STANDARD MAINTENANCE & SUPPORT POLICY

Transcription

1 1.0 Maintenance and Supprt Services STANDARD MAINTENANCE & SUPPORT POLICY a. SecureAuth Crpratin ( SA ) shall prvide licensees and end users (cllectively, Licensee r Cusrtmer ) maintenance and supprt services ( Maintenance and Supprt r the Supprt Services ) cnsisting f bug-fixes, wrk arunds, crrectins, enhancements, updates and new releases and versins f SecureAuth IdP ( Sftware ) made available t custmers n a nn-beta, cmmercial basis. Prir t requesting Supprt Services, Licensee shall use cmmercially reasnable effrts t cmply with all f SA s published perating and trubleshting prcedures cntained in its dcumentatin. Licensee shall use cmmercially reasnable effrts t gather technical infrmatin specific t a prblem including Sftware lg files, reprts, and errr messages. Upn receipt frm Licensee f a ntice f a Sftware prblem, accmpanied by reasnable supprting detail and prvided that the Sftware prblem is then under warranty r a supprt and maintenance bligatin, SA will use reasnable effrts t determine if such Sftware prblem exists and t crrect, t the satisfactin f Licensee, such Sftware prblem within the timeframes set frth herein, depending n the severity level f the Sftware prblem. b. Any crrectins t the Sftware will be made t the mst current generally available release f the Sftware and, if requested by Licensee, t versins N-1 and N-2 f the Sftware, where versin N is the latest listed versin at the time. After the intrductin f a new and generally available release f the Sftware, SA will supprt the thencurrent and the prir majr release f such Sftware, and the versins f each mentined abve. Licensee may install and use all Sftware updates and enhancements but Licensee is nt bliged t d s. SA shall have n bligatin t crrect any Sftware prblem t the extent f an unauthrized mdificatin r alteratin f the Sftware by Licensee, that cause it t deviate frm the Dcumentatin, r in the event f perating system r cmputer malfunctin nt caused by the Sftware. SA will ensure that its API and ID Tl Sftware, which is part f the licensed Sftware, will run n Licensee s required perating system and hardware platfrms. c. Licensee acknwledges and agrees that it is, and will be, slely respnsible fr the accuracy and adequacy f all infrmatin and data furnished by Licensee fr prcessing Service Level Overview SecureAuth agrees t satisfy the service levels set frth in sectins 1.1, 1.2 and 1.3 belw (the Service Levels ). a. Service Levels are defined as the measurement f the perfrmance f a service r system. b. The Service Level target is defined as the percentage r the abslute achievement f that service level gal f which failure t achieve has a nted business impact. c. SecureAuth s perfrmance with regard t the Service Levels will be measured accrding t mnthly averages, generated fr each full calendar mnth the Services are prvided t Custmer. d. Service Level and availability measurements will take effect upn executin f a license agreement by Custmer. e. Service Level measurements will nt take in accunt any agreed upn embarg perids and / r service upgrade utages. Likewise, where the fault r remedial actin lies with Custmer r a third party nt affiliated with SecureAuth, measurements will nt be applicable fr such perids. g. Key Service Levels are as fllws: System Cmpnent Target SLA Critical Systems Availability 99.9% Hsted Services Availability (i.e., SMS, Telephny and Certificate services) 99.9% SecureAuth Maintenance & Supprt Plicy. 6/16

