JHS 212 Service level management (SLM) of ICT services

Appendix 1 Service Level Agreement (SLA) for ICT services

  • Version: 1.0
  • Published: 9 October 2019
  • Validity: until further notice

INSTRUCTIONS FOR USE

This agreement template is intended for use in public administration when a customer (contracting entity) procures ICT services and support services associated with them. This agreement sets out the service levels of the services and deviations that result in sanctions.

The service may refer to a turnkey service, which contains all components needed for service provision, such as servers, information systems, software, connections, licences and support services, or to a more limited service. The detailed content of the service is described in the service provider's (supplier’s) service description.

The service contract between the contracting entity and the supplier describes the contracting parties, the object and period of validity of the contract, the content of the service, the contracting parties’ responsibilities and duties, contact persons, communication practices, ownership of and access to data, information security and data protection, prices, invoicing and any other terms and conditions.

The service may be delivered in many different ways, for example as a cloud service, or it may be installed in an environment located in the contracting entity's data centre. Regardless of the selected delivery method, the service level negotiations between the supplier and the contracting entity should cover each detail, and service levels that are satisfactory for both parties should be agreed upon.

This agreement template can be tailored to each individual case, and all parts of it that do not apply can be deleted. Instructions for completing the agreement template:

  • the sections shown in black can be left as they are
  • the sections marked in yellow should be modified to meet the needs of the service in question and its service level targets (the instructions and all unwanted parts should be deleted).

The starting point is that none of the service level targets or other requirements set out in this document are mandatory, and any of them can be removed from the final agreement.

These instructions for use do not form part of the agreement.

Agreement date and number:

Appendix No:

    1 Scope of application

(1.1) This Service Level Agreement specifies the service levels of the services provided by the supplier for the contracting entity (referred to separately as 'a service’ and jointly as ‘the services’).

(1.2) This Service Level Agreement will be applied as the services go live.

(1.3) Primarily, these terms and conditions and the supplier’s service descriptions, and secondarily, the supplier’s general terms and conditions valid at any one time, will be complied with in this Service Level Agreement, unless otherwise agreed in writing in an Article of this Service Level Agreement.

(1.4) The supplier will only perform the tasks included in the service description during the service hours of the service.

(1.5) The agreed service levels will be measured on the basis of figures produced by the supplier's work management system (ticketing system) or other production environment.

(1.6) In the service level calculations will not be included:

    1. The contracting entity's and/or the supplier’s service maintenance windows;
    2. Major incidents whose root causes are not within the supplier's control;
    3. Service level deviations beyond the supplier's control resulting from the contracting entity’s failure to perform a task, or incorrect performance of a task, for which they are responsible, or errors in instructions for which the contracting entity is responsible.

(7) The supplier shall notify the customer without delay of any circumstances having come to their knowledge which may prevent the service from being used in accordance with the agreement.

    2 Definitions

(2.1) In this Service Level Agreement, the definitions given in the recommendation JHS 212 Service level management of ICT services (SLM) will be used.

    3 Customer support and contact channels

(3.1) A Service Desk will be provided, which the service user contacts about incidents and service requests.

The supplier’s support channels: [Insert the agreed methods of contacting the service, add/remove rows if necessary]:

Method of contact

Address/telephone number

Telephone

+358 XXX XXX XXXX

Web form

https://address.domain.fi

E-mail

n.n@domain.fi

(3.2) The Service Desk has a system for logging service requests and incidents. The system keeps the user who made a request or reported an incident informed of progress made with processing the request or incident.

    4 Service maintenance windows

(4.1) The supplier’s maintenance actions may result in service downtime. An outage during a service maintenance window is always a planned outage, which is not included in the service level calculation.

(4.2) The service maintenance windows will be timed to take place as shown in the table below.

Service maintenance window

Date and time

Description

General service maintenance window

[fill in]

Covers all of the supplier's services and environments.

Special service maintenance window

[fill in]

Covers information security and other updates that cannot wait for the next general service maintenance window.

    5 Service levels

      5.1 Service hours

The ICT services covered by the agreement, their business criticality level and the service hours are given in the list below. Select the criticality level and service hours of each service from the suggestions in the table or specify them separately. Once the table has been completed and approved by both contracting parties, the text in this section should be deleted from the agreement.

(5.1.1) The service hours of the services covered by the agreement are specified as set out in the following table.

Add/remove rows or content if necessary. If the agreement covers several services, complete a separate table for each service. Delete this text from the final agreement.

