E-Commerce Security: Advice from Experts (IT Solutions series)

From the outset, your SLA document and process must make clear to the customer what services are encompassed by the agreement and what services are excluded. The following definitions may be drawn upon in constructing a customized SLA document:

• Maintenance is defined as any activity, performed at the discretion of IT, that invests in and preserves the value to the customer of an existing IT application and environment including the following:

  • Defect correction — this is the correction of critical defects found in a deployed application which inhibit the enterprise from meeting its production system availability or performance requirements. Examples of defect correction activities include responding to production calls for batch systems running overnight and installing system bug fixes.

  • Retooling — this includes any required change related to an upgrade of an infrastructure vendor product. An example would be changes needed to support CICS, DB2, etc.

  • Asset protection — this ensures the continued operation of any production system when changes to enterprise platforms are implemented. An example would be a DB2, ColdFusion, or CICS upgrade.

  • Disaster recovery procedures — these support the business unit in developing its disaster recovery plan and participating in any disaster recovery testing.

  • Required by external agencies — these are activities required by external and internal audit, regulatory agencies, etc. An example would be the process to move applications to and maintain them in a formal change management environment.

  • Applied research and feasibility analysis — as part of both SLA and project work for the business unit, IT services will conduct assessments of IT products, services, and processes to determine their appropriateness in line with business unit needs.

  • Infrastructure and related production support — this is work associated with the implementation and operation of business system applications, especially as these activities relate to Internet-enabled applications.

  • System support — this includes tier 2 and 3 help desk and phone support for existing applications, including both break/fix support and related customer (i.e., end-user) assistance.

• Enhancement work is defined as the day-to-day, business-as-usual activities required to satisfy customer-driven technology platform and systems application requests, including the following:

  • Scheduled updates — these include regular upgrades, bug fixes, and enhancements from the external manufacturer or supplier of an application system installed on behalf of the customer's business.

  • Problem management — this is the process of identifying, investigating, resolving, and preventing events or conditions that interrupt the user's ability to perform his or her job function.

  • Change management — this is the process of knowing, controlling, and planning the configuration, organization, implementation, and operation of products and services. Such changes would typically reach production through regularly scheduled releases of bundled upgrades and enhancements.

  • Enhancements — these are defined, customer-requested improvements or expansions to an existing application's business features or functions. The request does not have mandated start and end dates, and often falls below the priority of a development project request. The criteria for classifying a request as an enhancement are as follows:

  • The request has no significant external dependencies (i.e., no web of commitment outside of IT and the business unit in question).

  • The request does not exceed an estimated $100,000 in total (or whatever clip rate is set by the IT organization).

In reviewing these definitions with the customer, the CRE establishes a common vocabulary for describing and requesting IT services. The boundaries and rules of engagement placed around each service component set expectations. Typically, maintenance service definitions are no problem, and any vagueness about what constitutes an enhancement and what constitutes a project is sorted out over time and through mutual agreement.