2 1.2 Service Level Requirements a. Custmer Service Levels include tw (2) categries: Business Critical and Nn-Business Critical. The fllwing table describes the Service Levels target fr these tw (2) categries: Service Descriptin SLA target Business Critical Defined as an applicatin that is essential in the business prcess. These services are cnsidered cre business-critical systems. Their impact is cnventinally measured and described in terms f a lss f revenue. 99.9% up time 24 x 7 x 365 days Nn-Business Critical 1.3. Severity Levels and Respnse Times Defined as an applicatin that is nn-essential in the business prcess. These services are nt cnsidered cre business systems. Their impact is nt measured r described in either terms f lst revenue. Examples f nn-business critical items are scial media (e.g., Facebk, Instagram, etc.) 99% up time 24 x 7 x 365 days a. Prblems reprted by Custmer r that therwise cme t SA s attentin will be lgged by SA and assigned a severity level. Respnse time is the time between when SA is ntified f the prblem and when SA acknwledges the prblem by assigning it a truble ticket number. Custmer shall ntify SA at supprt@secureauth.cm r , ext. 2. The fllwing tables describe the severity levels classificatin fr prblems and the expected respnse time fr each prblem severity level. SA will respnd t prblem calluts within the timeframes set frth immediately belw: Severity Type Supprt Hurs Respnse Time Restratin f Service Target Severity 1 Critical 24x Minutes 60 Minutes There is the ptential f a health, safety r security issue t ccur r it has already ccurred. This will have an peratinal r financial impact t the business. Ptential fr an peratinal r financial impact t the business A Business Critical, Tier 1 system, applicatin r functin is cmpletely unavailable, severely crrupted r degraded fr mre than ne authrized user. SecureAuth Maintenance & Supprt Plicy. 6/16

3 Severity 2 Urgent A nn-business critical system, applicatin r functin is unavailable, severely crrupted r severely r degraded fr a mre than ne authrized user. Severity 3 Nrmal System perfrmance is impaired, but there is n business r custmer client impact fr mre than ne authrized user. Severity 4 Lw 24x Minutes 2 Hurs 24x365 8 Hurs 24 Hurs 24x Hurs 3 Days A user level fault nly affecting ne authrized user but nt affecting ability t perfrm business functins (i.e., n business r Custmer client impact) System/Service Lcatin Ntificatins CRITICAL Severity One Every 30 minutes until prblem is reslved r severity agreed by bth Custmer & SA URGENT Severity Tw Every 1 hurs until the prblem is reslved r severity agreed by bth Custmer & SA NORMAL Severity Three Every 4 hurs until the prblem is reslved r severity agreed by bth Custmer & SA LOW Severity Fur Every 24 hurs until the prblem is reslved r severity agreed by bth Custmer & SA 1.4 Causes nt Attributable t SA This Maintenance and Supprt plicy des nt include services requested as a result f, r with respect t, causes t the extent they are nt attributable t SA. Causes which are nt attributable t SA include, but are nt limited t, the fllwing events caused by Licensee r its agent: a. Accident; unusual physical, electrical r electrmagnetic stress; neglect; misuse; failure r fluctuatin f electric pwer, air cnditining r humidity cntrl; failure f rtatin media nt furnished by SA; excessive heating; fire and smke damage; peratin f the Sftware with ther media and hardware, Sftware r telecmmunicatin interfaces nt meeting r nt maintained in accrdance with the manufacturer s specificatins; r causes ther than rdinary use; b. Imprper installatin by Licensee r use f the Sftware that deviates frm any perating prcedures established by SA in the applicable dcumentatin; and/r c. Mdificatin, custmizatin, alteratin r additin r attempted mdificatin, custmizatin, alteratin r additin f the Sftware that cause it r deviate frm the dcumentatin undertaken by any party ther than SA r its agents withut the written cnsent f SA; Sftware prgrams made by Licensee r ther parties under the cntrl f Licensee. 1.5 Rights and Obligatins f Licensee SA s prvisin f Maintenance and Supprt t Licensee is subject t the fllwing: a. Befre prductin use f the Sftware, Licensee shall prvide SA with an peratinal architecture dcument which describes hw the Sftware is being used in the Licensee envirnment. Dcuments created as part f the SecureAuth Maintenance & Supprt Plicy. 6/16

