SUPPLEMENTAL TERMS FOR LIFE SCIENCES SOLUTION SUITE PUBLIC CLOUD NOVEMBER 2016

Transcription

1 EMC Suite Public Cloud SaaS Service Standards Supplemental Terms The SaaS Service Standards in this document apply (i) only between EMC and those organizations that procure the applicable SaaS Services under a contract directly with EMC (the Customer ); and (ii) only to those SaaS services ordered by the Customer at the time that the SaaS Services Standards are current. EMC may change the SaaS Service Standards at any time. The Customer will be notified of any changes to the SaaS Service Standards in the manner stated in the then current SaaS service ordering and/or related agreement between EMC and the Customer, but any such change shall not apply to any services ordered by the Customer prior to the date of such change. SaaS services obtained from any EMC reseller are governed solely by the agreement between the purchaser and the reseller. That agreement may provide terms that are the same as the SaaS Service Standards listed in this document. The reseller may make arrangements with EMC to perform services for the purchaser on behalf of the reseller. Please contact the reseller or the local EMC sales representative for additional information on EMC s performance of SaaS services obtained from a reseller. Environments provisioned by the SaaS Service with Customer or Customer contracted service provider initiated customizations may not apply to the SaaS Service Standards described in this document. Contents EMC Suite Public Cloud... 1 What is Included?... 2 Services Provided... 2 Service Level Objectives... 2 EMC System Administration Responsibilities... 5 Infrastructure... 5 Platform... 5 Customer Application Administration Responsibilities... 6 Update Management... 7 Supported Configuration & Integrations... 8 Qualification Services: EMC Validation Package... 9 Support Page 1 of 12

2 What is Included? The SaaS environment, which is included only as part of the Customer s specific SaaS Services Agreement, provides right to use public cloud URL access to the standard user interfaces and functionality that are included with the following: Table 1: EMC Suite Public Cloud Product EMC Sciences Suite - Public Cloud Sciences Suite Aerow ARender AMPLEXOR edrg Included Included Included Services Provided EMC shall supply, maintain and operate the SaaS Service including its various parts in accordance with the following specifications: A protected and secure computer room environment with physical access restricted to authorized personnel and network and remote access restricted by firewall and other electronic means to authorized users Sufficient fire suppression equipment so as to protect the computer hardware and network hardware used by the applications, and backup power supplies to provide uninterrupted supplies of electricity Automatic daily backup of all customer content and related data Complete facilities management, including: o Data backups o Computer hardware maintenance o Network hardware maintenance o Management of the EMC endpoint of the site-to-site VPN tunnel o Installation of software updates and fixes as supplied by the manufacturers of the computer and network hardware in place o Any such other tasks as required to operate the computer hosting services. Service Level Objectives These Service Level Objectives do not replace or augment Customer s existing EMC Software warranty/maintenance agreement in any way. The Service Level Objectives are enforceable provided Customer is current on SaaS Service fees. As evidence of Service Level Objective performance, EMC will electronically deliver to Customer by the 10 th day of a calendar month an Availability Report commencing upon production system accessibility for defined end user and/or connecting applications. Customer will have 10 days from receipt of Availability Report to dispute any reported information. Page 2 of 12

