Statement of Work MasterKey Provisioning Services Implementation. Submitted by:

Transcription

1 Statement of Work MasterKey Provisioning Services Implementation Submitted by: Prepared for: PO Box Plano, TX SAMPLE COMPANY. DATE Version

2 Table of Contents Page 1. Industry and Company Background Points of Contact Scope of Services Project Management STSG Responsibilities Customer Responsibilities Pre-Deployment Services Pre-Site Services On-Site Services AD Healthcheck Discovery and Assessment On-Site Services MasterKey Implementation and customization POC/Pilot Planning and Design Implementation and Testing into production Roll-out to 200 users for IT support desk and HR s Knowledge and Documentation Transfer Project Closeout Post Installation Software updates and Phone Support Service for one year Customer Assumptions Scope Assumptions Environment and Technical Assumptions Pricing Assumptions Professional Service Pricing Structure Hardware Pricing Out of Scope Services Change Management Payment Termination... 15

3 21. General Appendix A Change Request Form Appendix B: Status Report Appendix C: Weekly Status Report Appendix D: Project Completion Form

4 1. Industry and Company Background Superior Turnkey Solutions Group (STSG) is a highly experienced software development and support company specializing in technologies and services providing software applications, consulting and infrastructure services, and support services focused on User Identity & Access Management (UIAM). These services involve solutions to all aspects of a corporation s need to provision users and contractors, allowing authorized access to IT resources, meeting security and audit policies addressing both HR and IT s IAM requirements. STSG offers Enterprise class software to consolidate and authenticate users from the moment Human Resources processes a new employee or contractor by granting access to IT resources in a timely manner. STSG s MasterKey is a family of software applications based on Microsoft.Net technology that once installed, form a complete single point of provisioning a user. MasterKey allows for user resources to be modified, passwords renewed, and other forms of authentication to be controlled, managed, and audited with assurance that users, internal staff, and hackers cannot make changes without reports and notifications being issued to your security and audit staff. Figure 1 Targeted Customer Departments (STSG), with Development and Support in Tulsa, Oklahoma; and Finance, Sales, Marketing, and Operations in Dallas, Texas, specializes in technologies and services for the provisioning of Information Technology (IT) users requiring passwords to applications and resources requiring secured access. 4

5 SuProv, a subsidiary of STSG, is the focal point for the development of MasterKey and has developed a user provisioning solution around the creation, separation, enforcement, and implementation of user provisioning for all IT system resources deemed necessary in a company. Once installed, this system allows IT and auditors to implement all corporate policies in Active Directory and other systems to be installed, locked down, tracked, and enforced against all users in a company. Users can be employees, contractors, partners, and others needing access. The heart of MasterKey is a front-end system that is driven by the Human Resources department, which manages all employees hiring and firing and tasks the chain of command. It securily logs, categorizes, and reports all activity that impacts Active Directory along with the other systems to appropriate designated management with notification and confirmations in . In today s complex IT world, there are three types of Provisioning Services that companies need to acquire for their users and IT systems. The first type is provisioning servers and the applications that run on them. The second type is the provisioning of services privileges for networks, storage, PC desktops, and user experience. The third type is the provisioning of individual users via their permissions, assigning access to secured systems, applications, resources, and networks from different locations over specified periods. This provisioning of individual users is found in Microsoft Active Directory versions, Novell NDS, SUSE, Red Hat, and MandrakeSoft. Provisioning should happen in a controlled, managed, and auditable environment to protect each company s IT resources. Companies today are challenged to leverage their Information Technology budgets to simplify their operations while providing more value of security access services and management control. Information Technology departments today have the responsibility of creating user access policies, implementing them, carrying them out each day and reporting how well they are being enforced to the auditing department. This is not a healthy situation since they need to directly delegate the active use and reporting of provisioning to be performed by other parts of the organization responsible for their day to day use. The ability by HR to perform the provisioning rather than send a request into IT saves days of time and efforts. The result is that IT can spend its time setting practical security policies that raise the bar to the highest standards while provisioning each department to manage its operations more efficiently to meet their goals. Today, with mergers and other business requirements to maintain multiple secured domains, applications having their own authentication requirements, and remote and local users needing IT resources to perform their jobs, there is the need for a system like MasterKey to manage IAM as it is and not force changes. There is a need for a formal process to provision the right resources to staff assigned long-term projects, temporarily covering maternity leave or assuming an ex-employee s files and information flows. Further, employees that are assigned a long-term project, on maternity leave and the question of what to do with an ex-employee s files and information flow need a formal process to provision the right resources to other staff. 5

