DCPDS DRAFT Atch 15 - Performance Metrics - SLAs.docx

Attachment 15 Performance Metrics

1. Percentage of uptime:

This performance metric captures the percentage of scheduled uptime, in minutes, that is actually available for users to operate their respective system (actual uptime) for all Enterprise and Component system environments. Scheduled uptime is the number of minutes in a given month during which the system is normally scheduled to be operational. Scheduled system maintenance will normally be performed during non-operational periods and is considered scheduled downtime, but, in rare circumstances, may occur during normal operational hours. If the resulting downtime is scheduled, coordinated, and approved in advance, it will not be counted as actual downtime. All downtime that has not been coordinated and approved in advance will be considered as actual downtime.

Additional uptime at the request of the customer will not count as either scheduled or actual uptime.

This measurement is calculated by totaling the monthly scheduled uptime for all Enterprise and Component servers, subtracting all monthly actual downtime, and dividing the result by the total monthly scheduled uptime. The resulting percentage is the basis score for this metric. If more than 5 percent (5%) of the total unavailable time is at one (1) Enterprise or Component environment, the basic score is reduced by one score point. If more than 5 percent of the unavailable time is at two (2) Enterprise or Component environment, the score is reduced by two. If more than 5 percent (5%) of the unavailable time is at three (3) or more Enterprise or Component environments, the score is reduced by three.

The report shall consist of listing each Enterprise and Component environment and its monthly score separately.

Note: If a natural disaster occurs initiating a Disaster Recovery, time lost does not count towards this metric.

5 >= 99% 4 >= 98% and < 99% 3 >= 97 and < 98% 2 >= 96% and < 97%;

1 < 96% Minimum score will be a one if points deducted would make the result zero or a negative number.

2. Problem management:

This performance metric evaluates the responsiveness, the quality, and the volume of work performed by the Contractor on all PRs submitted. For this evaluation a problem is considered “fixed” only when the solution is accepted by the Government and patched to the field.

The criteria for this metric can be found in section 2.1.5 of the PWS.

The Contractor will be evaluated on the following expectations:

1. Maintain the quarterly PR count at 50 or below.

2. Demonstrates timeliness in notification and PR resolutions that are tied to each severity level and accepts the Government’s assigned severity level.

3. Quality and timeliness of repairing, testing, and fielding the repaired PR to the system.

5 = Exceeds all three primary expectations 4 = Exceeds two of three expectations and meets the other.

3 = Meets expectations 2 = Meets two of the three expectations and fails one.

1 = Fails to meet two or more expectations

3. Maintenance of database integrity:

Each RSC database is considered the database of record. As such, all subsequent actions rely on accurate data. Once data is corrupted on an RSC database, all future actions processed may be incorrect. In addition, at the Corporate database level (CMIS), data must be valid as it relates to input from all RSC databases. Problems cannot wait until found by users.

The Contractor must be proactive when validating database integrity of the RSCs and CMIS. The Contractor must establish procedures for verifying database integrity on all operational servers on a set schedule. The Contractor will produce a monthly report of the accuracy of data results to verify performance. Measure the database integrity of the RSC’s against CMIS on a rotating monthly basis, e.g Army, Navy, Air Force, 4th Estate. The report shall include the number or records compared and the percentage of data accuracy.

Report will be delivered on the 15th day of the following month.

5 = Quarterly average of data accuracy is >= 99% 4 = Quarterly average of data accuracy is >= 98% 3 = Quarterly average of data accuracy is >= 97% 2 = Quarterly average of data accuracy is >= 96% 1 = Quarterly average of data accuracy is >= 95%

4. Implement Federal & DoD regulatory changes:

These are changes mandated by OPM, Executive Order, Federal Statute, or DoD guidance that have a specified date for implementation.

This performance metric is rated for changes during the quarter in which the regulatory date falls. The mandated change will be scored in each subsequent quarterly release until implemented. If the change falls under the scope of a third party (e.g., software vendor), the Contractor is responsible for coordinating directly with the third party for release. If it becomes evident that the third party will not deliver the product in time to meet the mandated date, the Contractor must initiate action to effect changes.

Note: If no regulatory changes occur during the quarter, this metric is not scored and given a score of zero (0).

5 = Accurate regulatory changes were delivered prior to the required delivery date 80-100% of the time 4 = Accurate regulatory changes were delivered prior to the required delivery date 60-80% of the time 3 = Accurate regulatory changes met the required delivery date schedule 2 = Accurate regulatory changes did not meet the required delivery date 10% of the time.

1 = Accurate regulatory changes did not meet the required delivery date >10% of the time.

0 = N/A to overall score

5. Ability to work with the CPMS management team:

Due to the nature of business in the DoD HR arena, it is critical that the Contractor and the Government work closely together to ensure that operations in the field are effective and efficient.

