SLA # __________

Purdue University Young Hall

302 Wood Street West Lafayette, IN

47906

Service Level Agreement

Version 1.0 23-Mar-09

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 2 of 10

Service Level Agreement for SAP Enterprise Systems This SLA describes the partnered relationship between Business Services and ITaP to support the modernization of Purdue’s financial and human resource administrative systems and business processes. The document describes the conditions under which ITaP and Business Services plan to support the SAP Enterprise Systems initiative. The document recognizes the partnership between ITaP and Business Services to provide both technical and functional support to the customers and users of the SAP Enterprise Systems.

Purdue University Young Hall 302 Wood Street West Lafayette, IN 47906

1. Term

The term of this agreement is from October 1, 2007 to June 30, 2010 2. SLA Contact Information Customer Provider

Business Services ITaP, ITEA Michael Szczepanski Jeffrey L. Whitten Director, Business Services Computing AVP, Enterprise Applications 42177 mikes@purdue.edu jwhitten@purdue.edu

3. Funding

Costs associated with the Post-Go Live support and maintenance of SAP Enterprise Systems have been identified to the best of current ability. At this point, these costs are being covered from central funds that have been allocated to ITaP for this purpose. A re-evaluation of costs should happen on a regular basis.

4. Review and approval Signed by James S Almond Signed Gerry McCartney ______________________________________ ________________________________________ John Shipley, Interim VP Business Services and Asst Treasurer Gerry McCartney, CIO, ITaP J S Almond

5. Service Overview Due to the size and complexity of the SAP Enterprise Systems, there are some unique elements to consider. First, it is important to have a high level understanding of the structure of the production system. The system has five major components. The Portal provides the front door into the system. It passes user requests to the functional components of SAP. These are the Business Warehouse (BW) for reporting, the Enterprise Core Component (ECC), Exchange Infrastructure (XI), and Supplier Relationship Management (SRM). 6. Software/Application The SAP Enterprise Systems refer to the hardware and software environments associated with Purdue’s implementation of SAP. It will provide financial, human resources, and supply chain functionality to all four campuses within the Purdue system. 7. ITaP Responsibilities 7.1 Information Technology Customer Relations

• Provide ongoing technical support through the Customer Service Center. Includes attempt at resolution and then escalation as appropriate.

7.2 Information Technology Systems and Operations

7.2.1. Database Administration • Installing and maintaining database management software. • Backup and recovery measures to safeguard data. • Monitoring and maintaining space usage within the database. • Monitoring and maintaining availability and performance of the database. • Provisioning and monitoring security measures within the database environment. • Creating or re-creating new database instances where necessary. • Collaborating with departments in maintaining databases where database administration (DBA)

involvement is necessary. • Assisting with data movement between instances. • Creating user accounts in application systems that require DBA involvement.

7.2.2. Application Hosting ITaP will provide hosting services for enterprise applications in a secure, controlled environment. Support includes server procurement and installation, application installation, security patching, maintenance, monitoring, and backup and recovery services.

7.2.2.1.Unix Server Administration

• Installation of hardware into the ITaP server environment • Installation of OS and application software (as per license agreement). • Adding/modifying/removing system user accounts • Monitoring of file system and disk usage • Monitoring system availability • System and application patching support

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 3 of 10

• Monitoring for suspicious system activity • Responsibility for system security and maintenance and firewall maintenance • F5 load balancer administration • Adhere to a regular schedule of vulnerability scans on servers. • Provide tier 3 support for incidents and requests as escalated via the Remedy system

7.2.2.2.SAP System Administration (Basis)

• Provide software maintenance and modification • Provide Basis administration for all components and all SAP Enterprise Systems

environments. • Monitor and maintain sufficient system availability and capacity to ensure redundancy and

failover capabilities • Provide change control and transport capabilities for production environments consistent

with ITaP Change Management process. • Assist customer in benchmarking jobs at customer request. This will be used as a way to

test further patches and upgrades for their impact on performance.

7.2.3. Backups

7.2.3.1.Standard Files/File System • Recovery Point Objective (Maximum amount of data loss), 24 hours. File backups are

taken once every 24 hours and maintained for 30 days.

