Additional Terms for managed hosting services

Transcription

1 Service Level Agreement

2 1 Technical Design, Procurement, Housing, Service and Support Technical Design Procurement and Ownership Equipment Housing Service and Support Services Managed Hardware Service Managed Operating System Service Application Foundation Service Application Management IP Addresses Managed Ethernet Switching Services Managed Firewall and Next Generation Firewall services Traffic Management, Load Balancing & SSL Handling Storage as a Service Backup Schedule, Data Retention & Recovery Disaster Recovery Service Levels Operational Hours Incident Management Service Level Objectives Backup and Restore Objectives Disaster Recovery Objectives My Services Reporting Service Exclusions Responsibilities Technical Responsibilities Other Responsibilities Charges & Service Credits Charges payable by the Charges for Additional Services Other Additional Charges Calculation of Service Credits Repeated Availability SLO failures Exclusions to Payment of Service Credits Service Cancellation Insurance Glossary of Terms & Definitions Annex 1 The Technical Design, Inventory and Defined Service Level Objectives Page 2 of 28

3 1 TECHNICAL DESIGN, PROCUREMENT, HOUSING, SERVICE AND SUPPORT provides the with a customised hosting solution for business applications, located within data centres. The Hosting Service is described in further detail in Annex 1 and/or a Purchase Order and such Hosting Service will be provided in accordance with and subject to the provisions set out in this Schedule. In case of conflict, the terms of Annex 1 to this Schedule 2H will take precedence over this Schedule 2H. 1.1 TECHNICAL DESIGN For each Hosting System, will provide a technical design (the Technical Design ) attached in Annex 1. does not warrant that the Technical Design is fit for the particular purpose of the. The Technical Design will consist of an inventory of software, services and any Dedicated Equipment together with a high-level design of the Hosting System. The Technical Design identifies the components of the Hosting System but reserves the right to amend the Technical Design in order to accommodate particular attributes of a data centre or its environment or to comply with local law, however s consent which shall not unreasonably be withheld will be obtained prior to implementing any changes to the Technical Design that will cause a material diminution of the capabilities of the Hosting System. 1.2 PROCUREMENT AND OWNERSHIP Title to Dedicated Equipment A complete list of all hardware provided by for each Hosting System shall be attached to this Agreement as Annex 1. is hereby granted the option to purchase title to the used Dedicated Equipment (other than perpetual software unless expressly identified in writing) for a nominal value of 1. Such option shall be exercised in writing no sooner than one (1) month prior the expiry (but not due to early termination) of the Initial or Renewal Term related thereto. shall maintain a lien overall customer-owned equipment within the data centre in respect of all sums due under this Agreement (including cancellation charges, if any). The Dedicated Equipment will be transferred on an as-is, where-is basis and excludes all warranties and representations in such used Dedicated Equipment to the maximum extent permitted by law. If does not exercise such option prior to the expiry of the Initial or Renewal Term, the option shall lapse provided Dedicated Equipment For any provided Dedicated Equipment, including but not limited to cases where the title for Dedicated Equipment has passed from to, the will ensure that: 1. The provided Dedicated Equipment is always available for at the premises stated in Annex 1 for the relevant term. 2. The provided Dedicated Equipment is subject to a hardware service & replacement contract that meets s standards; and upon such terms that directly enables to exercise the rights therein on s behalf. 3. That has all necessary licences, consents and permits to use provided Dedicated Equipment according to this Agreement. Page 3 of 28

4 In case the fails to meet the provisions under Clause above, renders its services with regard to provided Dedicated Equipment on a reasonable efforts basis only, excluding all Service Credits and liabilities to the maximum extent permitted by law. 1.3 EQUIPMENT HOUSING is responsible for the installation of all equipment incorporated into the Hosting System (whether provided or provided). shall provide space and install the equipment in the Premises. is solely responsible for the choice of the exact location of the equipment in the Premises. Only authorised personnel will have access to the equipment and systems. The may have escorted access to audit the equipment in accordance with the following conditions: (i) there will be no more than two audits in any 12 month period; (ii) the audits will be carried out at the s own risk and cost; (iii) the audits will be carried out during Working Hours and will be undertaken after at least two Working Days prior written notice to ; (iv) s access to the Premises will strictly comply with s access and security policies; (v) where a s service resides on a shared platform, access will only be granted via a software interface to the s specific segregated hosting environment. 1.4 SERVICE AND SUPPORT Hardware Replacement is during the Initial Term responsible for the replacement of defective hardware components of provided Equipment on the supported services for which it has a contractual obligation. Beyond the Initial Term and or with regard to provided Dedicated Equipment has no such responsibility and renders its services with regard to hardware failures on a reasonable efforts basis only, excluding all Service Credits and liabilities to the maximum extent permitted by law. The Parties agree to undertake a review of the Hosting Service prior to the commencement of any Renewal Term to consider whether it is supportable and whether the is satisfied that it meets the s needs. Any revised support agreements or hardware replacement contracts are only binding if agreed in writing and signed by the authorised representative of the parties Hardware Upgrades has no obligation to upgrade any equipment during the Term Software Upgrades has no obligation to upgrade any software versions or to provision or acquire software support if not expressly stated in a Purchase Order or an Annex 1. Software patching will be undertaken according to Annex 1 and this Schedule. 2 SERVICES This Clause 2 describes the portfolio of standard services available to the as part of the Hosting Service. The services actually acquired by the are all set out in the Purchase Order or Annex 1. Any deviation from the terms of this Clause 2 are set out in Annex MANAGED HARDWARE SERVICE Where provides a managed hardware service: Page 4 of 28