4 = Contractor is cooperative and responsive, and occasionally exceeds expectations.

3 = Contractor meets CPMS management expectations.

2 = Contractor failed to meet several CPMS management expectations 1 = Contractor regularly fails to meet CPMS management expectations.

6. System backup and COOP planning/testing:

The possibility of a declared disaster is real and present, either natural or manmade. While HR systems for civilians are not considered Mission Critical, they are Mission Essential, and need to be operational shortly after any disaster event. The Contractor has sole responsibility for the DCPDS production COOP. The COOP plan must be initiated within 12 hours after the disaster. Components are responsible for their regional database COOPs but the Contractor is expected to support COOP (system and database administration duties) implementation and testing.

4 = A valid COOP plan is in place, but some problems existed with the annual disaster recovery exercise 3= Meets all disaster recovery requirements including annual testing of plan.

2 = Some segments do not meet COOP plan requirements 1 = No COOP plan exists and fails to perform test.

7. Call center effectiveness/help desk:

There will be calls from the Component Tier 1B helpdesk that require appropriate Contractor assistance when problems are irresolvable at the Component/customer level helpdesk.

4 = Question resolution rate >= 90% and abandonment rate <= 5%;

3 = Question resolution rate >= 85% and abandonment rate <= 7%;

2 = Question resolution rate >= 75% and abandonment rate <= 8%;

1 = Question resolution rate < 75% and/or abandonment rate > 8%.

8. Overall COTR assessment of Contractor:

The COTR will, through input from all Government customers, make an overall assessment of Contractor personnel and services.

4 = Exceeds some expectations 3 = Meets expectations;

2 = Does not meet some expectations 1 = Fails to meet expectations.

9. Information Assurance Management:

Information Assurance Management is critical for the ongoing operations of DCPDS. The contractor must be able to perform a variety of cyber-security activities at a level that will ensure that the personal information contained in the databases are protected in accordance with Federal laws and regulations, and with DoD policy guidance.

This measures how well the contractor is managing their work in support of DPCDS information assurance requirements.

1- Specifically, if expeditious measures are being taken to address each risk found through the DIACAP process, through annual enclave reviews, though quarterly POA&M review and updates, or through a USCYBERCOM message.

2 - Risks that require funding are communicated to CPMS management and accurately reflected in FISMA reporting and budget.

3- POA&Ms are current, regularly updated as progress or events occur, and changes to solutions or completion dates are discussed with and agreed to by the government prior to changing the POA&M.

4 - POA&M items are sufficiently documented with complete rationale or proposal for resolution.

5 – DIACAPs are performed on DCPDS enclaves when scheduled or significant changes occur which require them.

5 = Contractor meets all conditions specified for managing POA&Ms, all DIACAP documentation is delivered on schedule, and all USCYBERCOM messages are responded to and resolved or added to the POA&M within the required timelines.

4 = Contractor does not meet one of the conditions specified for managing POA&Ms and no documentation deliveries are late within the SLA reporting period.

3 – Contractor does not meet one of the conditions specified for managing POA&Ms and a documentation delivery is late within the SLA reporting period.

2 = Contractor does not meet two of the conditions specified for managing POA&Ms, or documentation deliveries are late twice within the SLA reporting period.

1 = Contractor does not meet three or more of the conditions specified for managing POA&Ms or documentation is late more than two times within the SLA period, or fails to respond to a system relevant USCYBERCOM message,

10. One-hundred percent (100%) standard operating environment:

Each DCPDS Component environment (either DCPDS Contractor maintained or Component maintained) may have a variety of hardware configurations based on size and number of records; however, the requirement is for the Contractor to ensure that the optimal configuration of memory, disk space, disk layout, and software levels are maintained across all DCPDS platforms. The standard operating environments also include the CPMS Corporate systems (CMIS, RSO, EXITS, etc.) The Contractor must notify CPMS when any deviation is detected.

This performance metric is based on the number of Component DCPDS operating environments that are compliant with the prescribed, approved configuration. Score is based on the number of Components in compliance with the standard approved operating environment.

Note: The Contractor is not accountable for deviation to the system configuration unilateral introduced by a Component not hosted under this contract.

5 = All Components are in compliance with the prescribed operating configuration or has been advised through CPMS of required chances.

4 = All but one Component are in compliance with the prescribed operating configuration or has been advised through CPMS of required changes.

3 = All but two Components are in compliance with the prescribed operating configuration or has been advised through CPMS of required changes.

2 = All but three Components are in compliance with the prescribed operating configuration or has been advised through CPMS of required changes.

1 = All but four or more Components are in compliance with the prescribed operating configuration or has been advised through CPMS of required changes.

As of: 16 Sep 11