SI PWS SLA Attachment.pdf

Attachment 001 - Service Level Agreement (SLA) 1 Enterprise Resource Planning (ERP) 2

VA-26-000769 3

1. SLAs, Service Credits and Remedies 6 The ERP Performance Work Statement (PWS) establishes service level and 7 performance requirements applicable to the Contractor’s enterprise System Integrator 8 responsibilities. These requirements are intended to measure enterprise operational 9 stability, user experience, business continuity, modernization performance, integration 10 reliability, and service efficiency. 11 The Contractor shall measure and report SLA performance with respect the base and 13 any exercised optional tasks. Contractor performance reports shall be accurate, 14 complete, and submitted in accordance with the reporting schedule established in the 15 contract. Acceptable quality levels, metric definitions, and reporting content 16 requirements are defined in each applicable SLA table. Each SLA calculation shall 17 identify the measurement period, data source, numerator, denominator, exclusions, 18 service credits or remedies if applicable, and corrective action requirements when 19 performance does not meet the required level. 20 Unless otherwise specified, the Government shall provide acceptance, conditional 22 acceptance, or rejection within 10 business days of deliverable submission. 23

1.1 Purpose and Scope 25

This section establishes the service credit and remedy framework applicable to 26 Contractor performance under Sections 1.4.1 through 1.4.6. The framework applies to 27 all SLA categories defined in this PWS and is intended to provide the Government with 28 graduated enforcement options proportionate to the severity, duration, and operational 29 impact of performance failures. 30 Remedies established in this section are cumulative and do not limit the Government’s 32 rights under the contract, including the right to issue a cure notice, terminate for default, 33 or pursue any other remedy available under the contract or applicable law. Acceptance 34 of a service credit by the Government shall not constitute a waiver of any other 35 contractual right or remedy. 36 Nothing in this section prevents the Government from requiring a Corrective Action Plan 38 at any time performance is observed to be trending toward non-compliance, regardless 39 of whether a formal Acceptable Quality Level (AQL) breach has occurred. 40 Incident priorities shall be assigned in accordance with the following definitions, subject 42 to Government review and reclassification. The Government may raise incident priority 43 based on mission impact, operational criticality, data sensitivity, executive direction, or 44 impact to a critical business function, regardless of the number of users directly 45 affected. 46

Attachment 001 - Service Level Agreement - ERP

VA-26-000769

Priority Definition Response

Time Resolution

Target

P1 Complete loss of production platform availability or loss of a critical business function affecting 1,000 or more users, with no workaround available.

15 minutes 4 hours

P2 Significant degradation of a production service or loss of a major function affecting 250 or more users, with limited workaround available.

30 minutes 8 hours

P3 Partial loss of non-critical functionality affecting limited users, with an acceptable workaround available.

1 hour 2 business days

P4 Minor issues, cosmetic defect, service question, or low-impact condition with no material operational impact.

1 business day

5 business days

SLA compliance shall be calculated as the number of SLA-applicable incidents resolved 49 within the applicable target divided by the total number of SLA-applicable incidents 50 during the measurement period, multiplied by 100. 51

1.2 Remedy Tiers 53

Performance failures under this SLA shall be subject to the following tiered remedy 54 structure. Tier applicability is determined by the duration and severity of non-compliance 55 as defined in Section 1.4.3. 56 Tier Trigger Government Remedy

Tier 1 - Notice AQL not met in any single measurement period.

Written notice to Contractor;

Corrective Action Plan required.

Tier 2 - Service Credit

AQL not met in 2 consecutive measurement periods, or performance falls to the Credit Threshold defined per SLA.

Invoice reduction per Section 1.4.4.

Tier 3 - Cure Notice

AQL not met in three consecutive measurement periods, or performance falls to the Cure Threshold defined per SLA.

Cure notice issued in accordance with applicable contract terms and clauses;

Contractor must demonstrate correction within 30 calendar days.

Tier Trigger Government Remedy

Tier 4 - Termination

AQL not met in four or more consecutive measurement periods, or Contractor fails to cure within the cure notice period.

Government may pursue termination or other remedies available under the contract.