5 2.1.1 Equipment Installation is responsible (either directly or through authorized subcontractors) for physically installing all equipment incorporated into the Hosting System (whether provided or provided), including racking, network cabling and providing appropriate power connections to devices Support for supplied or managed equipment is responsible for managing the replacement of defective, failed, or degraded hardware components on the supported services for which it has a contractual obligation; any third party vendors conducting work on premises will do so under the direct supervision of personnel at all times. Support will only be provided based on the fact that such defect, failure or degradation of hardware is not caused wholly or partially by: an act or omission of the, its employees, agents or contractors components not covered by `s hardware replacement responsibility under clause 1.4.1, a subsisting warranty or a vendor support contract incomplete or incorrect information given by the at the time of purchase of the equipment degraded performance occurs due to failure to implement patches and updates as per vendor or s recommendations Dedicated Virtualisation Solution (Private Cloud) Where has provided a dedicated infrastructure for the deployment of virtual devices, will be responsible for the management of the infrastructure, including maintenance of the hypervisor software. will upgrade the hypervisor software should it be required to meet the platform standards as defined by. Hypervisor upgrades can be requested by the, and are subject to the charges for implementation defined in Clause 5.2. If the states in the relevant Purchase Order or Annex 1 to this Schedule that the does not require management of virtual devices operating on the private cloud from, then will provide the with administrative access to a management system to manage virtual devices. will offer no warranty or service level for a dedicated virtual Hosting Service where the Serviced Software is identified as the root cause of any issue; the will be subject to the charges defined in Clause 5.2 for any technical assistance provided relating to an managed component which is identified to be at fault Technical Assistance shall provide reasonable technical assistance in the event that the requires assistance with their equipment. The technical assistance includes placing software media, such as CD- ROMs, in s equipment. reserves the right to charge for technical assistance at the rates set out in Clause Service Monitoring will provide ICMP availability monitoring for managed hardware devices. The will be responsible for any other required monitoring and will be responsible for informing should any action be taken in relation to hardware Incidents Data Backup will not provide backup service for the managed hardware service. Data backup services can be provided as part of the managed operating system service with specific details of the service provided included in Annex 1. Page 5 of 28

6 2.2 MANAGED OPERATING SYSTEM SERVICE Where provides a managed Operating System service, will provide a managed hardware service described in and subject to Clause 2.1 above plus the following services: Licensing and Service Provider License Agreements (SPLA) Managed operating system services will include relevant licensing for backup, monitoring and Serviced Software. has partnered with a number of vendors, currently VMware, Microsoft and Symantec as a service provider under their relevant usage based SPLA programs. Unless specified, where provides licensing from these vendors, licensing will be included within the monthly service charge. Licenses are treated as monthly rentals of software. Upon termination of the s service provided by, licenses granted to the will be returned to. Where provides licensing under a SPLA agreement, the license granted to the is subject to the terms and conditions of the SPLA Agreement, which will be provided to the by upon request. Alternately, the may assume Licensing responsibility for software, such as Operating Systems, middleware or databases, this will be set out in Annex 1. Where the holds responsibility for licensing software, will ensure that the products are appropriately licensed and will indemnify against any claim, loss or damage incurred by as a result of the supplying unlicensed software or breaching the licensing terms for such software. Any additional Serviced Software that is licensed and provided by will be defined in the Technical Design Operating System Installation will Install and configure the Operating System according to standards and normal industry practice. may configure disk partitioning as it deems appropriate for installation and will install onto a redundant array (where relevant) or as detailed in the Technical Design. The agrees not to use the Operating System disk partition and associated partitions required by the Operating System for data Access Unless specified otherwise, will provide the with administrator or root level access to servers, in order for the to manage elements of the system other than the operating system such as Serviced Software, applications and data. Management access will only be provided for devices as set out in the Technical Design Serviced Software Installation is responsible for the installation, support and servicing of all Serviced Software in the configuration set out in the Technical Design. This includes but is not limited to: backup client for the backup of the Operating System and any flat file data, according to standards and industry practice. anti-virus software onto all new Windows server deployments. will not install Anti-Virus software onto Unix and Linux servers unless included within the Technical Design. monitoring tools. Page 6 of 28

