Statement of Service Enterprise Services - MANAGE Microsoft IIS

Transcription

1 Statement of Service Enterprise Services - MANAGE Microsoft IIS Customer

2 Proprietary Rights The information in this document is confidential to Arrow Managed Services, Inc. and is legally privileged. The information and this document are intended solely for the addressee. Use of this document by anyone else for any other purpose is unauthorized. If you are not the intended recipient, any disclosure, copying, or distribution of this information is prohibited and unlawful. Disclaimer This documentation might include technical inaccuracies or typographical errors and is subject to correction and other revision without notice. Arrow Managed Services, Inc. GIVES YOU THE CUSTOMER THIS DOCUMENTATION "AS IS." EXPRESS OR IMPLIED WARRANTIES OF ANY KIND ARE NOT PROVIDED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states or jurisdictions do not allow disclaimer of express or implied warranties in certain transactions; therefore, this statement may not apply to you. Arrow Managed Services Confidential Page 2 of 25

3 TABLE OF CONTENTS 1.0 Introduction Engagement overview & scope Detailed Scope IIS Servers /7 Monitoring and Alerting Daily administrative activities IIS Remote remediation and fix for the servers Monthly proactive checks on IIS Web Servers hardware & software configuration of IIS Web Servers Monthly security patch deployment Service Requests (SRs) Service delivery Management Engagement Process Overview Service Level Agreement Service Reviews Customer Visibility & Auditability Auditability Infrastructure Visibility portal Executive dashboard Metrics based reporting and analysis Weekly Reporting Monthly Reporting Extending operation support for new Services/infrastructure Support Window Escalation Matrix Out of scope Fees Terms and Conditions Arrow Managed Services Confidential Page 3 of 25

4 Disclaimers Appendix A - SLA Appendix B Roles and Responsibilities Appendix C VPMG Deployment Architecture Appendix D Equipment List Arrow Managed Services Confidential Page 4 of 25

5 1.0 INTRODUCTION This document specifies the scope & schedule of the services delivered to the end custome r by Arrow Managed Services detailing MANAGE services package for IIS Servers. As a requirement to start services, this document must be signed off by Customer and Arrow Managed Services, as an agreement for the scope and deliverables of the services under the MANAGE services package. 2.0 ENGAGEMENT OVERVIEW & SCOPE This statement of service (SOS) describes the engagement model and scope of service for Arrow Managed Services to support monitoring and managing of Microsoft IIS Servers. The overall objective of this engagement is to provide support to Customer, using highly efficient and SLA driven delivery model under Arrow Managed Services MANAGE services package. MANAGE services Package includes these services for IIS Servers. Monitoring and alerting of IIS Services Monthly Security Patch deployment for web services after approval from customer Daily administrative activities. Remote remediation and fix for the issues on IIS Web Servers. Incident reporting & root cause analysis for P0 tickets. Monthly Proactive checks on IIS Web Servers (Executing IIS Health check checklist). Hardware & Software configuration of IIS Web Servers. Monitoring the IIS configuration & metadata backup Jobs. To help support the key objectives mentioned above, Arrow Managed Services will provide the following shared services delivery model: All alerts will go to Arrow Managed Services Service Desk which will be monitoring, alerting, ticketing and escalating the tickets. o Incoming alerts will be initially diagnosed to identify false alerts or alerts where no action is required o Actionable alerts will be ticketed by the service desk /helpdesk o Any documented Standard Operating Procedure (SOP) will be executed by service desk as first level of support o The ticket with no SOPs will be escalated to Arrow Managed Services L2 Windows Team. Arrow Managed Services Confidential Page 5 of 25