7.2.3.2.Production Databases (Oracle) • Recovery Point Objective, minutes. The database environment is replicated to stand-by

databases via Oracle Data Guard.

7.2.3.3.Non-Production Databases (Oracle) • Recovery Point Objective, 24 hours. This tracking is maintained for the previous 14 days.

7.3 Information Technology Enterprise Applications

Provide enterprise application support, including: • Customer relationship management via SAP Technical Competency Center Director • Software maintenance and modification via Remedy to Technical Competency Center

Director. • Application production process incident consulting and/or management support for clients • Application production process quality assurance consulting and support • SAP Portal Administration and support • Integration and planning services • Provide tier 3 support for incidents and requests as escalated via the Remedy system • SAP Business Warehouse data extraction and modeling • SAP Business Warehouse administration and support • Testing services • Project and Portfolio Management Services

7.4 Information Technology Networks and Security

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 4 of 10

7.4.1. Identity Access and Management • Provide role maintenance for position-based and person-based roles as requested by Business

Services within an agreed upon timeframe based on need. • Account maintenance for SAP Enterprise user accounts will be accomplished through standard

IAMO career account processes. • New hire access to SAP Employee Self-Service will be set up within one business

day after complete and correct entry of SAP HR master employee data by Human Resources SAP role assignment to positions will occur within one business day of receipt

of the request from Business Services 7.4.2. Security/IT Incident Response

• Security consulting, analysis and recommendations • Provide IT incident response and remediation

7.5 Teaching and Learning Technologies (TLT)

7.5.1 Provide access to the SAP Enterprise Systems suite of applications via an SAP-compliant browser for users who do not have a compliant browser. This includes initial installation and testing, as well as operation and periodic maintenance of the application on Software Remote.

7.5.2 Training • Maintain an instructional course management environment (currently Blackboard) • Provide training to instructional designers on use of the instructional course management

environment • Provide training registration services. • Provide training metrics and course completion reporting. • Schedule computing lab facilities for system training. • Manage training facilities. Currently have recurring funding for 1 (20 station facility) +

funding through 2012 for support of 60 additional training machines. • Develop and teach enterprise reporting tool training.

8. Customer Responsibilities 8.1 Business Services owns and operates the support process for functional support. Business Services also

retains responsibility for maintaining their Business@Purdue website, which details current business processes. In addition, Business Services also undertakes the following:

• Assign individuals who represent Business Services and facilitate the appropriate process for prioritization and approval of change requirements.

• Assign individuals who serve as a liaison between functional areas and ITaP • Maintain a pool of resources available for future enhancements and upgrades in SAP Enterprise

Systems. • Maintain SAP application configuration as it relates to business process and function. • Complete and maintain SAP Enterprise Systems Support information in order to help categorize

incidents in the tracking system. • Supply emergency contact information for incidents with priority other than “Standard.” • Identify common questions with answers and populate/maintain the ITaP Knowledge Base • Identify escalation paths and contact points • Provide tier 2 and/or tier 3 support for incidents and requests as escalated via the Remedy system

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 5 of 10

• Request that critical jobs be benchmarked for performance and then use this as a baseline for future performance of the system

8.2 Training • Set training priorities and determine schedules • Plan and manage OnePurdue FI/HR training projects. • Identify audiences to be trained; determine curricula and course content. • Coordinate training needs with stakeholders (regional campuses, Phys. Facilities, HFS,

Intercollegiate Athletics, etc.). • Develop/maintain online and instructor-led courses, other learning materials, and learning

assessment methods. • Provide all training communications, including course catalog and web presence. • Teach SAP courses and provide Subject Matter Experts for instructor-led courses. • Develop and teach enterprise reporting data training. • Coordinate training registration and logistics with ITaP Customer Education • Write/maintain SAP system Business Process Procedures (using RWD Infopak). • Maintain SAP training environment including planning, execution and coordination of changes

to this environment. Includes responsibility for: o Functionality and data o Accounts and access o Update strategy and schedule o Backup and refresh schedule

• Fund training material production (no funding source was identified in HR/FI recurring budget). 9. Scheduled Maintenance – Production Environments

9.1 Standard Maintenance Window If downtime maintenance is required to production environments, the ITaP Systems and Operations

division will use the standard maintenance window of Saturday, 4:00 p.m. to midnight. This window will only be used when needed.