7 The agrees not to directly access Serviced Software or modify any configuration without prior consent from Serviced Software Installation Serviced Software may be installed on a server at s own risk. reserves the right to uninstall Serviced Software (or refuse to permit installation) without having any liability to the where, in s reasonable opinion, the software will affect the operations or security of any other Hosting System hosted by. Serviced Software is not supported or serviced by. does not accept any liability for impact to solution availability or performance as a result of Serviced Software. The is solely responsible for the performance of Serviced Software and for its inter-operability with the Hosting System., will ensure that all customer Services Software is appropriately licensed and will indemnify against any claim, loss or damage incurred by as a result of the supplying unlicensed software or breaching the licensing terms for the Serviced Software, accepts no liability for license requirements for Serviced Software Dedicated Virtual Devices (Private Cloud) Where provides a managed Operating System service for Virtual Devices deployed on dedicated hardware, will be responsible for the deployment and management of Virtual Devices on the system. The can request changes to Virtual Device configurations on My Services. Where new Virtual Devices are required, the must request these by contacting the account manager. These devices will be subject to additional Charges. The resource allocations and requirements of the Virtual Devices must be satisfied by the capacity of underlying infrastructure as set out in the Technical Design. Service levels will only apply for high availability function (Clause 3.3) where the required capacity of the underlying infrastructure is available Service Monitoring will monitor the following performance elements of server hardware (excludes Hardware Only service), if supported by the Hosting Device and s standard monitoring: a. CPU usage per CPU b. Memory Usage c. File System Utilization d. Swap File Usage e. Paging f. Number of Processes g. Defective, failed, or degraded hardware components Patch Management Setup As part of the implementation, will agree and implement a patch management schedule according to those defined in Clause of this Schedule for Windows & Linux servers. Prior to the RFS Date will contact the to agree a schedule for the delivery of patching. The has a responsibility to respond and agree a patching schedule with. If the does not agree to a patching schedule, excludes all Service Credits and liability to the maximum extent permitted for the period of time that the Hosting Service is not at the patch level recommended by. Page 7 of 28

8 2.2.9 Backup Capability & Granularity will provide a client-server flat file backup of system data. In the case of servers this will include Operating System data and configuration. This service does not provide support for open file applications. has the right to exclude from backup at its sole discretion files which will not affect the ability to recover from a failure, all other files which are not exclusive or locked within the s Hosting System are backed up. Backups are performed online at file system level only, i.e. transactional files used by various applications such as database volumes or hibernation memory can be backed up, but are required to be in a dumped and closed state before the backup operation starts, otherwise the files may be in a corrupt state once they are restored. does not accept responsibility to any damage caused to the Hosting System by such corrupt files Backup Schedule & Retention Details can be found in Clause Backup Allocation The can utilise an allocated backup Volume for the solution, as defined in the Technical Design. sizes backups based on the backup Volume per server. If the allocated back up Volume for all servers of the is exceeded reserves the right to charge for the excess backup at the rates set out in Clause 5.3 and is not responsible for a correct backup function. In order to avoid future excess back up Charges the may either: (a) (b) purchase a higher allocated backup Volume by contacting their account manager; or change of the backup schedule, durability and/or granularity so that the allocated backup Volume will no longer be exceeded, for which charges will be made at the rates set out in Clause Data Restore Emergency restores will be completed in the timeframe according to Clause 3.4. An emergency restore can be requested a maximum of two times per year per device. Standard restore requests will be initiated during the next Working Day. There is no RTO for standard restore requests. The may request a maximum of one standard restore per device per month. Subsequent emergency and standard restore requests are subject to the charges set out in Clause 5.2. Data restores can be made to either the original location, or to an alternate location on the same device. s responsibility is limited to recovering successfully backed-up data to the original or specified alternate location and accepts no responsibility for configuring systems or applications. 2.3 APPLICATION FOUNDATION SERVICE Where provides an application foundation service, will provide a managed Operating System service (Clause 2.2) plus installation and backup of the application as detailed in the Technical Design. Application Foundation is defined as installed add-on components known as services, which are not required to perform the Operating System Infrastructure function. These services typically form the foundation of applications and associated additional functionality. They normally are required for the management, presentation and storage of associated data for an application. Examples include web and database services. Application Foundation does not include functionality built on these services. Page 8 of 28