3 Definitions A Resource is a collection of servers that comprise an instance of the managed software. Downtime is defined as when the service is not available and a customer is not able to login to the application. Uptime is net of planned maintenance where customers have been notified in advance of the planned maintenance activity. The system is considered Available if the end user can successfully log into the application using a correct password and view the expected landing page. Availability calculations inside of Scheduled Maintenance Window are exclusive of downtime due to customer requested updates or major upgrades to the EMC software. Initial Response Targets is defined as the period of time in which EMC will make commercially reasonable efforts to respond to a Service Request as set forth below. Wherever possible, EMC shall work continuously to respond to and resolve Severity 1 and Severity 2 incidents. Recovery Point Objective (RPO) is the maximum period in which data might be lost due to a targeted event. The RPO for Public Cloud Customers is 24 hours. Recovery Time Objective (RTO) is the duration of time for full system restore in offsite (recovery/secondary) data center post the declaration of a catastrophic failure of primary data center. The following parameters apply to the SaaS Service provided: Only the applications and/or functionality specified as part of the SaaS Service Agreement will be made available to the Customer in the EMC environment. No add-on components or functionality are allowed (e.g., functionality provided by BOCS, RPS, etc.) SAML 2.0 SSO is not supported for Identity Management Service Levels The Service Levels of the SaaS Service are as follows: Table 2: Service Levels Item Life Sciences Suite - Public Cloud Deployment Type Environments Connection Type Off-Premise 1 Prod Environment 2 Non-Prod Environments Public Cloud VPN tunnel is required for access to: Documentum Administrator Documentum Composer Documentum Process Builder D2-Config LDAP Sync Supported Integrations Page 3 of 12

4 Availability 99.50% exclusive of scheduled maintenance 98.0% inclusive of scheduled maintenance Recovery Point Objective Recovery Time Objective Backup 24 hours 3 days Daily Encrypted On-Site Daily Replicated Encrypted Off-Site (DR) 30 Day Backup Retention Storage Tier 1 (Up to 2,000 Users): 1 TB Tier 2 (2001 4,000 Users): 2TB Tier 3 (4,001 10,000 Users): 3 TB Tier 4 (10,001-20,000 Users): 5 TB Tier 5 (20,001 40,000 Users): 10TB Custom Tier (>40,000 Users): to be defined based on user count *Additional Storage can be purchased in 1 TB Increments Users No maximum Active Directory (LDAP) Sync FTP Server Only via VPN Tunnel No Infrastructure Services Incident Management & Resolution Patching Upgrades Maintenance Monitoring Tuning Page 4 of 12

5 Exclusions to Service Availability Service Availability metrics shall not apply to performance issues caused by the following: Overall Internet congestion, slowdown, or unavailability Unavailability of generic Internet services (e.g. DNS servers) Attacks upon the environment perpetrated through the VPN Tunnel to or from the Customer Connectivity issues originating on the Customer end of the network connection Suspension/Termination as described in the terms of agreement A result of Customer equipment or third-party computer hardware, software, or network infrastructure not within the sole control of EMC As result of changes to the provisioned environment performed by Customer or its agents Defects in the EMC Documentum Solution software that result in Severity 2, 3, or 4 incidents. EMC System Administration Responsibilities EMC is the administration team that covers the following areas of operations. Infrastructure EMC manages the following infrastructure components: Power and Environmental Controls Compute and Storage Platform EMC manages the following platform components: Hardware Monitoring, Fault Tolerance and Failover Backup, Restore, and Disaster Recovery Provisioning Isolated Environments Operating System, Database, and Application Server Maintenance Virus Prevention and Mitigation Life Suite Software Installation, Patches, and Upgrades Ongoing Environment Monitoring Ongoing monitoring includes: Overall health of Compute and Storage platform Network traffic, utilization, bandwidth Virus and malware detection and remediation Security posture Monitoring includes both point in time (e.g., exceeding threshold, status) and trending over time (changes in normal behavior). Page 5 of 12

6 Backup Procedures EMC Backup procedures include: Onsite backup encrypted to disk Replicated off-site backup encrypted to disk Customer Application Administration Responsibilities Customer is responsible for the following application development and management tasks: Setup of the Customer End of the VPN Tunnel, which is required for application administration functions related to the following: o Documentum Administrator o Documentum Composer o Documentum Process Builder o D2-Config o LDAP Sync o Supported Configurations o Supported Integrations User Administration Compliance of End User Desktop with Life Sciences Suite Certifications End User Application Execution Application Configuration and Administration Tool Execution End User Help Desk SMTP configuration Bulk Upload Page 6 of 12