6 All information, activities, logging, and changes are contained in a secured SQL database that manages and aggregates all activity and changes made on every transaction by HR, Auditing and Information Technology. STSG recognizes a tremendous corporate need for our user provisioning solution, MasterKey, driven by HR to solve a number of operation pains for our customers. For example, when two companies combine their operations, with competing IT/HR and audit departments having different policies, security and user provisioning in place, they still have to meet government-mandated reporting. We are able to assimilate all the different practices on day one of the merged companies and provide a combined database of each company s provisioning requirements. This is done so that IT and audit security can maintain their policies while HR and the merger committee combine the companies operations and personnel. Thus, companies will realize savings in time, utilizing existing IT resources, and minimizing personnel conflict. 2. Points of Contact Gateway Mortgage Co. Point of Contact: Superior TurnKey Solutions Group, Inc. Point of Contact: Josh B. Thomas President and Founder cell [email protected] Attn: Title: Address: Address: City, State, Zip Phone: Fax: Cell: Karl DeGraff Director of Application Development Phone: (972) cell [email protected] Brent Fuller Director of Operations (918) cell [email protected] Rich Sanner Director, Installation Project Manager cell [email protected] Purchasing Manager: Phone: Accounting: Cathy Davis Comments: PO Box Plano, TX Fax: (918)

7 3. Scope of Services This Project Statement of Work ( SOW ) is between STSG ( Provider ) and ( Customer ), and is subject to the terms and conditions of this Statement of Work Agreement for Professional Services between Provider and Customer. Capitalized terms not specifically defined herein shall have the meaning set forth in the Agreement. In the event of a conflict between the Agreements, Statements of Work, Customer Purchase Orders, or Exhibits, this Agreement shall prevail. The effective date of this Project SOW is October 23, Pricing is valid for a period of thirty (30) days and once signed for the next six months. Services will be performed at the following address: The duration of this SOW is expected to start with three months of work and renewed for additional 90 periods automatically unless notified 60 days in advance of a renewal period. This can be renewed on a quarterly basis and via s, we will track the time used and gain approval if we go over 30 hour of work each month starting in October Services to be provided: 30 hours of programming services each month that will be directed in Friday reports on what has been accomplished and what is to be performed next by the client. Extra hours each month are to be directed by the client and approved in advance. Installation of MasterKey for the service of up to 200 employee contractor to be used while this contract is in effect and consulting services are being rendered each month. The use of the software will be a Right to Use with 30 day written notice along with all updates. Pricing is to be renegotiated on a quarterly basis by number of employees and level of software usage. Service Hours - Unless after-hours services have been purchased, Services will be provided between the hours of 8:00 AM and 6:00 PM local customer time (Business Hours), Monday through Friday, excluding normally observed holidays. Services provided outside these times will be delivered based on availability and will not be subject to additional fees. Overview of Engagement STSG is providing the following services under this SOW with MasterKey 2009 software: Project Management and Reporting Pre-Deployment Services and Health Check On-Site Service Installation of MasterKey 2009 for up to 200 employees and contractors Customization of Applications and interface to provisioned systems for the following as funds beyond the monthly rental of the office with internet connectivity and utilities are included: o Active Directory 2003, HR application and Exchange 2007 included in base o Fax Number List o AxaCore Fax Agent o AxaCore XDoc o Mortgage system Installation and set-up Web services, SQL instance w/ 500MB, XML and SMTP services Testing and rollout 7