9 For the avoidance of doubt, unless specified in the Technical Design is not responsible for the support of these applications, nor is responsible for application packages or updates Application Installation will install the application according to standard practices. The may request alterations to the installation prior to deployment, such as location and features. Requests to make changes to the configuration post implementation may be subject to charges for technical assistance at the rates set out in Clause 5.2. accepts no liability for enforced changes which affect the performance, availability or security of the solution Application backup will provide an enhanced backup service for the defined application to enable application data to be recovered. This feature may include the installation of additional software capable of performing open file backup for applications such as Exchange, MS-SQL or Oracle relational database. must be informed of all database or open file application configurations, including additions or deletions of relevant data stores in order to complete a successful backup and is not responsible if the fails to inform of any changes Database Restrictions Databases can only be restored to the state of their last successful backup. Transaction logs cannot be restored, which may result in loss of changes in data after the moment of the backup. shall not be responsible for an inconsistent database or for any malfunction of the database application after a restore as a result of this behaviour. a. Data restores are limited to restoring the database to its original location. b. cannot support the on the recovery of the application based on the database Backup Schedule & Retention Details can be found in Clause Responsibilities The must: a. Provide any details relating to the database, file store or equivalent open file storage unit software configuration. This includes configuration and application software and configuration affecting it. b. Permit access to the application in order to install and set up the Backup client. c. Provide a user account with system administrator privileges to the application, if applicable. d. Request a data restore to test functionality when major changes are made by the and after installation. 2.4 APPLICATION MANAGEMENT Managed Application services shall be governed by Schedule 2x. If managed application services are ordered but the Master Agreement does not already include a Schedule 2x, the at the date of 's signature of the order the then current version of Schedule 2x shall automatically be deemed incorporated into the Master Agreement. Page 9 of 28

10 2.5 IP ADDRESSES shall provide, as standard, IP addressing for the s requirements as defined in the Internet Access Schedule 2F and in accordance with RIPE regulations. 2.6 MANAGED ETHERNET SWITCHING SERVICES will provide a managed hardware service plus: shall configure and maintain any managed switch service for hosted Local Area Connection (LAN) communications between devices. This will include configuration of any Virtual LANs (VLAN) and switch port configurations. 2.7 MANAGED FIREWALL AND NEXT GENERATION FIREWALL SERVICES Managed firewall and next generation firewall services shall be governed by Schedule 2s. If managed firewall and next generation firewall services are ordered but the Master Agreement does not already include a Schedule 2s, the at the date of 's signature of the order the then current version of Schedule 2s shall automatically be deemed incorporated into the Master Agreement. 2.8 TRAFFIC MANAGEMENT, LOAD BALANCING & SSL HANDLING will provide a managed hardware service plus: is responsible for maintaining any traffic manager or load balancer and policy as agreed with the. Shared or Virtual load balancing or traffic management services are limited to a maximum sustained throughput of 20mbps per instance, should this threshold be exceeded the will be required to upgrade their service. SSL offloading is not available as part of the service. The shall be allowed a reasonable number of changes to their policy for the first month from the Ready for Service Date. Thereafter, the shall be allowed 2 policy changes per month for each load balancing service. Additional policy changes will be charged applying the hourly charges specified in Clause 5.2 of this schedule. Policy changes are restricted to those available within the graphical user interface and do not include the use of command line options or scripting. These options may be supplied as a professional service at the rates defined in Clause 5.2 of this schedule. 2.9 STORAGE AS A SERVICE Where the has purchased a shared storage service will provision the relevant storage from a disk system, with features as defined in the Technical Design Type & Redundancy will provision tier 1 storage from an enterprise class disk array using a high performance storage technology. will provision tier 2 storage from an enterprise class disk array using a low performance storage technology. All disk systems will provide redundancy at a controller, disk loop and disk data (RAID) level Volume, Connectivity and Access Storage volumes quoted by are defined as useable space. Storage will be presented using either a SAN or NAS protocol. Connectivity from the host to the managed storage will only be redundant if specified in The Technical Design. Storage will be presented as follows. Page 10 of 28

11 SAN storage will be connected directly to the host server. will be responsible for configuring the network interface and operating system with required software as appropriate for the connection. will use a dedicated IP connection from the host. The relevant storage will be presented to the Operating System as an additional hard disk in the form of a LUN. The must not alter this configuration. NAS storage (CIFS and NFS) will be connected into the appropriate LAN segment. will configure the appropriate security setting to allow access, and provide the with connection details. The must not alter this configuration Data snapshots Where the has purchased data snapshots for a managed system, will perform scheduled snapshots of data on managed storage devices. All data within a Volume, Share or LUN specified for snapshot will store point in time references to data within a snapshot. Snapshots are performed online at file system level only, i.e. open or transactional files used by various applications such as database volumes or hibernation memory cannot be captured in a snapshot Application Aware snapshots Due to technical constraints, application aware snapshot services are only available for certain applications or restrictions may apply. It is s responsibility to check with whether the Service can be provided. Where application aware snapshots have been purchased, may install an application specific open file snapshot application. will perform scheduled snapshots of data on managed storage devices. The must notify of any transactional or open file locations requiring snapshots, failure to provide this information will exclude the service from any SLAs. In the event that both application aware snapshots and standard data backups are used together, will utilise the application aware snapshots to maintain the application life-cycle (e.g. log truncation, log pruning) Snapshot Allocation & Policy Snapshot backups will only store data which has changed since the previous snapshot. These snapshots occupy space within the Volume that contains the active LUN or Share. It is therefore necessary for the to order additional space for snapshot data within the Volume. It is the s responsibility to ensure that a suitably sized Volume is provisioned to meet the requirements of their data and its snapshots. does not accept responsibility for the inability to write data of any kind to a Volume due to capacity issues arising from snapshot data. In the event that a Volume is unavailable due to reaching capacity from data snapshots, is not responsible for its availability, nor for associated SLAs until availability is established. In the event where a Volume that is snapshotted reaches 98% storage usage of its available Volume size, will attempt to the delete the oldest snapshots, one by one until the actual storage usage is less than 80% of its Volume size. This process will occur to prevent the storage Volume becoming unavailable. accepts that will delete snapshots and therefore will not be able to provide the full retention of snapshot data. Page 11 of 28