Service name

Service criticality level

Service hours

ICT service 1 [name the service]

Critical

24/7 on all days of the year

High

07:00 - 22:00 Finnish time on weekdays

Normal

07:00 - 17:00 Finnish time on weekdays

Low

08:00 - 16:15 Finnish time on weekdays

09:00 - 18:00 Finnish time on Saturdays

09:00 - 18:00 Finnish time on Sundays

[other, specify]

(5.1.2) The supplier has a duty to respond to service requests and incident reports during the service hours of the support service. The service hours of the support services covered by the agreement are set out in the following table.

Add/remove rows or content if necessary. If the various channels (telephone, e-mail, chat, self-service) have different service hours, you can fill in a separate row for each one in the table. Delete this text from the final agreement.

Service name

Service hours

Support service

24/7 on all days of the year

07:00 - 22:00 Finnish time on weekdays

07:00 - 17:00 Finnish time on weekdays

08:00 - 16:15 Finnish time on weekdays

08:00 - 16:00 Finnish time on weekdays

09:00 - 18:00 Finnish time on Saturdays

09:00 - 18:00 Finnish time on Sundays

[other, specify]

      5.2 Availability

(5.2.1) ICT service availability is described as a percentage of the service hours. The availability rate describes the minimum target for ICT service availability during the period of scrutiny. Data produced by the incident management process will be used to monitor ICT service availability at the monthly and yearly level. Fill in each one of the tables below for every ICT service mentioned above and delete these instructions once the final tables have been completed.

(5.2.2) The service level targets concerning ICT service availability are determined on the basis of each service’s business criticality level as follows:

Level of ICT service business criticality

Availability during service hours, excluding pre-agreed service maintenance windows

Critical

[fill in, for example 99.8%]

High

[fill in, for example 99.5%]

Normal

[fill in, for example 98.0%]

Low

[fill in, for example 95.0%]

(5.2.3) Other performance indicators related to availability can also be specified if this is considered necessary. Add your preferred performance indicators to the table below or remove unwanted ones. Delete the instructions from this section once the final table has been completed.

Performance indicator

Target

Maximum number of outages/month

[fill in, for example 4]

Number of agreed service maintenance windows/month

[fill in, for example 1]

(5.2.4) The performance indicators associated with availability are agreed upon between the supplier and the contracting entity in each case. The maximum duration of an outage during service hours, depending on the level of criticality of the service, can be used as one of the indicators. Add your preferred target values to the table below and delete the instructions from this section once the final table has been completed.

Criticality of ICT service

Maximum outage length during service hours

Critical

[fill in, for example 30 minutes]

High

[fill in, for example 1 hr]

Normal

[fill in, for example 2 hrs]

Low

[fill in, for example 3 hrs]

      5.3 Response time

(5.3.1) The target values for the support service's reachability, or response time, are specified in the following table. An automated message is not taken into account as the supplier's response (for example: “Thank you, your message has been received and we will contact you soon.” Fill in the table below with the agreed methods of contact for the service and the relevant response time requirements. Delete unnecessary options. Delete these instructions once the final table has been completed.

Method of contact

Response time

Telephone

[fill in, for example 5 minutes]

Web form/Chat

[fill in, for example 10 minutes]

E-mail

[fill in, for example 60 minutes]

      5.4 Incident resolution time

(5.4.1) The calculation of incident resolution time starts when a support request has been received and ends when normal service availability has been restored or a workaround has been developed for an incident. The supplier shall log workarounds in a database of known errors, which may be part of the configuration management system.

(5.4.2) Incident significance will be classified on the basis of the following definitions.

Incident significance

Definition

High

The entire service is unavailable, its performance is significantly reduced or the service is unusable.

Moderate

Essential parts of the service are unavailable.

The incident disrupts the availability or normal use of the service.

Low

The incident is sporadic, affects individual users or does not essentially disrupt service use.

(5.4.3) Incident priority in terms of the ICT service’s business criticality and the incident’s significance will be determined according to the following table.

INCIDENT PRIORITY

ICT service criticality

Incident significance

High

Moderate

Low

Critical

1

1

3

High

1

2

3

Normal

2

2

3

Low

3

3

3

(5.4.4) The actions taken in case of an incident will depend on the incident’s priority. The resolution time target of an incident will be determined according to the table below.

Incident priority

Action

Incident resolution time target

1

Repairs are initiated immediately and continued without interruption, personnel are called in and other preparedness procedures are used. The agreed procedures are followed when communicating about the incident.

[fill in, for example 1 hr]

2

Repairs are initiated immediately and continued without interruption, using the available resources. Personnel are called in if necessary. The agreed procedures are followed when communicating about the incident.

[fill in, for example 4 hrs]

3

Repairs are carried out with the available resources. Incidence investigation is mainly carried out during office hours.