7 Update Management The following updates are included in SaaS Service: Table 3: Update Categories for Life Sciences Suite Categories Details Description Example Updates Outage Characteristics Customer Influence 2 Notice 1 Category 1: Critical EMC SaaS Platform Updates Category 2: Patches required to maintain a highly available and secure software/hardware platform Emergency hardware maintenance Patches or upgrades required to optimize or harden the software or hardware platform May provide platform improvements and new features Upgrades to keep components in a supported state Hardware replacement/ upgrades/updates Critical Operating system patches Virus signature and engine updates Rare Rolling outage is planned during EMC s scheduled maintenance or emergency maintenance window None The update is deployed per schedule in order to ensure continued security and operation of the EMC SaaS platform >= 3 days Optimal EMC SaaS Platform Updates EMC SaaS Portal upgrades vshield firewall upgrade Virtualization Software Upgrade Rolling outage is planned during EMC s maintenance window None Customer must take the update >= 30 days Category 3: Critical EMC SaaS Solution Updates Patches required to maintain a highly available and secure EMC SaaS software platform Patches or upgrades that do not include features or do not enable features Life Sciences Solution Suite Security Fix Documentum Platform Severity 1 Bug Fix Rare Rolling outage is planned during EMC s scheduled maintenance or emergency maintenance window None The update is deployed per schedule in order to ensure continued security and operation of the EMC SaaS platform No more than 1 upgrade per year 3 One upgrade is required within 2 years of contract date or previous upgrade 3 Customers choose upgrade window within designated 2 year upgrade timeline 3 >= 3 days Category 4: Optimal EMC SaaS Solution Updates Patches or upgrades required to optimize the solution May provide solution improvements & new features Upgrades to keep solutions in a supported state Life Sciences Solution Suite 4.0 to 4.1 Documentum Platform 7.1 to 7.2 One application environment at a time would be taken down to apply the update >= 30 days 1. The notification window is a general estimate. Some critical issues may need to be resolved immediately with minimal notice. Notice via approach defined in the section pertaining to Services Level Objectives and will include description of affected servers, services, and components as well as expected downtimes for each. 2. Expected Frequency is a general estimate. Due to the dependencies on third party products (such as operating systems, application servers, databases, hardware components, etc.) the frequency of updates is very difficult to predict. We will strive to consolidate updates to reduce the overall frequency of scheduled downtimes, but reserve the right to require scheduled activities during our published downtime window as frequently as required to maintain the secure, reliable operation of EMC Suite Public Cloud. 3. Customers deployed in 2016 will require one mandatory Category 4 upgrade of the rendering component prior to the end of calendar year This is an out-of-cycle upgrade requirement that does not apply to any of the defined parameters for upgrade frequency. Page 7 of 12

8 Supported Configuration & Integrations The EMC Suite Public Cloud offering is designed to be a standardized service that allows customers to take advantage of the robust end user functionality offered within the applications and the cost savings expected from cloud-based deployments. Given the larger enterprise software ecosystem typically found in the Life Sciences Industry, this section is intended to clarify supported methods of connecting the EMC Suite Public Cloud to the following types of systems: Clinical Trial Management Systems (CTMS) Laboratory Information Management Systems (LIMS) Learning Management Systems (LMS) Electronic Publishing Systems Quality Management Systems (QMS) Registration Management Systems ERP Systems Integrations The LS SDK will be available to the customer/partner/ps to download and install in an On-Premise system that requires integration with the EMC Suite Public Cloud offering. Any customization using the LS SDK is completed and deployed within the On-Premise system. Only calls to the SDK API are supported. The use of the VPN tunnel will be required for any of the supported API calls (via the Life Sciences SDK) initiated from an On-Premise system. Documentum Foundation Services (DFS & D2FS) Direct API calls using DFS or D2FS to the applications included in the EMC Suite are not supported in any type of deployment model, including public cloud, given the risk of invalid data. DFS is not enabled to accept any direct API calls. EMC does not assume any liability for performance degradation, invalid data, or downtime caused by use of direct third-party API calls to D2FS. Documentum Foundation Classes (DFC) Direct API calls using DFC to the Documentum Platform included in the EMC Suite Public Cloud are supported only via the VPN tunnel. The proximity of both the end user and the code/application sending DFC API calls to the EMC public cloud environment should be considered prior to deployment. The performance of DFC API calls may degrade as the distance between the locations increases. EMC does not assume any liability for the impact to performance, uptime, or data that is caused by use of direct third-party API calls to DFC. Custom Code for Integrations Integrations that require installation of any type of custom code within the EMC Suite Public Cloud environment are not supported. Elevated Privileges for APIs Any API calls that require dmadmin level or Documentum SuperUser privileges are not supported in the EMC Suite Public Cloud. Elevated privileges decrease the stability of the solution and can easily disable EMC from the ability to meet Service Level Objectives. Page 8 of 12

