NOTE TO SUPPLIER: SUBMIT RECOMMENDED REMEDIES IN THE SPACES BELOW SLA Definitions Implementation SLA: Include project management tools and practices employed by the Offeror for managing the implementation work effort estimation and service request processes to ensure consistency, accuracy, and timeliness during the implementation process. These SLAs also include Implementation Productivity Requirements that the Offeror must meet during implementation to minimize work defects and ensure timeliness of product delivery. Ongoing Services SLA: Include the performance metrics related to the services that the Offeror must provide in support of the system after Go-Live. Availability and response time of the system is measured from an end-user perspective. Incident: An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet affected service is also an incident for example, – failure of one disk from a mirror set. (ITIL Service Operation, 2011, p. 327) Problem: A cause of one or more incidents. The cause is not usually known at the time a problem record is created, and the problem management process is responsible for further investigation. IITIL Service Operation, 2011, p. 334) Implementation SLA Table 1 – # Service Type Service Performance Target Minimum Interval Remedies Measure Metric 1.0.1 Milestone Actual Actual completion of 100% Weekly Milestones on the Critical completion milestones by baseline Path date completion date 1.0.2 Milestone Completion—All Actual Actual completion of 100% Weekly NOT on Critical completion milestones by baseline Path date completion date System and Information Integrity Flaw Remediation – Contingency Planning SLA Table 2 – SEC501 Service Type Service Performance Minimum Measurement Remedies Control Measure Target Perf % Interval SI-2 The Supplier Vulnerability or 1 time UAT, and No “Critical” remediates security scan once each month “High” flaws1,2 vulnerabilities in production more than 90 Days old. SI-3 The system See definition of operates at normal ‘normal capacity’ capacity in in IT requirements environments employing malicious code protection.1,2 1Virginia ABC relies on the latest information from for scoring of vulnerabilities. scan tool is Nessus. Details as to how those are score items may be referenced here: 2Virginia ABC’s internal
NOTE TO SUPPLIER: SUBMIT RECOMMENDED REMEDIES IN THE SPACES BELOW SLA Definitions Implementation SLA: Include project management tools and practices employed by the Offeror for managing the implementation work effort estimation and service request processes to ensure consistency, accuracy, and timeliness during the implementation process. These SLAs also include Implementation Productivity Requirements that the Offeror must meet during implementation to minimize work defects and ensure timeliness of product delivery. Ongoing Services SLA: Include the performance metrics related to the services that the Offeror must provide in support of the system after Go-Live. Availability and response time of the system is measured from an end-user perspective. Incident: An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet affected service is also an incident – for example, failure of one disk from a mirror set. (ITIL Service Operation, 2011, p. 327) Problem: A cause of one or more incidents. The cause is not usually known at the time a problem record is created, and the problem management process is responsible for further investigation. IITIL Service Operation, 2011, p. 334) Implementation SLA – Table 1 # Service Type Service Measure Performance Target Minimum Metric Interval Remedies 1.0.1 Milestone on the Critical Path Actual completion date Actual completion of milestones by baseline completion date 100% Weekly 1.0.2 Milestone Completion—All Milestones NOT on Critical Path Actual completion date Actual completion of milestones by baseline completion date 100% Weekly System and Information Integrity – Flaw Remediation Contingency Planning SLA – Table 2 SEC501 Control Service Type Service Measure Performance Target Minimum Perf % Measurement Interval Remedies SI-2 The Supplier remediates security flaws1,2 Vulnerability scan No “Critical” or “High” vulnerabilities more than 90 Days old. 1 time UAT, and once each month in production SI-3 The system operates at normal capacity in environments employing malicious code protection.1,2 See definition of ‘normal capacity’ in IT requirements 1Virginia ABC relies on the latest information from for scoring of vulnerabilities. 2Virginia ABC’s internal scan tool is Nessus. Details as to how those are score items may be referenced here:
390314471.docx