[fill in, for example 12 hrs]

      5.5 Service request resolution time

(5.5.1) The calculation of service request resolution time starts when the request has been received and ends when the processing of the request ends, the logged service request (ticket) is closed, the service request is no longer being processed by anyone, and the service request is not reopened.

(5.5.2) A ticket is not regarded as being closed if the Service Desk has escalated it to some other service queue or party and, in fact, its processing has not yet been completed.

(5.5.3) The specified service levels of service requests will apply during the service hours. For example, they can be specified as follows [add and delete as required]:

Service request

Description

Resolution time

Password reset

Service request requires rapid actions or the requested information is essential for the customer in order for them to get on with their work.

[fill in, for example 8 hrs]

Addition of user rights

Service request requires relatively rapid actions or the requested information is to some extent essential for the customer in order for them to get on with their work.

[fill in, for example 16 hrs]

Workstation installation

Service request does not require rapid actions or the requested information is not essential for the customer in order for them to get on with their work.

[fill in, for example 40 hrs]

      5.6 Incident and service request solution capability

(5.6.1) Performance indicators related to solution capability have been determined for incidents and service requests. The service levels related to these performance indicators are set out in the following table.

Incident solution capability:

Performance indicator

Target

First Contact Resolution (FCR)

[fill in, for example 95%]

Service request solution capability:

Performance indicator

Target

First Contact Resolution (FCR)

[fill in here, for example 99%]

If you do not wish to use these indicators, remove the entire section from the agreement.

    6 Change management

(6.1) The supplier implements changes in the production environment following either a standard or normal change process.

(6.2) Standard changes include low-risk changes and frequently repeated similar changes that do not result in a service outage.

(6.3) The supplier will follow the normal change process in the implementation of other changes apart from those implemented as standard changes.

(6.4) The urgency of a change is determined as follows:

  1. Emergency change: a change carried out immediately in order to recover from a service outage or information security threat, or to prevent such outages or threats
  2. Fast-tracked change: a change to be deployed within less than two weeks
  3. Change implemented as part of a batch release or on a separately agreed date: to be deployed as part of a batch release or on a separately agreed date in more than two weeks.

(6.5) The incident management and change management classifications are loosely connected. An observed incident or threat of incident may trigger an urgent change. On the other hand, even if an incident meets the criteria for priority level 1, it may still be implemented in connection with a batch release, depending on the case. The precondition is that operational capacity has been restored on a temporary basis and there is no immediate threat of the incident's uncontrolled recurrence.

    7 Customer satisfaction, user satisfaction and Net Promoter Score

(7.1) The supplier is responsible for measuring customer satisfaction, user satisfaction and the Net Promoter Score.

(7.2) The supplier will report to the contracting entity on customer satisfaction, user satisfaction and the Net Promote Score regularly as indicated in the table below. [Specify the measuring interval, evaluation scales and target figures in the table. Remove rows if necessary.]

Measurement interval

Evaluation scale

Target figure

Customer satisfaction

Once a year

4 to 10 or 0 to 10

average > 8.5

User satisfaction

Once a year

4 to 10 or 0 to 10

average > 8.5

Net Promoter Score (NPS)

Four times a year

0 to 10 (NPS: -100…+100)

> +30

(7.3) Set down here the practices for measuring customer satisfaction: the purpose of each indicator, target figures, implementation method, calculation formula, frequency, data source, who measures, how the results are responded to, whether or not the measurement results will be associated with sanctions.

    8 Monitoring, measurement and reporting

(8.1) The supplier is responsible for monitoring the service level achievement.

(8.2) The supplier will report to the contracting entity regularly on service level achievement [fill in: on a monthly basis/length of other measuring period].

(8.3) The supplier will report to the contracting entity on significant service level incidents, significant changes and development needs concerning the service, and available updates. The supplier will also inform the contracting entity without undue delay if any information security gaps in the service or its parts come to their knowledge.

(8.4) The supplier will submit to the contracting entity the indicator data used as the basis of measuring the service level and the availability data produced by the monitoring system.

(8.5) The supplier will submit to the customer a calculation of sanctions relevant to the service level together with the service level report.

    9 Service level deviations

(9.1) The service level will be measured as described in this Service Level Agreement. The service does not attain the agreed level when the service level of a service is lower than what is described in this Service Level Agreement. This constitutes a service level deviation.

(9.2) On written request of the contracting entity, the supplier will credit the contracting entity with the amount of any sanctions and deduct this amount from the service fees.

    10 Sanctions

(10.1) The contracting entity shall demand the payment of any sanctions in writing within one (1) month of the time at which the service level deviation occurred.