9 EMC Documentum RESTful Services There are currently no RESTful Services that have been released specific to D2 or the Life Suite. The EMC Documentum RESTful Services for the Documentum Platform are not currently exposed as part of the EMC Suite Public Cloud offering. Configuration & Customization Configurations that can be completed via D2-Config are supported in the EMC Suite Public Cloud offering. These types of configurations are comparable with competitive SaaS offerings and are designed to be sufficient for the needs of the enterprise Life Sciences Industry customer. D2-Config will not be exposed on the public internet and will only be exposed via the VPN Tunnel. No custom code of any type, including custom D2 Widgets, java methods, third party products, or relevant executable code, can be installed within the EMC Suite Public Cloud environment. All supported customer specific options are available through D2 Config, direct API calls using DFC, and the On-Premise installation of the LS SDK as mentioned above. Qualification Services: EMC Validation Package The EMC Validation Package includes the following documents to assist the customer with their FDA requirements for validation activity: Validation Plan (Completed by EMC for which EMC defines the validation strategy & deliverables available via Audit) Requirements Document (User Requirements Specifications URS) Traceability Matrix (Completed by EMC available via Audit) Test Plan (Completed by EMC available via Audit) Test Script Instructions OQ Script Approval (Completed by EMC available via Audit) Installation Qualification Report & Installation Log Files (Completed by EMC for EMC Validation of the environment available via Audit) Executed Operational Qualification Protocols and Related Deviations, if applicable (Completed by EMC for EMC Validation of the environment available via Audit) Individual Deviation Forms (Completed by EMC for EMC Validation of the environment available via Audit) Deviation Tracking Form (a summary of the above Individual Deviation Forms & Completed by EMC for EMC Validation of the environment available via Audit) Validation Summary Report (Completed by EMC for EMC Validation of the environment available via Audit) EMC Solutions Validation Template Package, which includes: o DCTM LS 4.0 Solutions Validation Plan o DCTM LS 4.0 User Requirements Specification o DCTM LS 4.0 Solutions Trace Matrix o DCTM LS 4.0 Solutions Test Plan o DCTM LS 4.0 Test Script Instructions o DCTM LS 4.0 Solutions Validation Package History Page 9 of 12

10 o DCTM LS 4.0 Solutions Package Overview o DCTM for Life Sciences 4.0 OQ Test Scripts Set o DCTM for Life Sciences 4.0 PQ Test Script Set o DCTM LS 4.0 Solutions Validation Summary Report Page 10 of 12

