Tripwire® ExpertOps™ Service Level Agreement

Overview

To support our clients’ ability to monitor their IT assets, the Tripwire ExpertOps service (“ExpertOps Service”) provides a hosted Tripwire Enterprise (“TE”) console, licensed Tripwire Enterprise software for managed nodes as described in an order, and system administration services provided by Tripwire’s Managed Services during the ExpertOps Service term. ExpertOps Service is offered on an annual basis, and includes standard implementation, monitoring, reporting and support during the term based on the client’s configuration instructions and policies.

Service level targets vary based on the service level selected by the client: Essential, Advanced or Advanced Plus.

1. Service Requests

Service Tier

Request Type

Response Target*

Advanced Plus

Urgent Service Request

30 minutes

Advanced Plus

Routine Service Request

4 hours

Advanced Plus

Major Service Request

1 business day

Advanced

Urgent Service Request

1 hour

Advanced

Routine Service Request

1 business day

Advanced

Major Service Request

2 business days

Essential

Urgent Service Request

4 hours

Essential

Routine Service Request

1 business day

Essential

Major Service Request

2 business days

*Response targets are based on Tripwire business hours, 6:00am-5:00pm Pacific, Monday-Friday, excluding national holidays.

Urgent Service Request: An immediate audit or regulatory need that has an impact on an ongoing breach investigation, or a configuration request that addresses an issue that impacts more than 50% of the environment monitored by the ExpertOps Service. All urgent service requests must be submitted via telephone or through a ticket/case in the Tripwire Customer Center (TCC) and annotated with the correct request type. Implementation timeframes will vary based on the nature of the request and the service tier.

Routine Service Request: A minor adjustment to configurations or a request for further information on reporting or analysis that is in scope for the client’s service tier. Implementation timeframes will vary based on the nature of the request and the service tier.

Major Service Request: Any request that will take longer than 8 hours to complete. This could include major reporting or dashboard changes, policy imports, requests for application monitoring, or in depth analysis of compliance or FIM reporting. Implementation timeframes will vary based on the nature of the request and the service tier.

2. Fault Identification

Tripwire Managed Services will notify the Client Lead of an outage of either the hosted environment or connectivity to the client environment according the schedule below. Examples of service faults:

  • Communication failure between proxy agent host and ExpertOps infrastructure.
  • Data is not flowing between proxy agent host and ExpertOps TE console
  • Application services are not available. (i.e. ExpertOps TE console or logon services not available)

Service Tier

Response Target*

Resolution Target**

Advanced Plus

30 minutes

1 business day

Advanced

1 hour

1 business day

Essential

4 hours

2 business days

*Response target is defined as the amount of time to respond once an outage is detected by Tripwire Managed Services. Response and resolution targets are based on Tripwire business hours, 6:00am-5:00pm Pacific, Monday-Friday, excluding national holidays.

**Resolution Targets apply only to service faults caused by issues or events under Tripwire’s sole control. For example, if the service fault is caused by an issue with the proxy agent host, and Tripwire cannot access the host and resolve the issue remotely without the client’s assistance, these targets do not apply.

3. Event Ticket Creation

Tripwire Managed Services will create tickets in the Tripwire Customer Center as a result of the following conditions for Advanced and Advanced Plus service tiers:

Event Type

Creation Target*

Critical Severity Changes to Monitored Assets

Within 30 minutes of detection

Critical Asset Policy Threshold Non-achievement

Within one business day of detection

Critical Asset Monitoring Outage

Within one business day of detection

*Creation targets are based on Tripwire business hours, 6:00am-5:00pm Pacific, Monday-Friday, excluding national holidays.

4. Service Level Credits

The claim process for a Client to request a remedy for any missed service level target is set out below. This process is the sole and exclusive remedy for any service level target that is not met.

4.1 Claim Submission. In order to receive a credit, the client must electronically submit a claim within ten (10) days after the date on which the service level target was not met. The claim must be sent to managed@tripwire.com and contain the following information:

  • “SLA Credit Request” in the email subject line
  • Client’s name
  • Client contact name
  • Client contact phone number
  • Case or ticket number

· Description of the service level target not met and the date of the failure

4.2 Claim Review and Determination. Tripwire will make all credit determinations in its reasonable discretion and will notify the client contact in writing (which may be in the form of an email) of its decision. If any request is rejected, Tripwire’s notification will provide the reasons for the rejection.

4.3 Service Level Credits. For all accepted claim requests, Tripwire will provide a service level credit to the client equal to the pro-rated charges for one full day of the affected services (i.e., 1/365th of the annual fee) for each day during which one or more of the service level targets was not met. Any service level credits accrued will be credited against the fees owed by the client to Tripwire. If service level credits are still owed at the termination or expiration of the applicable agreement, Tripwire will pay the outstanding service level credits to the client.

4.4 Service Level Credit Exceptions. Service level credit requests will not be accepted if Tripwire’s failure to meet the service level target results from (i) the client’s failure to meet its obligations set forth in the ExpertOps Service Description and Service Agreement; (ii) the client’s material impediment of Tripwire’s efforts to meet the service level target; (iii) the client’s negligent acts or omissions; (iv) the failure or malfunction of equipment, applications or systems not owned or controlled by Tripwire; (v) circumstances or causes beyond the reasonable control of Tripwire; or (vi) scheduled and pre-announced maintenance periods.

4.5 Maximum Credits. If multiple service level credits are accrued for the same date, such service level credits will not be cumulative. The maximum service level credit for one day, regardless of the number of service level targets missed, will be the pro-rated service charges for that day. Under no circumstances shall Tripwire be required to issue service level credits to Client in any one calendar month totaling more than ten days of service fees.