SAP hybris Commerce, cloud edition, Managed Services Description

Transcription

1 SAP hybris Commerce, cloud edition, Managed Services Description Effective June 2015 OBJECTIVES AND SCOPE This document provides supplemental information regarding the Managed Services for the SAP hybris Commerce, cloud edition provided by SAP pursuant to the Agreement for the SAP hybris Commerce, cloud edition between SAP and Customer. As used in this document, Project or Project Phase means the activities of Customer and SAP in the period between the project kick-off meeting or call, and the Go-Live of the Cloud Service. Go-Live means the Production Environment is deployed and capable of live processing of end-user data. All other capitalized terms shall have the meaning set forth in the Agreement. This Managed Services Description is incorporated by reference and made a part of the Agreement. The Cloud Service includes the services as described in this Managed Services description. MANAGED SERVICES OVERVIEW SAP shall use the following personnel in performing the Cloud Service: Project Manager- named resource assigned to customer Project and primary point of contact during implementation Technical Account Manager- named account management resource assigned to customer Project post Go- Live, and responsible for proactive oversight of the application and operational processes. Meets regularly with the customer to review the solution performance and the resolution of outstanding issues Database Administration team for database management Security Analysts- security operations staff, responsible for initial security set-up, and reviewing, assessing, and addressing security related information System Administrators - responsible for server health maintenance and management Network Architects - responsible for network set-up of customer project and connectivity to customer enterprise Monitoring Analysts - responsible for managing ongoing customer monitoring services Platform Implementation Experts a team that deploys, implements, and supports the Hosting Platform throughout the Project Phase (pre Go-Live) Platform Service Experts a team that manages the Hosting Platform post Go-Live, being involved in Support, deployment, configuration changes, applying security patches and other platform maintenance tasks. The Project setup services include: Project management services for the implementation phase of the Project Setup of the Development Environment multi server environment, installation, setup/configuration of SAP application, app server, web server, networking, security setup Setup of Staging Environment multi server environment, installation, setup/configuration of SAP application, app server, web server, networking, security setup Setup of Production Environment multi server environment, installation, setup/configuration of SAP application, app server, web server, networking, security setup SAP hybris Commerce cloud edition Services Description effective June 2015 Page 1

2 Additional server setup for third party applications, if applicable. Setup does not include third party application installation or configurations (subject to additional fees for added resources as specified in an Order Form). SAP shall deliver the following deliverables as part of the Project: Project Kickoff presentation (covered topics include Project information, timeline, communication plan, team roles and responsibilities / RACI, deployment process, contract review, change control) Network Diagram Deployment Form document to communicate deployment instructions Whitelist Form document to manage third party vendor security whitelisting Application Deployment Guide how to deploy code from local installation to standard configuration Client Deployment How To guideline for packaging application releases Cloud Services Operations Manual details on engaging SAP notifications, escalations, and maintenance. Project Plan details and schedule of implementation activities Webserver Configuration Form detailing file structure and locations for the installation of SAP application VPN Access into the hosted environment Use of infrastructure and services outlined in the Order Form Operational Deliverable post Go-Live: Operations Scorecard Monthly report on operational performance SUPPORT TEAM The Cloud Service includes an assigned Project manager during the initial Project Phase as well as a technical account manager once the Website is used in a production mode (live processing of end-user data), to provide Project and account management support for the Cloud Services. These individuals are the primary points of contact who work closely with customer s team to help meet customer service needs and to help manage future requirements and growth. Furthermore, these individuals will help coordinate discussions with other technical resources as needed. Once the Production Environment is used in a production mode, Customer will have a Technical Account Manager (TAM) assigned, as well as a backup TAM based in an alternate time zone for extended hours. Contact information for Cloud Service Support is as follows: Telephone Number: /Web: EMEA: North America: By submitting tickets through the support ticketing system or through support@hybris.com SAP hybris Commerce cloud edition Services Description effective June 2015 Page 2