4 internal supprt prcesses f Licensee, which prvide all relevant infrmatin needed fr SA t help trublesht prblems, are acceptable substitutes; b. Licensee shall use cmmercially reasnable effrts t prvide SA with reasnably necessary access t the persnnel and equipment f Licensee; c. Licensee shall use cmmercially reasnable effrts t prvide supervisin, cntrl and management f the use f the Sftware. In additin, Licensee shall use cmmercially reasnable effrts t implement prcedures fr the prtectin f infrmatin and the implementatin f backup facilities in the event f errrs r malfunctin f the Sftware r equipment; d. Licensee shall reprt all detected errrs r malfunctins f the Sftware t SA. Licensee shall use cmmercially reasnable effrts t take all steps reasnably necessary t carry ut prcedures fr the rectificatin f errrs r malfunctins within a reasnable time after such prcedures have been received frm SA; e. Licensee shall use cmmercially reasnable effrts t maintain a current backup cpy f all prgrams and data; f. Licensee shall use cmmercially reasnable effrts t prperly train its persnnel in the use and applicatin f the Sftware; and g. Licensee may request a written reprt t mnitr its supprt activity statistics r t verify cmpliance with the Service Levels. SA will prvide such reprts within seven (7) business days f the request. Such requests shuld nt exceed nce a mnth. 1.6 Case Registry Cntacts Licensee shall use cmmercially reasnable effrts t appint ne (1) r mre individuals within its rganizatin wh is reasnably knwledgeable in the peratin f the Sftware t serve as primary cntact between Licensee and SA regarding the registry and reprt f supprt calls (the Case Registry Cntacts ). All supprt inquiries f Licensee shall be initialized thrugh these cntacts where pssible. As a security precautin, the htline analyst may request further infrmatin t verify the identity f the caller. If at any pint, the htline analyst believes that the requesting party is nt authrized, the htline may deny any supprt that culd jepardize the security f the envirnment until the primary cntact(s) are reached. Additinally, any request fr imprper assistance will be reprted t the primary and secndary cntacts f Licensee. 1.7 Infrmatin Gathering The Case Registry Cntacts shuld prvide SA with a descriptin f the request r prblem. T assure accuracy, the htline analyst may request any f the fllwing infrmatin utlined belw: Name Address Prblem severity Prblem descriptin Exact errr messages Lg infrmatin Date and time prblem was encuntered Changes made t the cnfiguratin/ envirnment prir t the prblem Changes made t the cnfiguratin/ envirnment after the prblem Actins taken t islate and reslve befre cntacting the htline Hardware cnfiguratin type Appliance versin release level System cnfiguratin parameters Infrmatin abut ther Sftware interacting with the Sftware SecureAuth Maintenance & Supprt Plicy. 6/16

5 1.8 Exclusins. SA prvides supprt and maintenance fr its prduct, SecureAuth IdP, and the appliances n which the prduct is supplied; prvided, hwever SA des nt supprt, and is n way respnsible fr any f the underlying r surrunding infrastructure that may be used in cnjunctin with, r in supprt f, the SA IdP prduct by the Custmer. The freging includes, but is nt limited t, the fllwing: Identity Stres, including but nt limited t. Micrsft Active Directry, Micrsft LDS, OpenLDAP, Nvell e-directry, IBM LDAP, SunOne LSAP, ApacheDS. any ther 3rd-party LDAP directries, MS SQL Server, Oracle Server, Ggle Apps Datastre, and any ther identity r prfile stre. Any 3rd party Databases, Datastres, r SIEM prducts (whether n-premise, r clud hsted) used fr the strage and reprting f any audit, accunting, r reprting data. Any underlying hypervisrs r hypervisr management prducts used t hst and supprt the SecureAuth IdP Virtual Appliance, including but nt limited t, Micrsft Hyper-V, VMware ESx, and Citrix XenServer. Any MDM slutins used t manage any endpints r mbile devices. Any supprt f endpint Operating Systems, (including Micrsft Windws, Apple OS X, Linux and Unix Derivatives) and Mbile Operating Systems (including Apple ios, Andrid, Windws Mbile/Phne, and Blackberry). Any underlying private, r public netwrk infrastructure - bth physical and lgical. Any clud, r 3rd party hsting services. Any 3rd party hardware OTP tkens, prximity cards, and smart cards, and reader devices. Any relying party Sftware, such as thse that accept SAML r ther assertins frm the prduct. Fr the avidance f dubt, where additinal third party infrastructure cmpnents are required, SA shall have n liability whatsever fr the third party infrastructure cmpnents that may be required t supprt the use case f Custmer. SecureAuth Maintenance & Supprt Plicy. 6/16