12 2.10 BACKUP SCHEDULE, DATA RETENTION & RECOVERY will provide recovery capabilities for relevant data according to the Technical Design Client server backups Schedule and Data Retention Unless an alternative schedule is defined, will perform scheduled, daily incremental backups for six sequential days followed by weekly full backups every seventh day as determined by. The backup images for the full backups are retained for a 28-day period and for the incremental backups for a 14-day period after which time they shall be overwritten or disposed Data snapshots Schedule and Data Retention Unless an alternative schedule is defined, will, where available, perform scheduled snapshots according to the following Schedule and Retention policy. Snapshot Service Snapshot Frequency Snapshot Retention Bronze Daily 4 Weeks (28 snapshots) Silver Every 8 hours 72 hours (9 snapshots) Gold Every 4 hours 72 hours (18 snapshots) Platinum Hourly 72 hours (72 snapshots) Upon expiry of snapshot data retention, this space will be freed for new active or snapshot data. Snapshot data will occupy space within the live data Volume, LUN or Share. It is therefore necessary for the to order additional space for snapshot data within the Volume Data Backup Location The backup images and data are stored on owned and operated equipment on-site at an data centre. If defined as part of the Technical Design, the may choose to have copies of backup media stored off-site and/or copies of storage replicated to additional sites, at an additional cost Backup Window In the event that a backup job of a single service exceeds 40% of the time between backups, will inform the. Once the has been informed is not obliged to perform backups of the service, nor will any SLAs apply to the service in relation to data, until an alternative solution is provisioned or backups complete within the 40% threshold due to changes to data Data Restore Any restore necessary due to an Incident, not attributed to, will be conducted at s request on a 24x7 basis. The is allocated a reasonable number of restore requests within the first month after the Ready for Service Date of an Hosting Service free of charge. Thereafter, the is allowed one restore request per Hosting Device per month with any additional restore requests being made on a chargeable basis at the rates set out in Clause 5.2 of this Schedule. These restores will be conducted at a time mutually agreed between the and. Page 12 of 28

13 It is the s responsibility to recover all applications to their desired state after a successful restore. is not responsible for loss of data caused by incompatibility of Software and s backup software DISASTER RECOVERY Where has provided a multi-site Disaster Recovery solution, the agrees to perform scheduled failover testing with s support team which may incur charges at the rates set out in Clause 5.2 of this Schedule. Service Levels and any associated Service Levels will only apply for 12 months after a successful test, with further tests required for SLA validity for subsequent 12 month periods. A successful test is defined as The availability of suitable infrastructure at a Secondary Site, configured to service similar requests to the Primary Site within the SLOs set out in Annex 1. The agrees to the following conditions for a Disaster Recovery solution; a. Changes to configuration of any system within the Disaster Recovery solution require preapproval by, and may require further failover testing and associated charges. b. Apart from those applications managed by as specified in Annex 1, does not accept responsibility for the configuration of any other applications for Disaster Recovery. c. The failover of IP addresses, network routing and DNS between Primary Site and Secondary Site are not part of the solution, unless expressly stated in the Technical Design. 3 SERVICE LEVELS 3.1 OPERATIONAL HOURS Support Time will provide operational support, Incident management and request fulfilment, as follows. The timing of support (the Support Time ) will be as set out below, unless stated otherwise in Annex 1. 24/7 Support Time will provide support 24 hours a day, 7 days a week. Page 13 of 28 Business Hours Support Time will provide support in Business Hours only. will not provide support outside Business Hours. All Incidents and requests will only be dealt with during Business Hours Implementation Hours Implementations are as standard performed during Business Hours only. For out of hours installations and excess charge will be applied, at the out-of-hours rates in Clause 5.2 of this Schedule Contact Centre s Contact Centre ( CCC ) is the primary point of contact for any problem or request related to the Hosting Service. CCC personnel are on duty on a 24x7 basis. The CCC will handle all support requests and will use reasonable endeavours to ensure that any problems are resolved as quickly as possible.