Other than these scheduled maintenance windows, the primary SAP system will be available 24 hours x 6.5 days.

Every Tuesday from 6:00 – 800 pm the system is taken down to run transports.

9.2.Security Patching 9.2.1. UNIX

UNIX operating system security patches will be applied to systems within 48 hours after the Unix administration group is notified of its release by the vendor. Application of these patches will either be coordinated with Business Services or during the standard maintenance window.

9.2.2. Oracle Oracle security patching will occur once patches have been certified by SAP. Application of these

patches will either be coordinated with Business Services or during the standard maintenance window.

9.3.Change Management Information regarding downtimes due to scheduled maintenance or unscheduled outages will be

available through the ITaP Change Management website: http://www.itap.purdue.edu/infrastructure/operations/change/

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 6 of 10

Changes to the non production environments will be handled by the SAP Change Control process and Advisory Board. 10. System Incident Response

10.1. Monitoring The quickest way to respond to Incidents is to have a system that monitors for the occurrence of things

outside of normal system operation. If a monitoring system notifies of an incident, ITaP will respond without any action from the customer. The following items will be monitored for errors or defined alarm thresholds:

• Memory/Page file • Logical/Physical Disk • Network Interface • Processor

Also, these following items are being monitored that are specific to the SAP Enterprise System

• Business Warehouse and data extraction • XI Interfaces

The primary SAP monitoring tool is Solution Manager which monitors various conditions for the production SAP systems. Email is the notification method. Conditions monitored:

• Java availability • System availability • Filesystem space • Internal SAP job failure

Oracle Grid is used to monitor database health. Email is the notification method. Conditions monitored:

• Tablespace free space • Agent up/down • Database up/down • Archivelog space

A Beacon program runs externally from the SAP networks and checks system availability. If the system is not responsive, an email is sent to the Basis team. A script executed daily on all production hosts that checks for unsuccessful logon attempts. An email is sent only if indications of repeated unsuccessful attempts are detected.

Critical alerts are interpreted and will be communicated via the ITaP Outage Notification system.

10.2. Incident/Request Resolution and Response All incidents reported through the CSC will be assigned a priority based on urgency and impact.

Resolution times indicated are targets. The resolution of any issue is dependent upon complexity, the need for parts to be ordered or located, the need for software to be upgraded or reinstalled, and/or the need for additional information from the user who may not be immediately available. All of these factors can

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 7 of 10

influence the length of time it takes to resolve a service or application outage. A customer can reasonably escalate an incident level based on extenuating circumstances, including time of year.

Priorities are defined below, based on one or more of the bulleted conditions:

Standard (target resolution - 3 days) • Single user affected. • IT Resource is available with degraded performance and/or is difficult to use. • User requests general information, service or consultation.

Urgent (target resolution - 1 day) • Small group of users directly affected. • IT Resource is available with degraded performance and/or is difficult to use.

Critical (target resolution - 4 hours) • Multiple users or departments are directly affected. • Incident has serious impact on critical tasks and no workaround is available • IT Resource cannot function as designed and installed.

Emergency (target resolution - 1 hour) • Entire campus or multiple campuses affected. • Core business process cannot be carried out.

10.3. System Notifications

Unscheduled service interruptions and changes that are unable to make the full change management process will be posted to the Systems Availability calendar. These announcements will also be available for subscription via the Systems Notification sign up web page. https://www.itap.purdue.edu/infrastructure/operations/change/calendar.cfm

10.4. Catastrophic Response A catastrophic issue is one in which a hardware failure occurs, major data corruption occurs, or in

which hardware replacement is required. In these cases additional time will be needed to procure replacement hardware and/or repurpose and reload non-production hardware from the QA/Dev environment to replace production hardware.

All of this assumes a catastrophic failure in the SAP Enterprise Systems only. Should an event occur which affects the entire campus datacenter and/or back up facility then these timings would not apply. Systems and services would be brought back on line on a priority basis in accordance with system criticality as provided by the business areas via Disaster Recovery Task Force. The same applies for security incidents where it would be inadvisable to bring a service back on-line if vulnerabilities still exist.