3 DATA CENTER SAP utilizes 3 rd party data centers to provide the Cloud Service. The data centers used to host the Cloud Service provide secure facilities for hosting and have a direct connection to the global Internet backbone. The data centers provide a secure and controlled hosting environment, with: Heating, ventilation and air conditioning (HVAC) systems Very early smoke detection alarm (VESDA) and dual interlock fire suppression systems Uninterruptible power supply (UPS) with automatic power transfer bridge system Integrated biometric/card access control 24/7 CCTV video surveillance and recording Monitoring for HVAC and mission-critical power systems The data centers provide diverse power and network connections, backup generators and air conditioning systems supporting the equipment s online availability 24 hours a day, 7 days a week. HOSTED INFRASTRUCTURE AND INFRASTRUCTURE MANAGEMENT Initial infrastructure sizing is performed according to traffic estimates and additional requirements provided by the customer. Core+ modules might also require separate servers to be supplied at an additional cost. Systems Infrastructure The Cloud Service will reside on a redundant server infrastructure ensuring that if one server (or part of the server infrastructure) fails, a backup is in place designed to support the operation of Customer s systems. The infrastructure is load-balanced for high availability of the system during peak usage periods. The loadbalancing allows the systems to handle large volumes of simultaneous users balancing the load of activity across multiple servers. The server and network infrastructure is based on a private cloud virtualized infrastructure. Infrastructure Components: Redundant Firewalls Redundant Routers Redundant Load balancers Web file storage Database storage Intrusion detection DDoS monitoring and mitigation security services SAP hybris Commerce cloud edition Services Description effective June 2015 Page 3

4 SAP will perform the setup and configuration of all infrastructure components. The following 3rd party application software is included with Cloud Service solely for use with and as part of the Cloud Service on the Hosting Platform: Linux (Debian) Apache Webserver Tomcat Applications Server database setup with the application Virtualization hypervisor VMWare File Integrity Management Software Log Management Software Data Storage Management Storage is provided through the use of redundant high performance storage solutions. The storage solution includes the use of NetApp storage technology including solid state disks on the first tier with expandable fast cache. Storage is safeguarded through the use of Raid DP, NetApp s raid technology which is a double-parity RAID 6 setup that helps prevent data loss when two drives fail. Server Infrastructure and Management: The Cloud Service includes server management, OS patching and proactive maintenance of the server environment. With respect to RAM, SAP reserves the Production Environment VM s allocation so that no swap can occur. The Cloud Service uses vsphere DRS (Distributed Resources Scheduler) to balance the load based on actual load on the host and affinity rule. The database runs on dedicated virtualized servers with dedicated compute power. Network: The SAP Internal network used to provide the Cloud Service is comprised of: Fortinet Fortigate FireWalls (300c) Cisco Routers for VPN connectivity Citrix Netscaler Load Balancer with Web Application Firewall HP Core and L2 Switching Brocade Fiber Channel is used for the databases servers Network device management as part of network monitoring. CONNECTIVITY The Cloud Service delivers connectivity through Tier 1 internet backbone access. The redundant multi-tier network is based on high-end gateway routers, core switches, and distribution switches. The data center is connected directly to the high-performance global IP network. The hosted environment is supported by 2 x 1 Gbps connections to the Internet backbone, each burstable to 8 Gbps. bandwidth. SAP hybris Commerce cloud edition Services Description effective June 2015 Page 4