14 The CCC can be contacted via My Services, phone or and supports the languages English, German, and French. The following information should be provided: a. Organization name b. Account Number as set out in the Service Handover Document c. Service Identifier (SID) as set out in the Service Handover Document d. Issue description e. Contact person f. Contact telephone number & In the interest of security, CCC will only accept service requests from nominated individuals within the organisation as defined in the Service Handover Document. 3.2 INCIDENT MANAGEMENT Incident Reporting Any suspected Incidents should be reported to the Contact Centre using the procedures detailed in the Service Handover Document to be provided on the Ready for Service Date. When reporting an Incident, the should identify the affected Service and provide details of the Incident Incident Duration All Incidents recorded will be reconciled against the corresponding incident ticket raised by the Contact Centre. The exact Incident duration will be calculated as the elapsed time between the Incident being reported to the Contact Centre and the time when Service is restored Maintenance of the Hosting System Maintenance of the Network will be conducted in accordance with applicable clause for maintenance in schedule 1 of this Agreement. Maintenance of the Hosting System and the Premises will be conducted as follows: a. Configuration Maintenance: maintains a record of changes made to the equipment, network and operating system configurations. b. Planned Maintenance: In order to maintain the service, may perform operations that might temporarily disrupt the Hosting Service. These operations will normally be performed between midnight and 6:00 am local time, and will be announced at least seven days in advance, with the exception of Emergency Maintenance. c. Emergency Maintenance: reserves the right to carry out any necessary urgent maintenance on the Hosting System or network connections (for example, installation of crucial security patches / updates) or Premises without s prior approval. Such unscheduled maintenance may result in temporary service outage and such outage will be kept to a minimum. shall inform the of any such unscheduled maintenance as soon as is reasonably practicable to do so. d. Save in case of emergency, will not perform service interrupting maintenance at more than one Data Centre location at any one time. Page 14 of 28

15 e. Anti Virus Updates: The default managed Anti Virus schedule will be configured on newly deployed Managed Operating System Windows servers unless otherwise specified. Anti Virus software will be installed and signature updates performed every 4 hours (if new updates are available). Optionally the can request either that their own Anti Virus software is installed on their server (at the rates defined in Clause 5.2 of this Schedule), or that no Anti Virus software is installed. In requesting one of these options, will not perform Anti Virus management tasks on the server, nor provide any SLAs where a virus may have been the cause. Where a server is under Anti-Virus management by, signatures will be compliant with the software vendor s published and relevant signatures within 72 hours. f. Patch management: Per device or service Patch Management will be provided in accordance with Annex 1, where the terms used have the following meanings: i. Fully Automatic Schedule The Patch Management process will take place once per week, during the scheduled maintenance period. Should the require an alternative day and time for the process this can be stipulated at order and will be deemed as scheduled maintenance. Where a server is part of a Fully Automatic Patch Management Schedule, and managed by, security and critical patches will be compliant with the software vendor s published and relevant patches within 2 weeks. ii. iii. iv. Manual Schedule using Infrastructure will provide patches to servers, but will not install them. The may then install patches at their discretion. The takes full responsibility for patching the server and controlling any required reboots. Schedule The takes full responsibility for environment patching. will not provide any patching service. Manual Schedule will provide a bespoke patching schedule as specified by the for which additional engineer charges will apply at the rates defined in Clause 5.2 of this Schedule. Feature packs, Service packs and general updates will be required to be part of the Manual Schedule. Page 15 of 28

16 3.2.4 Incident Management Response times are measured from the creation of a ticket by the on My Services, an automated system or by the service desk. The following escalation guidelines for standard 24x7 support are used within, and are escalated and targeted as follows: Priority Priority 1 Critical Priority 2 Major Description System hard down, inaccessible from internet Performance degradation, critical data restoration Hours of Operation Target resolution time Reason For Outage (RFO) time 24/7 4 Hours 5 Working Days 24/7 8 Hours 5 Working Days Priority 3 Standard Standard change requests Business Hours Next Working Day N/A Priority 4 Low Standard maintenance & planned works, service questions, password requests Business Hours Two Days Working N/A Change Management a. Change control: is entitled to submit change requests to at any time using the My Services. Where a request is made to to implement a change to the Hosting Service, will consider such changes. Where changes are likely to result in additional work beyond the standard management of the Hosting System, will advise the of any additional charges that may make in order to complete the work, applying the hourly charges specified in Clause 5.2 of this Schedule or such other charges as are agreed at the time. b. responsibilities for change control include tracking proposed and completed changes to systems and services managed by, and informing of any proposed changes that may impact on service performance/availability. initiated change requests will be dealt with applying the prioritisation used for trouble tickets. Page 16 of 28