11. Support Processes

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 8 of 10

11.2 Self Help Options. Many self-help tools are available to users of the SAP Enterprise Systems system. These tools are listed below, indicating responsibility for maintenance.

• Self-Help. From within the SAP Enterprise Systems application, users can access a help menu. Content of these help pages are maintained by the subject matter experts who will use the Change Management process for updates.

• Business@Purdue (www.purdue.edu/b@p). This site, maintained by Business Services, provides information on Purdue business processes as well as links to information on tips, contact information, policies, training and forms.

• SAP Enterprise Systems Training Materials. In addition to the materials received during training, users can find information on news, updates, schedules, and other training services at http://www.purdue.edu/OnePurdue/training/index.shtml. This site is maintained by ITaP.

• SAP Enterprise Systems Knowledge Base. Users can visit http://help.itap.purdue.edu/OnePurdue and search a technical knowledgebase by using keywords. This site is maintained by ITaP with assistance from the business.

11.3 ITaP Customer Service Center (CSC) Availability

The ITaP Customer Service Center (CSC) is open at the following times (excluding Purdue University and national holidays) for telephone calls and walk-in traffic (Eastern Standard Time, -5:00 GMT):

• Monday through Thursday, 7:00 a.m. to 8:00 p.m. • Friday, 7:00 a.m. to 6:00 p.m. • Saturday and Sunday, Noon to 6 p.m.

Hours may change based on CSC traffic patterns and are posted on the ITaP Change Management

website: http://www.itap.purdue.edu/change/

11.4 Requests and Incident Reporting Users will request information and report incidents requiring ITaP support by

• Calling 494-4000 • Emailing itap@purdue.edu • Visiting Stewart Center, Room G-65

If the incident is time-sensitive, users should call rather than sending email. The CSC will resolve

common, simple incidents and requests whenever possible. When the CSC is unable to resolve an incident, they will assign the incident to the appropriate ITaP staff or other Purdue University staff for resolution.

All incidents and requests reported through the CSC will involve opening a ticket and gathering user information and information about the incident or request needed for initial diagnosis and classification. Based on the diagnosis, the CSC representative will determine the most qualified person for resolution and confirm the priority level based on the impact and urgency of the incident or request.

11.5 After Hours/Weekend Incident Reporting Incidents or outages that occur outside of the hours listed above should also be reported to the CSC at

the number or email address above. Users calling “After Hours” will hear a recorded telephone message instructing them to do one of the following:

• Leave a voice mail message with details to be addressed the next business day • Press 0 to report an outage or urgent or emergency service disruption

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 9 of 10

ITaP Service Level Agreement--ITSO (Version 3.6, rev. 01/25/08

Page 10 of 10

By selecting 0, the user will be forwarded over to the Infrastructure Operations Center (IOC) to speak to an Operator. If the IOC is closed, that call is forwarded to an answering service. The answering service will contact the on-call IOC Shift Supervisor regarding service outages and disruptions. The Shift Supervisor will initiate investigations and contact appropriate ITaP staff.

12 Security Customer and ITaP agree to comply with all Federal, State, and local laws as well as all Purdue University policies and procedures, including all Purdue University information technology policies located at: http://www.purdue.edu/securePurdue/. Questions about information security should be directed to ITaP at 765-494-4000. 13 Facilities Location All services described in this Service Level Agreement are managed by ITaP and are housed on servers located in secure ITaP facilities. 14 Service Performance Reporting/Reviews Business Services staff should contact ITaP Service Level Manager by telephone at 765-494-6826 or by email at jmcelduf@purdue.edu if there is a need to meet and discuss unsatisfactory performance. 15 Annual Review This Service Level Agreement will be reviewed annually. Prior to the annual review, modifications to the service level agreement may only be made if mutually agreeable to both sides. Any modifications will be included in a written amendment to this agreement signed by both parties. The implementation of any changes will occur thirty (30) days after agreement has been reached. 16 Termination Clause Either party may terminate this agreement by providing written notification to the other party ninety (90) days in advance of termination