6 o Any tickets/issues which need to be resolved with a 3 rd party vendors (Hardware Vendors / Software vendors) will be handled by L2 Engineers (it includes 3 rd party coordination and escalation up to issue resolution) 3.0 DETAILED SCOPE IIS SERVERS /7 MONITORING AND ALERTING Tasks include: Arrow Managed Services will monitor the IIS Web Servers 24/7 and alert the customer contact based on the priority of the alert and Server. At the same time, the Arrow Managed Services Windows team will troubleshoot and fix the reported issue remotely. Arrow Managed Services deploys Arrow Managed Services Virtual Private Management Gateway (VPMG) which utilizes WMI and Syslog monitoring. This appliance also allows Arrow Managed Services staff secures remote access to the customer IIS web Servers. Note: All Monitoring templates applied to the IIS Web servers are customized by Arrow Managed Services and any monitors found outside the existing templates will be researched by Arrow Managed Services and applied to all the clients Windows Servers as appropriate. The following Monitors will be enabled on IIS Web Servers. o IIS Service monitoring o Application Pools o URL Monitoring o IIS Configuration files monitoring o Web Server Response for requests o IIS Server CPU Utilization, Memory utilization o SSL Certificate expiration o Active Server Pages Counters for ASP scripts and applications running on the server. o FTP Service Counters for the FTP service. o HTTP Indexing Service Counters for the Indexing Service for Web sites, active queries, and caching results. o Internet Information Services Global Counters for all Internet services (WWW, FTP, SMTP, NNTP, and so on) running on the server. o Web Service Counters for the World Wide Web Publishing Service. Arrow Managed Services Confidential Page 6 of 25

7 3.2 DAILY ADMINISTRATIVE ACTIVITIES IIS Daily administrative activities include the following: IIS services stop & starting services. Creating a Web FTP site Creating virtual directories Saving and copying site configurations. Setting authentication settings Obtaining and backing up server certificate. Redirecting Web sites Troubleshooting & Installing SSL certificates Troubleshooting & Registering dotnet framework applications Configure applications (ASP, dotnet, CGI ) and Web services Configuring Recycling Settings for an Application Pool Create a Tracing Rule for Failed Requests Privilege management for FTP Sites Log Analysis Scope: Scope includes the customer locations which are included in the agreement Arrow Managed Services responsibility Preparing the SOPs for performing the activities. Performing these activities as per the Standard Operating Procedures (SOPs) Customer responsibility: Providing the contact details for approving various requests such as Site Name, Virtual directory name etc. Approving the requests such as user Stop\Start web sites, IIS Services etc. 3.3 REMOTE REMEDIATION AND FIX FOR THE SERVERS Arrow Managed Services Windows Team will connect to IIS Web Servers remotely to troubleshoot the issues. The following are the some of the examples of issues: Website down. Website slow. Configure Applications. Troubleshoot IIS Performance. Enabling IIS certificates Applying Security Patches Application Backup & Restores Root cause analysis Arrow Managed Services Confidential Page 7 of 25

8 Scope: All IIS Web Servers in the customer environment which are in the scope. Deliverables: Remotely fixing the issues with IIS Web Servers. Providing RCA report for P0 issues. 3.4 MONTHLY PROACTIVE CHECKS ON IIS WEB SERVERS. Arrow Managed Services team will perform monthly proactive checks on IIS Web Servers which include checking Health and Security status of the IIS Web Server, etc. The following are the some of the examples of IIS Health checklist. Scope: Executing IIS Best practice analyzer Disabling guest accounts Verify Security permissions on Websites Verify FTP User accounts All IIS Web Servers in the customer environment agreed as per the scope. Deliverables: Report on Monthly IIS health check. 3.5 HARDWARE & SOFTWARE CONFIGURATION OF IIS WEB SERVERS. Arrow Managed Services team will document the hardware and software configuration of the IIS Web Servers. Scope: Deliverables: All IIS Web Servers in the customer environment agreed as per the scope. Hardware & Software configuration document. 3.6 MONTHLY SECURITY PATCH DEPLOYMENT Monthly security patches related to web services will be deployed on all IIS Web Servers (which are in the scope) after the approval from customer. The following are the steps in the monthly patch deployment process. Scope: All the IIS Web Servers in the customer environment. Arrow Managed Services responsibility: Testing the patches in the test environment and preparing the test report Arrow Managed Services Confidential Page 8 of 25