8 Documentation Review Knowledge Transfer and training the Help Desk Project Closeout Post Installation Phone Support and Software Updates for 90 days. 4. Project Management STSG project management office will manage and implement the services described under this SOW ( Services ). STSG and Customer will each assign a project manager who will coordinate the activities to be performed under this SOW ( Project Manager ). The Project Manager for each party will serve as the point-of-contact for all communications and any modification to the scope, requirements, or responsibilities under this SOW STSG Responsibilities STSG and/or its Project Manager will perform the following activities: Serve as central point of contact for all service delivery issues. Manage STSG tasks and resources associated with the project, and coordinate activities with Customer. Conduct meetings to communicate roles, responsibilities, review assumptions, and schedule activities. Use standard industry-recognized project management tools and methodologies. Employ a regular reporting mechanism to identify project tasks, next steps, and potential problems. Make any changes associated with the project in compliance with the Change Management Process described in Appendix A. Manage the escalation of issues between STSG and Customer Customer Responsibilities Customer and/or its Project Manager will perform the following activities: Provide reasonable assistance, cooperation, timely decisions and support in connection with the provision of the Services by STSG. Coordinate the scheduling of all necessary resources required for the Services. Obtain all consents, approvals, and licenses required by Customer s suppliers, licensors, and lessors that are necessary to support or permit the provision of Services under this SOW. Manage the escalation of issues between STSG and Customer. 5. Pre-Deployment Services STSG and Customer will complete the services listed below before On-Site Services begin. These services will validate the assumptions, requirements, procedures, and responsibilities set forth in this SOW. In the event any Assumption, requirement, procedure, or responsibility is found to be incorrect, the pricing and/or scope of Services will be modified to reflect the actual operating environment Pre-Site Services a) Pre-engagement phone call reviewing SOW and assumptions 8

9 b) Share contact information and establish travel and lodging requirements c) High-level project plan for tasks in design and assignments of people and resources needed d) Request Customer provide a new Domain Name for testing purposes e) Request VPN for remote access as needed 6. On-Site Services AD Healthcheck The scope of this engagement is to assess Active Directory performance issues and make recommendations Discovery and Assessment a) Perform discovery to determine numbers and types of systems, hardware and preparation needed to support a Windows 2008 server in a Windows 2003 Active Directory environment. b) Interview key customer individuals to gather information about the current environment including: i. Windows ii. Network iii. Servers iv. Storage v. Applications with password authentication vi. Active Domain vii. Services or Resources (DNS, DHCP, WINS, Protocol) c) This information will allow for the development of an appropriate customized solution. d) Document the intended plan going forward with recommendations for resolving the issues affecting usability in the current domain. Note: If troubleshooting is required, a Change Order request will be written and agreed to by all parties. e) Review and finalize associated as-deployed documentation (Design Workbook) 7. On-Site Services MasterKey Implementation and customization POC/Pilot The goal of this Service is to install the SMB Advanced Module, Password user reset module and the SuProv Master Management Console and then custom interface to the other 4 modules listed abo Planning and Design a) Interview key management and IT staff on current environment b) Review each interface starting with the HR module, AD 2003 and Exchange 2007 c) Finalize design and testing of other 4 interfaces in POC d) Design and verify with web interface internal and external the provisioning e) Identify the security policies in place and document Implementation and Testing into production a) Custom configure the application for password setup and authentication b) Customer to provide server with operating system and required Service Packs installed c) Installation and configuration of MasterKey modules d) Installation and interface to all custom modules 9

10 a) Verify network, web domains, IP s, and communication lines in place to users 7.3. Roll-out to 200 users for IT support desk and HR s a) Assist Customer to integrate with current environment b) Customer to make changes in firewall as needed. 8. Knowledge and Documentation Transfer a) Provide informal knowledge transfer with designated customer contacts on all systems installed. This overview does not replace any available customer or formal education courses for the products installed. b) Review and finalize associated as deployed documentation 9. Project Closeout a) Obtain customer sign off acceptance. b) Report on completed engagement and any issues and opportunities for follow-up c) Update the as-deployed design documentation to reflect changes/additions to configuration. 10. Post Installation Software updates and Phone Support Service for one year Software updates and service packs are provided throughout the year with one major release occurring every 18 to 24 months with minor releases every 6 to 12 months. Service packs and bug fixes will be released as needed based on severity of the error and customer expectations. SuProv will provide unlimited support on the actual systems set-up and installed. Unlimited Phone support is provided and available for one year after installation sign-off. The hours are normally seven (7) days a week excluding national holidays where a best effort will be made with a skeleton staff with 4 hour response. Limited phone support during normal 8M to 6PM will lower the maintenance fee by 4 percent should you chose this option each year. The contract above is renewable annually from 30 days before to 30 days after the renewal date each year. Deliverable (200 users) Project Management and Reporting Pre-Deployment Services Gathering information on interfaces, Active Directory, Health Check Total Phase 1: On-Site Services - AD Healthcheck and Assessment Discovery and Assessment current operations w/ Visio Phase 2: On-Site Services Planning and Design with approval Creation of full Project Plan, resource allocation with finalized design Total Duration 1 Days 1 Day 2 Days 1 Days 2 Days 3 Days 10