11 Deliverables Overview The set of documents included in the EMC Validation Package are intended to cover all components associated with the Life 4.0 in an OOTB configuration. These documents are included as templates to assist the customer in their required validation activities associated with the installation of the EMC Science Solution Suite Public Cloud. EMC is not responsible for the completion of these document templates. Category Description This document describes the activities and documentation to be completed in validating the Life s implementation. Solutions Validation Plan User Requirements Specifications Solutions Traceability Matrix The purpose of the validation plan is to establish the requirements needed to provide documented evidence that the Life s system has been installed and is operating according to approved requirements, manufacturer specifications, and quality objectives. This Plan will also identify and describe the major components comprising this validation. These components can be viewed as the specific deliverables of the validation effort and will be addressed by either referencing a separate protocol (e.g. IQ protocol) or in the final validation report for the Life s system. This document provides the user and business level OOTB features, functions, and high level default configurations. The requirements documents are divided into the following sections: Unified Solution Layer Requirements This section provides all the features and functions found at the core level of the solution and are leveraged across all modules. Documentum etmf Requirements This section provides the features specific to the etmf module or specific configurations of core level functionality within the etmf module. Documentum R&D Requirements This section provides the features specific to the R&D module or specific configurations of core level functionality within the R&D module. Documentum SSV Requirements This section provides the features specific to the SSV module or specific configurations of core level functionality within the SSV module. Documentum Q&M Requirements This section provides the features specific to the Q&M module or specific configurations of core level functionality within the Q&M module. Compliance Requirements These requirements are the system level requirements from FDA 21 CFR Part 11. These requirements are met in all three modules of the solution suite. This document shows that the Requirement Specification for the Life s have all been accounted for in either a Performance Qualification / User Acceptance Testing (PQ/UAT) Test script or has been identified as an administrative functions which is outside the scope of the PQ/UAT testing. Page 11 of 12

12 Category Solutions Test Plan Test Script Instructions Solutions Validation Summary Report Solutions Validation Template Package History Solutions Validation Template Package Overview OQ Test Scripts Set Suite 4.0 PQ Test Script Set Description This document provides a list of test scripts to be executed as part of the User Acceptance Testing activities. This testing is meant to demonstrate that the delivered system will meet the application related requirements listed in the EMC DCTM LS Solutions User Requirement Specifications document. The test plan is to test the application related functions within LS Solutions that will use as part of their day-to-day document management operations. Administrative and system related functions are not part of this plan. This document provides information relating to the Life s Test Scripts and its execution. It provides an overview of the steps and process involved in completing the LS 4.0 SaaS Operation Qualification (OQ). It will identify test script sequence, instructions relating to good documentation practices for validation, forms/templates used for documenting test script results and an example of a completed test script and its attachments. This document summarizes the results of the executed Life Science Solutions Test Plan. It identifies the Pass/Fail test result for each test script, and summarizes any incidents/deviation encountered in the test execution. The objective of this Validation Package History Document is to define the files that changed from the previous version of the EMC Solutions Validation Template Package. The purpose of this document is to provide an overview relating to the EMC Documentum Life Sciences 4.0 Solutions Validation Package. The templates in this package are provided to assist customers with their documentation responsibilities related to validation that extend beyond items covered by EMC. The OQ Test Script set are the test scripts used for OQ validation to verify the functionality of the system to the individual requirements listed in User Requirement Specification. The PQ Test Script set are test scripts designed to verify business oriented processes from beginning to end. Page 12 of 12

13 Support The following table lists Initial Response Targets for incidents opened with EMC. Table 4: Service Request Severity Definitions Category Item Description Initial Response Target Service Request Severity 1 Severe problem preventing customer or workgroup from performing critical business function Service Request Severity 2 Customer or workgroup able to perform job function, but performance of job function degraded or severely limited Service Request Severity 3 Customer or workgroup performance of job function is largely unaffected Service Request Severity 4 Minimal system impact; includes feature requests and other non-critical questions 1 hour 2 hours 3 local business hours 8 local business hours Support services are provided on a 24x7 basis provided Customer is current on SaaS Service fees. Failure to perform Services and to meet the service levels: Should EMC fail to perform to its obligations on service levels, EMC will advise the customer as soon as reasonably practicable of said failure and provide reasonable steps to remediate the issue. EMC will take all commercially reasonable steps necessary to minimize the service interruption and impact of such failure. Page 13 of 12

14 Copyright 2015 EMC Corporation. All rights reserved. Published in USA. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. The information in this publication is provided as is. EMC Corporation makes no representations or warranties of any kind with respect to the information in this publication, and specifically disclaims implied warranties of merchantability or fitness for a particular purpose. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC², EMC, and the EMC logo are registered trademarks or trademarks of EMC Corporation in the United States and other countries. All other trademarks used herein are the property of their respective owners. For the most up-to-date regulatory document for your product line, go to EMC Online Support (