A measurement period in which the Contractor meets the applicable AQL shall reset the 59 consecutive-period counter for purposes of Tier progression. A reset does not waive the 60 Government’s right to assess credits for prior non-compliant periods or to consider 61 performance history in future remedy determinations. 62

1.3 Corrective Action Plan Requirements 64

Upon receipt of a Tier 1 Notice, the Contractor shall submit a written Corrective Action 65 Plan to the Contracting Officer’s Representative within five business days. The 66 Corrective Action Plan shall include, at minimum: identification of the performance 67 standard that was not met and the measurement period affected; root cause analysis 68 identifying contributing factors; specific corrective actions to be taken, with responsible 69 parties and target completion dates; preventive actions to reduce recurrence risk; 70 expected date by which full AQL compliance will be restored; and any dependencies on 71 Government action required to support restoration. 72 The Government shall review the Corrective Action Plan and provide written acceptance 74 or rejection within 10 business days of receipt. A rejected Corrective Action Plan shall be 75 resubmitted within five business days of rejection notice. Failure to submit a Corrective 76 Action Plan within the required timeframe, or failure to implement an accepted 77 Corrective Action Plan within the approved schedule, shall constitute an independent 78 performance deficiency and may accelerate progression to the next remedy tier at the 79 Government’s discretion. 80

1.4 Service Credit Schedule 82

Where Tier 2 conditions are met, the Government may reduce the applicable monthly 83 invoice by the credit percentage defined below. Credit percentages are applied to the 84 total monthly invoice value for the affected SLA period. Credits shall be reflected as a 85 reduction on the next invoice following the Government’s credit determination. Credits 86 are not automatic. The Government retains discretion to apply or waive credits based 87 on circumstances, operational impact, Contractor remediation progress, and any other 88 relevant contract administration consideration. 89

1.4.1 Enterprise Availability 91

Monthly Availability Credit Threshold Credit Percentage

99.98% - 99.99% Tier 1 - Notice only 0%

99.90% - 99.97% Tier 2 3% of monthly invoice

Monthly Availability Credit Threshold Credit Percentage

99.50% - 99.89% Tier 2 / Tier 3 escalation 5% of monthly invoice

Below 99.50% Tier 3 - Cure Notice 10% of monthly invoice; cure notice may be issued

1.4.2 Incident Response and Service Restoration 94

SLA Compliance Rate Credit Threshold Credit Percentage

90% - less than applicable AQL per priority tier

Tier 1 - Notice only 0%

80% - 89% compliance Tier 2 2% of monthly invoice per priority tier below threshold

70% - 79% compliance Tier 2 / Tier 3 escalation 4% of monthly invoice per priority tier below threshold

Below 70% compliance Tier 3 - Cure Notice 7% of monthly invoice; cure notice may be issued

Credits may be assessed independently per priority tier. A Contractor may incur credits 97 on P1 response without incurring credits on P3 response if those tiers perform 98 differently. Maximum aggregate credit under this subsection shall not exceed 15% of the 99 monthly invoice in any measurement period. 100

1.4.3 Change, Release, and Modernization Performance 102

Successful Change or Release Rate

Credit Threshold Credit Percentage

90% - less than 95% Tier 1 - Notice only 0%

80% - 89% Tier 2 2% of monthly invoice

70% - 79% Tier 2 / Tier 3 escalation 4% of monthly invoice

Below 70% Tier 3 - Cure Notice 7% of monthly invoice; cure notice may be issued

A single failed change that introduces a P1 production incident may independently 105 trigger the incident response remedy under Section 1.4.2 in addition to the change 106 performance remedy under this subsection. The Government may assess both 107 remedies for the same event where both SLAs are independently breached. 108

1.4.4 Integration Reliability and Data Integrity 110

Integration Transaction Success Rate

Credit Threshold Credit Percentage

98% - less than 99% Tier 1 - Notice only 0%

95% - 97.9% Tier 2 2% of monthly invoice

90% - 94.9% Tier 2 / Tier 3 escalation 4% of monthly invoice

Below 90% Tier 3 - Cure Notice 7% of monthly invoice; cure notice may be issued

Integration failures that result in data integrity loss or CMDB corruption shall be treated 113 as a separate deficiency from transaction success rate failures and shall require an 114 independent root cause analysis and corrective action plan regardless of whether the 115 transaction success rate AQL was breached. 116

1.4.5 Security and Operational Resilience 118

Security SLA remedies are structured differently from other SLA categories given the 119 non-negotiable nature of security compliance and the potential for mission impact. 120 Financial credits are not the primary remedy for security failures. The primary remedies 121 are mandatory corrective action and escalation. 122 Failure Type Tier Remedy

Failure to initiate critical security incident response within 15 minutes.