9 Following Change management process for raising the change request for deploying the patches. Deploying the patches on IIS Web Servers. Generating the MBSA report for IIS Web Servers. Customer responsibility: Approving the change request for deploying the patches. Providing downtime for deploying patches. Deliverables: MBSA report of IIS Web Servers after deploying the monthly security patches. 3.7 SERVICE REQUESTS (SRS) Service Requests - Definition Service requests (SRs) are requests that are not due to disruption i.e. requests which are not due to any incidents, monitored event or change requests due to root cause analysis. Examples of these SRs are: o Add a Web Site o Creating a Web FTP site o Creating virtual directories o Backing up and restoring metadata base configurations o Setting authentication settings o Obtaining and backing up server certificate. o Redirecting Web sites o Installing SSL certificates Scope: Service Requests which require less than 30 minutes of effort per SR are included in the monthly contract. For SRs exceeding the 30 min effort level, customer authorization will be obtained because these SRs will be considered as category services and charged additionally to the customer. SRs which are more than 8 hrs in effort level go beyond category services and are considered as projects beyond the scope of the monthly project. Customer authorization will be obtained for projects. Examples for Category Services o Deploying Applications o Migration of web sites and applications from earlier versions of IIS. o Hosting multiple Web sites o Application up-gradation Arrow Managed Services Confidential Page 9 of 25

10 4.0 SERVICE DELIVERY MANAGEMENT Leveraging its well defined process, technology and people, Arrow Managed Services will execute efficient and effective operations of any IIS Servers environment. Arrow Managed Services will create two important documents which will define the service delivery details. These documents are being created by Arrow Managed Services and will be provided to Customer for review and approval. 1. Service Delivery Document: This support process document is intended to identify the guidelines for providing support and services and for determining priority, issue resolution and the communication of updates to Customer s team. This document will be kept current (based on the changes in support requirements) and will be an extension to this SOS. 2. Discovery Document & Service Delivery Manual: This is document details the business services and contains important sections which are required for Arrow Managed Services to adequately manage the service. Customer will play a key role in providing the necessary information for Arrow Managed Services to complete the documents. 4.1 ENGAGEMENT PROCESS OVERVIEW Arrow Managed Services will provide efficient support to Customer by leveraging our SLA driven delivery model. The monitoring facility will be installed on all the Servers under support, in consultation with the customer, and all alerts will be monitored. All alerts which qualify as per defined parameters will be ticketed and remedied. Alternately, any request or incident that is reported by designated customer s personnel will be ticketed and remedied. A unique service ticket number will be assigned when initial contact or alert is noted by Arrow Managed Services support. Requests for services - either via phone call, via the Arrow Managed Services created customer ticketing system or auto generated system events also will be similarly ticketed. This ticket number will be used to track the issue from initial contact to final resolution. Each ticket will be prioritized based on a mutually pre-established set of guidelines and the classification of each device and service (as defined in Service delivery document). Based on the results of the initial investigation, an issue may be brought to resolution. If an anomaly is identified, it is escalated to appropriate individuals within Arrow Managed Services. Service delivery document details the process flow for this engagement and will be updated to highlight the current support process. All enhancement / change requests are also given a ticket number. The progress of the issue can be tracked live via visibility portal/ dashboard. 4.2 SERVICE LEVEL AGREEMENT Arrow Managed Services will perform these activities in SLA based service delivery model. However, because there is no lockdown on the environment, important Arrow Managed Services Confidential Page 10 of 25

11 operational requirements such as availability, capacity, and outages will be a joint responsibility of Arrow Managed Services and its customer. Further any device addition/deletion, changes must follow effective change management. Following table describes the various priority levels associated with incidents. The sources of alerts are either from monitoring system or from user requests via ticketing system, phone or s. The RCA for P1 is part of normal ticket updates but in P0 we would provide a separate and detailed report. SLAs are not applicable on unsupported devices SLAs are not applicable when change management is not followed Support benchmark is 100% for given quarter SLA is applicable if effective Change Management is followed both for changes made by Arrow Managed Services and the customer. Resolution time mandates one or more of the following activities are complete: Temporary work around/fix to restore the business service Permanent fix (may be a result of root cause analysis of an issue) Issue escalated to vendor Action plan is created to address the trouble ticket 4.3 SERVICE REVIEWS Periodic reviews will be conducted by Arrow Managed Services with customer management team to assess the performance. A weekly review for status update/performance review will be scheduled with Customer Management. The agenda for the meeting includes: Review of tickets (Open / Closed / Work in Progress etc) and service requests. Progress made on key activities/items Key Issues impacting the engagement Prioritization of activities/service requests Arrow Managed Services Confidential Page 11 of 25