(10.2) On the contracting entity's request, the supplier undertakes to check an alleged service level deviation based on the supplier's monitoring system values.

(10.3) The sanctions payable for a service level deviation are determined as indicated in the table below. Fill in the table with the sanctions agreed upon with the supplier. If the agreement covers several services, fill in the sanctions for each service if necessary. It does not necessarily make sense to associate sanctions with all the indicators. Please note: the figures shown in the table are examples that should be modified and simplified as needed.

If the parties wish to associate a sanction with customer satisfaction and/or the Net Promoter Score, the contracting entity and the supplier should agree upon a maximum sanction amount (EUR) based on the total value of the service cooperation.

Performance indicator

Grounds for sanctions

Percentage of the monthly fee credited for the service in question

Service availability during service hours

Service criticality level: critical

Failure to achieve the target:

Availability less than 99.8% but at least 99.5%

Availability less than 99.5% but at least 99.2%

Availability less than 99.2% but at least 98.7%

Availability less than 98.7% but at least 97.8%

Availability less than 97.8% but at least 96%

If the availability is less than 96%, the monthly fee for the service in question will not be charged.

10%

20%

30%

40%

50%

100%

Service availability during service hours

Service criticality level: high

Failure to achieve the target:

Availability less than 99.5% but at least 99.3%

Availability less than 99.3% but at least 98.8%

Availability less than 98.8% but at least 98.3%

Availability less than 98.3% but at least 97.3%

Availability less than 97.3% but at least 95%

If the availability is less than 95%, the monthly fee for the service in question will not be charged.

10%

20%

30%

40%

50%

100%

Service availability during service hours

Service criticality level: normal

Failure to achieve the target:

Availability less than 98.0% but at least 97.5%

Availability less than 97.5% but at least 95.5%

Availability less than 95.5% but at least 90%

If the availability is less than 90%, the monthly fee for the service in question will not be charged.

10%

30%

50%

100%

Service availability during service hours

Service criticality level: low

Failure to achieve the target:

Availability less than 95.0% but at least 94.0%

Availability less than 94.0% but at least 92.0%

Availability less than 92.0% but at least 90%

If the availability is less than 90%, the monthly fee for the service in question will not be charged.

10%

30%

50%

100%

Response time during the service hours of the support service

Failure to achieve the target:

At minimum 85% but less than 95% of contacts responded to within the target time

At minimum 75% but less than 85% of contacts responded to within the target time

At minimum 65% but less than 75% of contacts responded to within the target time

Less than 65% of contacts responded to within the target time

10%

20%

30%

40%

Incident resolution time during the service hours of the support service

Failure to achieve the target:

At minimum 85% but less than 95% of incidents resolved within the target time

At minimum 75% but less than 85% of incidents resolved within the target time

At minimum 65% but less than 75% of incidents resolved within the target time

Less than 65% of incidents resolved within the target time

10%

20%

40%

50%

Incident solution capability during the service hours of the support service

(First Contact Resolution)

Failure to achieve the target:

More than 0.1 but no more than 10 percentage points

More than 10 but no more than 20 percentage points

More than 20 but no more than 30 percentage points

More than 30 percentage points

10%

20%

30%

40%

Service request solution capability during the Service Hours of the support service

(First Contact Resolution)

Failure to achieve the target:

More than 0.1 but no more than 10 percentage points

More than 10 but no more than 20 percentage points

More than 20 but no more than 30 percentage points

More than 30 percentage points

10%

20%

30%

40%

Customer satisfaction

Actual customer satisfaction - target level:

> 0.5 (target level exceeded)

-0.5…-1.0

-1.1…-2.0

< -2.0

Bonus: 50%

Sanction 40%

Sanction 60%

Sanction 100%

Please note: if sanctions are associated with customer satisfaction, the basis for calculating the sanction or bonus should be specified clearly.

Net Promoter Score

Actual NPS:

Target level exceeded

Target level not achieved but NPS > +20

Target level not achieved but NPS > +10

< +10

Bonus: 50%

Sanction 40%

Sanction 60%

Sanction 100%

Please note: if sanctions are associated with the NPS score, the basis for calculating the sanction or bonus should be specified clearly.

(10.4) Alternatively, the sanctions can be calculated in accordance with the following model:

For each indicator, a target level and a quality deviation value resulting from failure to achieve the target is set, for example serious, significant and slight. The total amount of the sanction is calculated based on the number of quality deviations relevant to different indicators/services. For example, if the highest quality deviation is slight, the sanction is 10% of the monthly fee charged for the service, or if there are three or more serious quality deviations, the sanction is 30%.