Tier 1 Written notice; Corrective Action Plan within five business days.

Failure to initiate containment within 2 hours of confirmation.

Tier 1 / Tier 2 Written notice; Corrective Action Plan; 2% monthly invoice credit if failure occurs in 2 consecutive periods.

Critical or High vulnerability not remediated within approved timeline.

Tier 1 Written notice; Corrective Action Plan; escalation to CO if unresolved after 15 calendar days.

Repeated failure to meet vulnerability remediation timelines, defined as 2 or more Critical or High vulnerabilities per measurement period.

Tier 2 / Tier 3 3% monthly invoice credit;

cure notice if pattern continues across 2 consecutive periods.

Failure Type Tier Remedy

Security incidents attributable to Contractor failure that results in Government data exposure or operational disruption.

Tier 3 Immediate cure notice;

Government may direct independent security assessment at Contractor expense.

Security remedy determinations shall be coordinated with the VA Security Operations 125 Center and the Information Security Officer before issuance. The CO retains discretion 126 to escalate directly to Tier 3 or Tier 4 for any security failure with confirmed data 127 exposure or mission impact, regardless of prior tier progression. 128

1.4.6 User Experience, Adoption, and Service Efficiency 130

Monthly CSAT Score Credit Threshold Credit Percentage

4.0 - less than 4.5 Tier 1 - Notice only 0%

3.5 - 3.9 Tier 2 1% of monthly invoice

3.0 - 3.4 Tier 2 / Tier 3 escalation 2% of monthly invoice

Below 3.0 Tier 3 - Cure Notice 3% of monthly invoice; cure notice may be issued

CSAT credits shall not apply unless the minimum response volume established in 133 Section 1.4.6 is achieved during the applicable measurement period. Where response 134 volume is insufficient, the Contractor shall still provide trend analysis, user feedback 135 summary, and corrective action recommendations. 136

1.4.7 Aggregate Credit Cap 138

Total service credits assessed across all SLA categories in any single monthly 139 measurement period shall not exceed 15% of the total monthly invoice for that period. 140 The aggregate cap does not limit the Government’s right to issue a cure notice or 141 pursue termination where Tier 3 or Tier 4 conditions are independently met under any 142 SLA category. 143

1.4.8 Credit Assessment Process 145

The Contracting Officer’s Representative shall review monthly SLA performance reports 146 and provide a written recommendation to the Contracting Officer regarding whether 147 credit conditions appear to have been met. The Contracting Officer shall determine 148 whether any credit will be applied and shall notify the Contractor in writing of any credit 149 to be applied. The Contractor may submit a written dispute of a credit determination to 150 the Contracting Officer within 10 business days of notification. Disputed credits shall be 151 resolved through the contract’s disputes process. 152

1.4.9 Non-Waiver 154

The Government’s election not to assess a service credit, issue a cure notice, or 155 exercise any other remedy in a given measurement period shall not constitute a waiver 156 of the Government’s right to assess credits, issue notices, or exercise remedies in any 157 subsequent period. The Government’s acceptance of a service credit shall not 158 constitute satisfaction of any other contractual obligation or limit the Government’s rights 159 under the contract. 160

1.4.10 Contractor-Initiated Disclosure 162

The Contractor shall proactively notify the COR within two business days of identifying a 163 performance failure that has breached or is projected to breach an AQL. Proactive 164 disclosure shall identify the affected SLA, the nature and scope of the performance 165 failure, the estimated duration, contributing factors known at time of disclosure, and 166 initial remediation steps taken or planned. 167 Proactive disclosure shall be considered by the Government when determining remedy 169 tier and credit assessment, but shall not constitute a waiver of the Government’s right to 170 apply applicable remedies. Disclosure that omits material information known to the 171 Contractor at time of submission shall not be treated as a complete proactive disclosure 172 for purposes of remedy consideration. Failure to proactively disclose a known 173 performance failure shall be considered an aggravating factor in remedy determination. 174