12 Operational metrics review 4.4 CUSTOMER VISIBILITY & AUDITABILITY AUDITABILITY All remote activities performed by Arrow Managed Services engineers on the customer s IIS Web Servers are recorded and available for the customer to replay and review via the Arrow Managed Services VPMG INFRASTRUCTURE VISIBILITY PORTAL Arrow Managed Services will provide two user logins for our customers to login to the Infrastructure visibility portal. This provides unparallel visibility on the current status of the Base OS servers across different locations and provides useful trending reports for advanced analysis EXECUTIVE DASHBOARD Data to be made available via executive dashboard to the customer includes all the performance metrics of the IIS under management. The dashboard has ad-hoc report generation capabilities. For example: the service performance report. 4.5 METRICS BASED REPORTING AND ANALYSIS WEEKLY REPORTING Key Content Review of tickets/issues of previous week. Health of critical services and SLAs Review any potential issues discovered during proactive maintenance activities. Review tasks for coming week. Meeting Type Phone call 30 minutes to 1 hr as per customer requirements MONTHLY REPORTING Key Content Meeting Type Status review meeting to review tickets and SLA performance. Phone call 1 hr Arrow Managed Services Confidential Page 12 of 25

13 4.6 EXTENDING OPERATION SUPPORT FOR NEW SERVICES/INFRASTRUCTURE Arrow Managed Services will perform a service/infrastructure intake process to do knowledge transfer and transition/transfer of information to perform steady state operations. service/infrastructure intake process will be performed by L2 team as ondemand activity and would usually need 2-6 weeks of Transition/TOI before supporting it with SLAs. Arrow Managed Services will evaluate every business service and update on the plan for operation readiness and intake. Arrow Managed Services will present a program change request on this SOS to customer accommodating the additions in devices/services. 4.7 SUPPORT WINDOW Below are the terminologies used by the NOC for the service time frames:- Definition Days Service Timings Mode of Delivery Business Hours Monday to Friday 8:00 am to 6:00 pm Remote Off Business Hours Monday to Friday 6:00 pm to 8:00 am Remote Weekend Hours Saturday & Sunday 6:00 pm Friday to 8:00 am Monday Remote Note: All hours mentioned are client local hours. 4.8 ESCALATION MATRIX Following is the escalation matrix available for customers to escalate any incidents relating to services. Role Skills Major Activities Account Manager Management Skills Strategic interfacing with customer Statement of Service Compliance Overall delivery quality SLA adherence Transposing best practices across sites Availability management Service Delivery Delivery Management Capacity Management Manager Skills Service Delivery review & reporting Bridging the customer and delivery team SOP co-ordination, reviews and approvals SPOC for the customer on Delivery issues Arrow Managed Services Confidential Page 13 of 25

14 Technical Support Group Senior Engineer Help Desk Technical Skills Server, Mail, Network Support Communication Process Knowledge Provide level 3 technical support for all escalated incidents Incident handling Call resolution (servers, network, servers) Handling escalated calls Process adherence Call logging Call assignment Process adherence Configuration Management (ITIL) Following is the Arrow Managed Services Contact List dedicated for the Customer Service Delivery Technical Support Title Name Phone Number Service Delivery Manager Account Manager Arrow Managed Services Confidential Page 14 of 25

15 5.0 ON-BOARDING REQUIREMENTS Tasks include Arrow Managed Services can assist the customer in the above tasks by conducting a discovery and assessment engagement prior to on-boarding. Arrow Managed Services will integrate into customer current outsourced helpdesk provider for SR fulfillment and tracking This would be on a case by case basis. Arrow Managed Services Confidential Page 15 of 25

16 6.0 OUT OF SCOPE Any items not explicitly covered within this document are considered out-of-scope. Upon request, out-of-scope activities will be scoped by Arrow Managed Services and presented to the customer for approval. Arrow Managed Services Confidential Page 16 of 25