17 3.2.6 Defined Service Requests & Events For further definition, recognise the following requests, events and categories. Timings are concurrent Category and availability Priority 1 24x7 Issue Monitor failure (ICMP, HTTP, etc.) Emergency security change - suspected or actual security breach (fair use policy applies) Monitored service failure Physical hardware failure Emergency restore request (max 2 per year per device) Level 1 (Generalist) Level 2 (Specialist) Level 3 (Vendor) Resolution Target 15 mins 2 hours 4 hours 4 hours See RPO & RTO Service Level Objectives Priority 2 24x7 Managed device reboot request Managed device service restart request 30 mins 2 hours N/A 2 hours Monitor response time violation 4 hours 8 hours 8 hours Load balancer change request Standard restore request (max 2 per service per month) Priority 3 Business Hours Security policy change (max 2 per service per month) Capacity warning Virtual device change request (max 1 per service per month) N/A Next Working Day Standard restore request Priority 4 Business Hours Information request User admin request VPN configuration request (if manages both endpoints) N/A Two Working Days Requests for Priority 3 or Priority 4 work outside the Business Hours require the to notify one week prior to the requested works, and is subject to agreement by. Charges will apply at the rates specified in Clause 5.2 of this Schedule. Subject to the exclusions detailed in this Agreement, from the time has responded it will use reasonable efforts to resolve the Incident or otherwise address the problem as soon as reasonably practicable. Page 17 of 28

18 3.3 SERVICE LEVEL OBJECTIVES Service Level Objectives (SLO) will apply according to Annex1 to either (i) specific Hosting Services being a group of Hosting Devices, (ii) individual Hosting Devices or (iii) for an entire solution. SLOs are dependent on the technical architecture and its ability to sustain failures without outage. A Hosting Service (against which an SLO is measured) is considered to be Available if any device from any site capable of supporting the Service as part of the Technical Design is considered Available by Successful Test. A Hosting Device is considered to be Available at a certain point in time if a scheduled ICMP Ping has been executed and received an affirmative answer within ten seconds ( Successful Tests ). In order to calculate availability, scheduled ICMP Pings are made to each Hosting Device at 5 minute intervals ( Tests ). For the avoidance of doubt, the objective is a measurement of infrastructure availability and not applications. Availability is measured per month. Support Times are detailed in Annex 1 or a Purchase Order and defined in clause of this Schedule above. For services with 24x7 support all Tests are included in the availability metric. For the purpose of availability measurement, support time excludes maintenance periods. For the avoidance of doubt, as long as one part of a redundant Service is Available, the entire Service is deemed to be Available. If no Annex 1 is applicable the following SLOs will apply: Primary Site Configuration Secondary Configuration Site SLO Objective Availability Single device* None 99.5% Two devices configured for high availability (HA) Two devices configured for high availability (HA) Two devices configured for high availability (HA) None 99.9% Single device 99.95% Two devices configured for high availability (HA) *The table above refers to Hosting Devices where it states device or devices % Page 18 of 28

19 3.4 BACKUP AND RESTORE OBJECTIVES In the event that a service needs to be recovered from backup or snapshot mechanism within the Primary Site, the service will have the following Recovery Time and Recovery Point Objectives to recover to an available service depending on the recovery method and service for the data. Backup Service Recovery Point Objective Recovery Time Objective Standard Backup 24 hours + the duration of the backup Bronze Snapshot 24 hours 2 hours Silver Snapshot 8 hours 2 hours Gold Snapshot 4 hours 2 hours Platinum Snapshot 1 hour 2 hours 2 hours + 1 hour per 50 GB recovered If the backup of a hosting device fails to successfully backup any open or transactional files for which an additional backup function has not been purchased or is not available, the backup will be deemed as successful. will provide the with visibility of partially successful backups. will successfully complete 95% of scheduled backups taken in any one calendar month. Should a scheduled backup be restarted for any reason, this restarted backup will count towards the percentage if successful, but will not count if unsuccessful. Should a restore of data be requested, will successfully recover the requested data from any successful backup within the retention period. provides a 95% success rate SLA for the recovery of data from backup. 3.5 DISASTER RECOVERY OBJECTIVES In the event where a service needs to be recovered at a Disaster Recovery Site the service will have the following Recovery Time and Recovery Point Objectives. Recovery Service Recovery Point Objective Recovery Time Objective No Disaster Recovery Service 24 hours None Active Passive Disaster Recovery Design dependant 24 hours Active Active Disaster Recovery Design dependant <1 hour accepts no liability to recover services where a Disaster Recovery mechanism has not been purchased, nor accepts liability for data loss where data is not stored off-site Initiation of Site Failover will not perform a site failover and recovery to a secondary data centre, unless instructed by an authorised representative of the. may in exceptional circumstances perform a failover to a disaster recovery site without customer instruction. Page 19 of 28