11 Phase 3: On-Site Services Proof of Concept and Demonstration Software Installation and interface to different provisioned systems(5) Custom programming for each interface module on provisioning and Auto password reset Phase 4: On-Site Services - Implementation and Testing Customizing software tables and 5 sample users Total Phase 5: On-Site Services Roll-out to users, auditors and help desk User and Help Desk Training, reports and finish installation work Phase 6: Knowledge Transfer and final documentation Review with IT, auditors and other interested parties Total Phase 7: Project Closeout and turnover to support desk Clean-up project and transfer to support Total TOTAL Post Installation Phone Support- 5 by 9 with 4 hour response 7 days 2 Days 9 Days 3 Days 1 Days 4 Days 1 Days 1 Days 19 DAYS 90 Days 11. Customer Assumptions The following assumptions are made: Prior to the start of this SOW, Customer will indicate to STSG in writing a person to be the point of contact. All Project communications will be addressed to such point of contact (the Customer Contact ). The Customer Contact will have the authority to act for Customer in all aspects of the Project. The Customer Contact shall have the authority to resolve conflicting requirements. The Customer Contact will ensure that any communication between Customer and STSG is made through the appropriate STSG Project Manager. The Customer Contact will obtain and provide project requirements, information, data, decisions and approvals within one working day of the request, unless both parties agree to a different response time. The Customer Contact will ensure that STSG Project personnel have reasonable and safe access to the Project site and adequate office space, as required. The Customer Contact will help resolve Project issues and ensure that issues are brought to the attention of the appropriate persons within Customer s organization, as required. Customer will provide network access in the work area for Internet and . Customer will provide access to and use of information, data, Customer facilities, equipment, and internal resources as reasonably necessary to deliver the Services Customer will inform STSG of all Logon ID s, passwords, domain specifications, and access issues prior to scheduled Services. 11

12 Customer is responsible for providing all hardware, software, and facilities for the successful completion of this Project. Facilities and power must meet STSG s requirements for the products purchased. Customer will provide technical points of contact who have a working knowledge of the enterprise components to be considered during this Project ("Technical Contacts"). STSG may request that meetings be scheduled with Technical Contacts. Scope of project is based on information gathered to-date and is subject to re-scoping if additional tasks or technical issues arise. Any time spent beyond the projected project hours will be billed to STSG at the Project Staff standard hourly rate. All hardware and software must be on-site and ready to be deployed. Project Staff is not responsible for any Application configurations (i.e. SQL, Exchange, etc.)project Staff assumes no responsibility for unprotected data. 12. Scope Assumptions Service Hours are: o Business Hours - Monday through Friday, 8:00 a.m. to 6:00 p.m. local time (excluding nationally-observed holidays) based on a forty (40) hour week. o Outside Business Hours (Monday Friday) (may incur an addition charge) o Weekends and Holidays (may incur an addition charge) Changes to the mutually agree schedule or modification to the Services will only be in accordance with the Change Management Process. Any time spent beyond the projected project hours will be billed to Customer at the Project Staff standard Time and Materials ( T&M) hourly rate. 13. Environment and Technical Assumptions Provider can leverage the Customer s network to perform the Services if required. Customer provides a single point of contact for resolution of any technical issues which may arise with regard to the network, devices, and any software application. Network infrastructure is stable across all Customer sites. Provider is not responsible for application malfunctions or conflicts between customer applications Customer will provide access to technical personnel for support with any other systems that may need to be accessed or changed to complete the work as outlined in the deliverables. (DNS, Firewall, Service Accounts, SSL Certificates, etc.) 14. Pricing Assumptions Pricing is valid for a period of 3 months from the time of submission to Customer. Prices and/or scope of services will be adjusted by Customer/Provider to reflect actual operating environment if the assumptions are found to be incorrect or there is material failure of the Customer to perform its responsibilities as set forth in this SOW. Any time spent beyond the projected project hours will be billed to Customer at the Project Staff standard T&M hourly rate. 15. Professional Service Pricing Structure 12