17 FEES Arrow Managed Services Confidential Page 17 of 25

18 TERMS AND CONDITIONS Arrow Managed Services Confidential Page 18 of 25

19 DISCLAIMERS DISCLAIMER OF WARRANTIES, LIMITATION OF LIABILITY AND LIMITATION OF ACTIONS. ARROW MANAGED SERVICES MAKES NO WARRANTIES, EXPRESS OR IMPLIED, FOR ITS SERVICES OR ANY RELATED DELIVERABLES, ALL OF WHICH WILL BE PROVIDED AS-IS, WITH ALL FAULTS. ARROW MANAGED SERVICES SPECIFICALLY DISCLAIMS (A) THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, (B) ANY WARRANTY THAT IT S SERVICES OR ANY RELATED DELIVERABLES WILL BE ERROR-FREE OR WILL OPERATE WITHOUT INTERRUPTION AND (C) ANY WARRANTY THAT ITS SERVICES OR ANY RELATED DELIVERABLES WILL RESULT IN ANY ECONOMIC ADVANTAGE, INCREASE IN PROFITS OR REDUCTION IN COSTS. ARROW MANAGED SERVICES WILL NOT BE LIABLE FOR ANY INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF ANY DATA, PROGRAMS, WARRANTIES, ANTICIPATED PROFITS OR OTHER BENEFITS) THAT RESULT FROM USE OF, RELIANCE UPON OR INABILITY TO USE ITS SERVICES OR ANY RELATED DELIVERABLES, REGARDLESS OF (1) WHETHER OR NOT ARROW MANAGED SERVICES HAS BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES AND (2) WHETHER SUCH DAMAGES ARE BASED IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY OR ANY OTHER THEORY OR FORM OF ACTION. If for any reason, by operation of law or otherwise, any of the foregoing disclaimer of warranties and limitation of liability is ineffective, the parties hereby expressly agree that IN NO EVENT SHALL ARROW MANAGED SERVICES S CUMULATIVE LIABILITY TO CUSTOMER IN RELATION TO THIS AGREEMENT AND THE TRANSACTIONS CONTEMPLATED HEREBY EXCEED A SUM EQUAL TO THE TOTAL COMPENSATION ACTUALLY PAID TO ARROW MANAGED SERVICES UNDER THIS AGREEMENT. Neither party shall have the right to institute any action nor does proceeding arising out of any of the transactions contemplated by this Agreement, regardless of the form of such action or proceeding, later than one year after such transaction occur. Customer Signature Print Title Date ARROW MANAGED SERVICES INC. Signature Print Title Date Arrow Managed Services Confidential Page 19 of 25

20 APPENDIX A - SLA Following section describes the various priority levels associated with incidents. The source of alerts is either from Monitoring system or from User requests via our ticketing systems phone or s. Priority 0 (Critical) Description: This is an EMERGENCY situation that significantly restricts the use of an Application or System to perform any critical business function. This could mean that several areas of customer IT infrastructure are impacted. The ticket could originate from multiple sources: customer, end-user, customer IT staff, Arrow Managed Services staff, or an automatic notification from a server, network device or an application. Some examples of critical issues are listed in the bullets below. Target for Response: There will be first response within 15 minutes of receiving notification. A status update will be given within 60 minutes of the initial call. Target for Resolution: Within 4 hours, but the solution may require a temporary workaround until the final solution can be investigated and implemented. In these cases, the ticket will be closed after a workaround is implemented and the service is restored. A new ticket will be opened with a lower priority to evaluate alternative solutions. Procedure: After a critical issue is reported to the incident manager in Arrow Managed Services (ICM) the process is: The ICM will report the issue immediately to all key customer personnel (key customer personnel shown in section on Business Contacts). The ICM will communicate regular status updates to the appropriate customer personnel. If it is appropriate, the ICM will call an emergency coordination meeting with all the issue owners to discuss an action plan for resolution including possible recovery efforts. Incident report will be sent to the customer within 8 Hrs of resolution/workaround which details the steps taken to resolve the Incident. A Root Cause Analysis (RCA) report will be provided within 1 week of resolution to the customer. Examples of Critical Issues Several users or groups have Hardware, Server, Business application, or Network related issue which has a direct impact on CUSTOMER revenue. A comprehensive list will be prepared based on feedback from CUSTOMER & mutual agreement will be made on the expectations. Examples of some critical issues: o Complete web site down o Authentication issues for all users. o FTP Server down Arrow Managed Services Confidential Page 20 of 25