20 3.6 MY SERVICES REPORTING The will be provided access to My Services. This access will allow customers to manage their services and to review the performance of their devices. The following main monitoring types are available: ICMP: provides details of the uptime of the selected device. HEALTH-STATS: provides details of the usage of several components of the selected device. The elements of this type are explained in the next paragraph. HTTP (optional): provides details of the uptime of the web server installed on the selected device. This monitoring type is only enabled on your request by filling in the "Server Monitoring Activation Form" at the end of this document. Further information can be found in the Unified Computing Service Manual. 3.7 SERVICE EXCLUSIONS The Hosting Service does not include any service other than those expressly stated in Annex 1. For the avoidance of doubt in particular (but without limitation) the following services are excluded if not explicitly stated otherwise in Annex 1. a. Development or integration of web site content or application software. b. Design of any kind of network, system or service other than the defined hosted service. c. Protection of data, systems or application against attacks, hack attempts, viruses, worms or Trojan horses, unless appropriate systems and infrastructure is in place; where will provide protection in line with the software or hardware vendor s terms and conditions and s management and update policies. d. Support of the installation of Serviced Software. e. Upgrading the operating system on a Hosting device in its entirety where still supports the current operating system installed on the Hosting Device. All of the operating system upgrades requested by the will be charged for applying the hourly charges specified in Clause 5.2 of this Schedule. f. is not responsible and cannot be held liable for degraded performance in case of physical limitations of the hardware (memory, CPU, disk space, throughput) or software. will notify the of such limitations and will suggest changes to the hardware. If the requires any of these features, they should consult their local Sales contact in order to check for related services. 4 CUSTOMER RESPONSIBILITIES 4.1 TECHNICAL RESPONSIBILITIES Technical Representatives Page 20 of 28

21 The must designate one or more qualified persons as their technical representatives and support points of contact with. These technical contacts can be updated either by phone, fax or and must be provided for both pre and post installation Shutdown and Boot Protection To service the Hosting System, may need to reboot a server. The will ensure that any Serviced Software shuts down and boots correctly. Failures caused by software during shutdown or start of Hosting Devices shall not be s responsibility and shall not be counted as unavailability of the Hosting Device Backup The must ensure that all files requiring restoration conform to the specifications as set forth Clause 2 of this Schedule above Maintenance and Outages The shall in line with the agreed change management process promptly inform of any changes to Serviced Software it intends to undertake or of any outages that the causes or intends to cause Content In addition to the rights and obligations set out in Schedule 1, where the service consists of the storage of information, reserves the right to remove or disable access to the information immediately where will otherwise subject to any liability envisaged by Article 14 of Directive 2000/31/EC (the Directive on Electronic Commerce) or the respective applicable national law implementing this directive without having any liability towards the. The right to access the Hosting Service using a privileged account, for example to maintain data or applications installed on a Hosting Device, is strictly limited to the, its employees and/or its contractors in the process of their work to perform for the and the s affiliates. The must safeguard that only the before mentioned authorised personnel or affiliates shall access the Hosting Service with a privileged account. Passwords shall be complex, changed regularly and kept secure. 4.2 OTHER RESPONSIBILITIES undertakes that it shall: a. advise of changes made to the applications installed on the Hosting System prior to changes being made in line with the agreed change management process; b. ensure any reboots or stopping of monitored services are preceded by contacting Contact Centre (details provided in Service Handover Document); c. report any Incidents or problems with the Hosting Services to the agreed Support number set out in the Service Handover Document as soon as such problems have been identified; d. provide feedback on any maintenance approval requests passed to the within the reasonable times specified within such requests; Page 21 of 28

22 e. provide with the correct list of domains that needs to be pointed at the s servers, where relevant; f. install and set-up a remote access client on their remote computer, where applicable to the Hosting Service for the purposes of remote maintenance of the Hosting Services; g. provide any specific changes to the configuration details for any equipment within the Hosting System; h. not install patches for the operating system or supported applications unless agreed by ; i. ensure that applications are not corrupted, degraded, damaged or compromised due to patches of the operating system. It is not in the responsibility of if a patch of the operating system leads to a corruption, degradation, damage to or compromise of the s applications. can provide a testing and or pre-production environment as part of The Technical Design if required; j. recover all applications to their state prior to service failure, unless manages the application; k. provide to any details relating to the database software configuration. This includes configuration and application software and configuration affecting the database; l. permit access to the Database in order to install and set up a backup client to conduct backups, where relevant; m. permit access to the Database in order to install and set up a monitoring client to conduct process monitoring of the database, where relevant; n. enable SQL user account with system administrator privileges, where relevant; o. configure applications to be redundant where a multi-site solution or failover based solution and SLA is deployed, unless expressively defined as part of s responsibility for the solution; p. do such other things and provide such information as may reasonably request in order for to provide the Hosting Service or manage its facilities; q. not initiate a penetration test without agreeing and complying to the current Penetration Test Agreement. In case a penetration test is undertaken and no respective Penetration Test Agreement was signed, herby agrees that the Penetration Test Agreement is deemed to have been signed and that its stipulations bindingly apply. 5 CHARGES & SERVICE CREDITS 5.1 CHARGES PAYABLE BY THE CUSTOMER Charges for the Hosting Service shall comprise an Installation Charge, a Monthly Charge and Additional Charges. Page 22 of 28