13 The base price for the Services to be performed by STSG, optional services price, and applicable cancellation, and rescheduling fees for the Services are listed below: Turnkey Services to be Performed Total Price Project Management and Pre-Deployment Services On-Site Service - Assessment, Healthcheck & Design On Site Service POC, interface and implementation On Site Service User, Help Desk start-up Support On Site Service - Knowledge and Documentation Transfer with closeout of project Consulting Services Price 23 days $0 Discount for Beta site revised number: $100/hour $0.00 Beta site discount for 40 months renewed each 90 days as long as Sample Company is in the program-25% Per month $TBD after 90 days Reduced to office space and utilities Summary for project for software, maintenance and consulting installation charges (includes expenses) Time & Materials with remote travel expenses extra Time & Materials Rates (during Service Hours) 13

14 Notes: 1. Prices for Optional Services listed in the above chart are dependent on such Services being performed at the same time the basic Services are performed. Prices for Optional Services will be subject to increase when such Services are scheduled separately from the basic Services and require a return visit. 2. Cancellation or re-scheduling of any scheduled engagement less than five (5) business days prior to engagement will be subject to the fees listed in the above chart plus any actual, reasonable and customary, expenses incurred. 3. Prices and/or scope of services will be adjusted by STSG to reflect the actual operating environment if the assumptions are found to be incorrect or there is a material failure of Customer to perform its responsibilities as set forth in this SOW. 4. Prices exclude costs for procurement of any hardware or software. 5. Prices include travel expenses. 16. Hardware Pricing Not needed as we will use the customer s existing web and SQL 2005 servers. 17. Out of Scope Services Pricing excludes any services not specified in this SOW, including but not limited to the following: a) Procurement of hardware, software, or other equipment required for the Services. b) Post-installation support on-site. c) Storage configuration consultation, performance tuning, system optimization or other similar services unless specifically noted herein. d) Any data migration. e) Custom scripting of any kind. f) Tape library systems; other hardware or software combinations will be considered custom and will require additional services g) Any cabling or other hardware related activities. h) Disaster recovery, including but not limited to: re-imaging, reloading software applications or recovering backup data. i) Warranty services or remedial hardware maintenance or software maintenance. j) Warranty services for third party products which are not provided by STSG. 18. Change Management When STSG or Customer determines that a change is necessary to refine a process, procedure, or specific responsibility identified in this SOW, the party proposing the change will document the request using the change request form provided in Appendix A ( Change Request ). The receiving party will review the proposed Change Request and determine whether the change is acceptable or requires modifications. Both parties will review the proposed Change Request and will (i) approve it, (ii) agree to further investigation, or (iii) reject it ( Change Management Process ). When the parties agree to the change, they will sign the Change Request, which upon signing by both parties will constitute authorization to implement the change. 14

15 19. Payment Provider agrees to invoice Sample Company at the beginning of each month for that months expected services and adjusted in the following month s bill under the terms of this Agreement. Monthly billing of software will be billed in advance and due by the 30th of the month it is incurred. Billing will begin for the month when services are rendered and customer will sign-off that the services have been delivered. Travel related expenses are the Provider s responsibility unless noted otherwise. Provider will endeavor to provide the lowest cost possible for the performance of services, purchase of products or services from third parties or creation of deliverables as agreed hereunder. Expense incurred in excess of hourly rates identified herein may be reimbursed by Sample Company if the expense is preapproved in writing by Sample Company and is documented with invoice(s) from Provider s third party contractor(s). 20. Termination Sample Company may terminate this SOW in whole or in part without cause on thirty (30) days notice after the first 3 months. Should there be the need to cancel in less time, then a one year of month payments is due immediate to forgive the rest of the months of services to be paid. 21. General IN WITNESS WHEREOF, Sample Company and STSG have caused this SOW to be signed and delivered by their duly authorized representatives as of the date of last signature below (the Effective Date ). FAX OR PURCHASE ORDER & SIGNED STATEMENT OF WORK TO: Josh B. Thomas FAX: (972) Sample Company By: By: Printed Name: Printed Name: Josh B. Thomas Title: Title: President Date: Date: October 20,