21 o Application to Database connectivity issues o Web Server down o SSL Certificate Expired Priority Level 1(High) P1 Description: Any important functionality of an application is severely impacted. It is deemed high priority (P1) because of its business or financial impact. The ticket could originate from multiple sources: customer end-user, customer IT staff, Arrow Managed Services staff, or an automatic notification from a server, network device or an application. Substantially degraded performance of any critical system (order/invoice channel) is also categorized as Priority 1. The only difference between a P0 and P1 issue is how widespread the issue is i.e. business impact. A P0 may impact the entire department or company where as P1 impacts one/few users. A P1 may impact the entire order/invoice channel where there is a possibility of reverting to a manual or back-up order process. Target for Response: There will be first response within 30 min of receiving notification or leaving a voic if a representative is not available immediately. Status update for every 8 Hrs will be given until the problem gets resolved OR a workaround been provided. Target for Resolution: Within 24 hours, but the solution may require a temporary workaround instead of the final resolution. In these cases, the ticket will be closed after workaround is implemented. A new ticket will be opened with a lower priority to evaluate all possible solutions. If a resolution requires vendor management, the ticket will be escalated to Customer and Arrow Managed Services will provide the back end support required to close the ticket This is just the SLA measurement part where third party vendors are involved and Arrow Managed Services will have less hold on it. However the team will continue to co-ordinate with vendor for first one hour and from second hour an approval would be obtained from customer as it involves additional charges. Examples of High Priority Issues FTP is not accessible for few users. Modify application authentication settings Web server Performance troubleshooting Backup restore A comprehensive list will be prepared based on the feedback from CUSTOMER and mutual agreement will be made on the expectation Priority Level 2 (Medium) Description: The reported issue may restrict the use of one or more features of the system, but the business or financial impact is not severe. The ticket could have originated from multiple sources: customer end-user, customer IT staff, Arrow Managed Services staff, or an automatic notification from a server, network device or an application. The reported issue may be of Arrow Managed Services Confidential Page 21 of 25

22 critical nature but sometimes the issue can be downgraded to a priority 3 because a viable workaround is discovered as a temporary solution. Target for response: within one hour, every 12 hours status update will be provided Target for resolution: within 48 Hrs Examples of medium priority issues Slow web access Log analysis Application configuration changes Priority Level 3 (Low) Description: The reported anomaly in the system does not substantially restrict the use of one or more features of the product to perform necessary business functions. The ticket could have originated from multiple sources: customer end-user, customer IT staff, Arrow Managed Services staff, or an automatic notification from a server, network device or an application. This is a minor problem and will not significantly impact operations. This also arises out of any install/move/add/change (IMAC) activities discussed with customer. Target for Response: Within 2 Hrs Target for Resolution: 5 days (or mutually Agreed) Examples of Minor Issues Low impact changes in IT processes that are of a non-critical nature Any server software or hardware issue for which a workaround exists Patch Installation Backup APPENDIX B ROLES AND RESPONSIBILITIES Activity Customer Arrow Managed Services Enable SNMP/WMI and setup community string Account Access Details for all the Servers Install and Configure VPMG Access in the firewall to allow communication from VPMG Vendor and their contact details with escalation matrix Arrow Managed Services Confidential Page 22 of 25

23 SERVICE DELIVERY Activity Customer Arrow Managed Services Monitoring and alerting IIS Web Servers Troubleshooting and fix IIS related Issues Hands & Feet Support Approval for deploying antivirus updates and monthly security patches End users should be informed of maintenance schedules Preventive Maintenance tasks Antivirus Updating Install missing security and critical patches Reports Backup and Restoration Inform NOC of any changes to the IIS Web Servers Configuration. Arrow Managed Services Confidential Page 23 of 25

24 APPENDIX C VPMG DEPLOYMENT ARCHITECTURE Customized as per customer requirements Arrow Managed Services Confidential Page 24 of 25

25 APPENDIX D EQUIPMENT LIST Insert Device list at customer s locations Arrow Managed Services Confidential Page 25 of 25