregate

NIPR

SIPR

HIT Sites SLR 24.1 Operations Critical Event Prevention An event is a detectable occurrence in the operations environment. A Critical Event is a network service or infrastructure component alarm that if unattended will interrupt or degrade a user service. Critical Events require actions that will prevent incidents or lessen the time from the alarm trigger until an incident ticket is created. Once an action is taken that prevents an incident or a related incident ticket is created, a critical event is closed. An Incident is defined as a service interruption or degradation of service that impairs the effective use of the service. Critical Event Response Time is defined as the difference in time of when a component alarm occurs and when the Critical Event ticket is closed and/or the incident ticket is created.

Criteria: Measures the percentage of critical events that are acted upon to prevent an Incident from occurring or if they are acted upon within the required time for incident ticket creation (as specified in the Event Management Process Guide).

Measurement Formula: Total number of Critical Events where actions were taken to prevent incidents, during the reporting period ÷ total number of Critical Events occurring during the reporting period * 100

Target: ≥ 75.00%

Criteria: Measures the percentage of critical events that were acted upon to prevent an Incident from occurring or if they were acted upon within the required time for incident ticket creation (as specified in the Event Management Process Guide).

Measurement Formula: Total number of Critical Event Response times that are within the established thresholds, during the reporting period ÷ total number of Critical Events occurring during the reporting period * 100

Target: ≥ 97.90 %

Criteria: Measures the percentage of users impacted by incidents where restoration of service is achieved within the required time frame. An incident is defined as an unplanned service disruption or degradation per the Event Management Process Guide. All customer-facing tickets closed in the month will be assessed, with those involving incident resolution to be correlated based on the total time open.

How…