5 SAP uses the 95th percentile measurement rule of the total of the ingress and egress traffic to calculate the additional bandwidth used above the base bandwidth. Additional bandwidth can be purchased for an additional fee in the Order Form. 95th Percentile Measurement - The bandwidth reporting system captures average data points usage every 5 minutes for each network line for ingress, egress, and total bandwidth data. The highest 5 percent of the data points out of a given set (ingress or egress or total) of data points over the billing period are discarded. The highest data point from the remaining data points is considered as the 95th percentile value of the data set. MONITORING SERVICES The Cloud Service provides 24x7 monitoring of the hosted SAP applications and infrastructure. Monitoring systems in-place include OpsView, Solarwinds, Ignite and WebMetrics. The tools provide monitoring and alerting of such areas as CPU, memory, disk space, db performance, page loadtime performance and availability. Reporting access from OpsView, Ignite and Webmetrics is made available to the customer. The Cloud Service includes alert messaging and reporting for systems uptime and page load performance. In addition, web performance monitors can test across geographic locations. SAP uses application profiling tools to perform application analysis to determine the source of an issue. Included as part of the web performance monitoring are a monitor for 1 site that checks a designated URL every minute and a monitor for 1 site that checks a 5 page user flow every 5 minutes. Each time a page is monitored, it consumes 1 unit. Capacity Monitoring and Planning On a monthly basis, SAP reviews performance and utilization reporting to determine if capacity increases will be required. If the data supports the need to increase capacity, SAP will discuss such capacity changes with the customer. SECURITY SERVICES AND INFRASTRUCTURE The security infrastructure includes firewall security and hardened security policies on all servers. Log management procedures are in-place for log review for firewall, applications, network devices, including fileintegrity management. SAP utilizes technologies from leading security firms for Log Management and File Integrity Management and the SAP security team monitors these systems. The infrastructure also offers the customer configurable web application firewalls (WAF) and DDoS monitoring and mitigation services. In addition, security policies and change management policies are in-place ensuring that access and changes to customer systems and information is accessible only by SAP staff with access authorization. Security Infrastructure for the Cloud Service includes: SAP hybris Commerce cloud edition Services Description effective June 2015 Page 5

6 Fortinet Fortigate FireWalls (300c) Citrix Netscaler Web Application Firewall LogRhythm SIEM Symantec AntiVirus SourceFire Intrusion Prevention System (IPS) VMware vcloud Networking and Security (Phase I) The application of security processes and requests follows SAP Change Management Process and further documentation is available on SAP s Change Management Processes upon request. Security of the software application remains the responsibility of the customer. Security processes and procedures related to the development and deployment of custom implemented code are the responsibility of the customer. The customer is also responsible for its own external vulnerability scans and penetration tests to secure the regular deployments of the applications. Firewall Management Firewall management is included as part of the Cloud Service offering. Firewalls are maintained in an Active/Active mode and are secured to allow only approved traffic inbound and outbound. Firewall logging is in place with 90 day retention periods. Two Factor Authentication The Cloud Service makes use of two factor authentication throughout the SAP-controlled network to ensure enhanced security access to the network. File Integrity Management File Integrity Management helps identify authorized changes versus unauthorized changes and possible malicious activities, to exclude operational integrity being compromised. File integrity monitoring (FIM) examines files and directories on a server, identifying changes to content and permissions. VPN Services Point-to-point VPN services are available to provide VPN tunnels between external site and the hosted environment. The required infrastructure for a VPN s the responsibility of the customer and must be supplied by a telecommunications operator, while SAP may provide any support services that might be required for setup and operation of the VPN for an additional fee. DATABASE MANAGEMENT The backend of the Production Environment runs off a configured database. The clustered database runs on redundant virtualized server infrastructure. In addition, synchronized copies of the data are stored offsite providing offsite data protection. The Cloud Service offers proactive monitoring and management of the database, including; SAP hybris Commerce cloud edition Services Description effective June 2015 Page 6