16 Appendix A Change Request Form Case# 000 Between: STSG- Customer STSG- Vendor Priority (select one) Emergency, High, Medium, Low Client Name (there must be a name in this field) Date Change Manager (there must be a name in this field) Related Issue # (indicates if this was moved to the Issue/Activity log) CONTACT INFORMATION Prepared by Change Owner Client/Vendor Contact (there must be a name in this field) Phone Phone Phone DESCRIPTION OF EXISTING STATE Details: (Select from SOW, Clearly state process to be changed, Cite rationale for original design) SUGGESTED CHANGE IMPACT Cost Schedule Quality or Quantity Related SOW Section Details: (Include Rationale, Scope of Change, Specific requirements to be implemented Identify personnel changes) Details: (Include: Itemized Costs, Specific New schedule,) IMPACT Total Cost of this Change $ Paid By (keep all that apply) VENDOR/SUPPLIER CUSTOMER SELECT ONE This change is: Accepted Date Rejected Date On Hold Date *Revise Date *REVISIONS TO SUGGESTED CHANGE OR REASON FOR REJECTION AND NEXT STEPS (include date and explanation-submit to Project Manager for re-consideration) STSG, INC. SAMPLE COMPANY Signature Name Signature Name 16

17 Appendix B: Status Report Customer Name Project Name Customer Contact SuProv Team Project Start Date Status Report Period Project Information Project Status Status Report Date Estimated Completion Date Days/Hours Worked in Period 1/4/ /31/2009 Days or Hours Report Period Executive Summary (High-level narrative) Tasks Worked on or Completed this Period (Note- C ) (Bullet point w/ hours summary at end) Tasks to be Addressed Next Period (Bullet point w/ est hours summary) Issues (Resolved and Open w/ recommendatio ns) (Bullet point The current project is proceeding as scheduled, within the planned budget. 17

18 summary) Project Schedule (Bullet point summary & percent) Changes to Scope (Bullet point summary) Project Status Updates from signed SOW(reverse chronological order):

19 Appendix C: Weekly Status Report Project Information Customer Name Project Name Customer Contact DPS Team Project Start Date Status Report Date 4/12/10 Estimated Completion Date 5/21/10 June 4, 2010 Status Report Period 5/14/10 thru 5/21/10 Days Worked in Period 5 Project Status Report Period Executive Summary 5/14/10 thru 5/21/10 Tasks Completed this Period Tasks to be Addressed Next Period Issues (Resolved and Open) Project Schedule Changes to Scope N/A Budget (optional section for T&M or milestone billing projects) 19

20 Appendix D: Project Completion Form Please fax signed form to: Company Project Name On-Site Dates OMNI # N/A Professional Services Technical Lead Professional Services Project Manager Ira Miller # QUALITY ASSURANCE CHECKLIST STATUS Completion/Testing criteria and results have been reviewed with the customer. Customer has been shown how to use product/application to perform basic tasks. Customer has received configuration documentation for the product/application. 4 Technical Account Manager Handoff has been completed. x 5 For Dell products, the customer understands how to contact Dell support. x 6 For non-dell products, the customer understands how to contact appropriate vendors. 7 Customer is satisfied with the work performed. x Yes No N/A x x x x CUSTOMER CONFIRMATION Project Completion x Project Completed (Entire Engagement) Project Phase(s) Completed. List Phase(s): List open issues or concerns in comments/exceptions below. By signing below, the customer acknowledges that has been completed to their satisfaction, with any exceptions noted in the Comments / Exceptions section. Company Name Customer Signature 20

21 Printed Customer Name and Title Date Comments / Exceptions 21