7 Production/Test/Development databases Maintenance and Patching of the hardware and database software Daily incremental database backup Database restore services Backup of archive logs Implementation of database patches Emergency triage of database problems The managed database service includes managing capacity on demand based on actual database requirements. The database costs are included in the overall environment sizing to support the Peak Page Views per second. Incremental Peak Page views per second costs would include the database requirements for that level. The current capacity will be visible to the customer within an online dashboard using Ignite. Database patching is performed during Scheduled Maintenance. Any restore procedures on the database would only be performed with the written authorization of the customer. The Cloud Service includes the database license for use with the SAP application running from the Cloud Service environment within the SAP pre-determined database infrastructure. The license is valid only while paying the Cloud Service fees and while being hosted by SAP. The license is non-transferable, and does not allow for it to be used outside of SAP Cloud Service datacenters. BACKUP AND RECOVERY SERVICES The Managed Services include daily offsite backup of all system data in accordance with appropriate industry standard backup procedures. Backup services include daily offsite backup services. Procedures for backup of the application and data are configured by SAP. Backup services are supplied for the Production Environment only. Additional environments such as Development Environment and/or Staging Environment may also be covered as an optional service for an additional fee. Backup of data is offsite with 30 days retention as well as local disk backups with hourly snapshots held for 3 days, nightly backups kept for 7 days and weekly backups kept for 3 weeks. Database Backup As per the backup schedule set forth above, SnapManager will transition the database into backup mode: Step 1- All the write operations will be appended in a reserved disk area; Step 2 - Read operations will run normally; Step 3 - A backup file will be generated and exported; Step 4- Backup mode will be transitioned to off and all data generated on step 1 will be appended to it. Exports will remain on disk for faster recovery if needed as well as being sent off site. All datasets will be kept off site for a minimum of 30 days. SAP hybris Commerce cloud edition Services Description effective June 2015 Page 7

8 Any request to rollback/restore in production must be verbally confirmed by one of the personnel on the escalation list set forth in the customer-specific operations guide. The verbal approver cannot be the same as the ticket submitter. MAINTENANCE SERVICES SAP and the customer will schedule application deployments during a mutually agreed upon maintenance timeframe. SAP s standing infrastructure Scheduled Downtime window is currently every Wednesday from 01:00 AM to 05:00 AM in the time zone of the applicable datacenter. For urgent security issues or other issues that may have significant impact on the Cloud Service, the infrastructure of other customers of the Cloud Service, SAP may also schedule Scheduled Downtime windows outside the standing infrastructure window by sending a notification beforehand. The customer must provide SAP with notice 10 days prior to any maintenance to be performed by the customer which may impact the performance of the Cloud Service by opening a ticket with SAP support. CHANGE MANAGEMENT The IT Infrastructure Library (ITIL) is an integrated, process-based, best practice framework for managing IT services. Covering 17 different IT service areas, ITIL outlines how best to complete critical IT practices using checklists, tasks, and procedures that although rigorous are nevertheless flexible enough to be tailored to organizations of all types and in all industries. SAP follows the IT Infrastructure Library, and uses Service-Now, designed with ITIL v3 framework in mind, to manage the internal change management processes: IT Service Management dashboard ITIL v3.0 compliant Service Desk, Incident Management, Problem Management, Change Management, Release Management, Configuration Management and Service Catalog Status snapshots of Incident Management, Problem Management and Change Management in real time Service response reporting DEPLOYMENT SERVICES For Build Deployment in excess of two (2) hours per month, a separate statement of work and time and materials fees are required. Updates to the customer Website must be deployed by SAP in the Staging Environment and Production Environment. The customer will manage deployments to the Development Environment. All requested database changes must be communicated by Customer or its partner to SAP and performed by SAP. The Build Deployment process is described in the following diagram. Adherence to this process by Customer is required for SAP to meet SAP hybris Commerce cloud edition Services Description effective June 2015 Page 8

9 its obligations with respect to the Build Deployment and may affect the number of Build Deployments SAP can perform within the two (2) hours per month of included SAP Build Deployment services. Typical Build Deployment requests should be made 1 week in advance, however deployment requests will be accepted up to 3 days in advance of the desired deployment date. Other services related to Build Deployment not included in the Cloud Service and charged as time and material include, but are not limited to, activities performed outside of business hours, application troubleshooting support, platform upgrade services, customized reporting, non-standard configurations and specific database requests. Build Deployment packages provided to SAP must include the ability to roll-back a deployment. Build Deployment package deployment is done in Business Hours and the Build Deployment package must be provided to SAP at least two (2) hours in advance of the planned deployment time in order to provide sufficient time for adequate task completion during the same Business Day. Change requests which require SAP action are performed on a time scale appropriate with the request. For example, certain requests such as firewall changes would be scheduled for the next maintenance period. To provide optimal implementation of customer change requests, SAP also has a no Build Deployment or firewall change policy on Fridays, weekends and during public holidays recognized in Bavaria, Germany. SAP hybris Commerce cloud edition Services Description effective June 2015 Page 9

10 ROLES AND RESPONSIBILITIES The following roles and responsibilities shall apply to the cooperation between SAP, Customer and the Customer s designated Implementation Firm. As between Customer and SAP, only those responsibilities with an R assigned to SAP shall form part of SAP s Cloud Service obligations. All other responsibilities shall, in relation between SAP and Customer, be deemed part of Customer s obligations. R=Responsible A=Accountable C=Consulted I=Informed Activities SAP Partner Customer Project and Account Management Assign and make available a Project Manager R R R Assign and make available a Technical Account Manager R/A R Manage relationship with Application Support partner R/A Traffic volume forecasting C C R/A Participate in monthly Cloud Service review calls R/A I R Infrastructure and Server Management Server Management (all servers) up to and including the OS R/A I I Server OS and Network Infrastructure Patch Management R/A I I Network Management R/A I I Initial Server configuration (Dev, Staging, Production) R/A I I DEV Initial Installation and configuration of the default SAP R/A I I Application STAGING Initial Installation and configuration of the default R/A I I SAP Application PRODUCTION Initial Installation and configuration of the R/A I I default SAP Application DEV Server (above OS) and Application additional C R/A I configuration and management - SAP web/app STAGING Server (above OS) and Application additional R/A C I configuration and management - SAP web/app PRODUCTION - Server (above OS) and Application additional R/A C I configuration and management - SAP web/app Initial and ongoing Server and Application configuration and I I R/A management - Non-SAP web/app/db servers (ie: Vertex) Backup Services R/A C C 3 rd party services connectivity (excluding functionality) R C A Monitoring Infrastructure Monitoring (Memory, CPU, disk) R/A I I Website Availability Monitoring R/A I C Capacity Monitoring R/A I C SAP hybris Commerce cloud edition Services Description effective June 2015 Page 10

11 Security Network Infrastructure Security (ie: Firewall, IDS/IPS) R/A I I Server OS Security Patching R/A I I Access Security (VPN, Two Factor Authentication) R/A R R DDoS Monitoring R/A I I Security Software: Anti-Virus, File Integrity Management, R/A I I SIEM Web Application Firewall R/A C C Application security vulnerability and penetration testing and I C R/A application security auditing Secure custom application development I R A Security incident management related to hosting R/A C C environment Security incident management related to non-sap application R A C/I code (initial alerting) Security incident management related to non-sap application code (mitigation / remediation) I R/A I Database Management Database installation and configuration R/A I I Patching of the database R/A I I Database backup and restore R/A C C Database updates to indexes and tables R/A C I Database monitoring R/A I I Application Development / Deployment / Testing Development of new code I R/A C Preparation of deployment packages C R/A A Scheduling of deployments C R/A A Deployment to Development Environment (not included in I R/A I Cloud Service) Deployment to Staging Environment (not included in Cloud R/A C I Services) Deployment to Production Environment (not included in R/A C I Cloud Services) User Acceptance Testing I C R/A Overall Application Quality Assurance I R A Load Testing C R R/A SAP application upgrades I R/A C Support & Incident Management First line support for hosting support issue R/A C/I C/I Application Support any issue specific to the SAP I R/A I application Create new incident based on automated alerts or support R/A I I request by phone or from Customer or Application Support partner Capture incident details (Hosting) R/A I I Categorize incident (Hosting) R/A I I Prioritize incident (Hosting) R/A I I SAP hybris Commerce cloud edition Services Description effective June 2015 Page 11

12 Investigate and diagnose incident (Hosting) R/A I I Assign incident to appropriate support group within SAP or to R/A I I Application Support partner for resolution SAP hybris Commerce cloud edition Services Description effective June 2015 Page 12