www.mrsa.uk.net ASP Service; Service Level Agreement This Service Level Agreement ("SLA") is between The Training Foundation Ltd, a Company registered in England, no. 3603214, of Foundation House, Millburn Hill Road, Coventry, CV4 7EZ (“TTF”) and XXX of……………. ………………………………………………….(“Customer”) and describes certain performance and security components regarding the operation of www.mrsa.no.com, the web hosting service provided by TTF. This SLA is governed by the customer’s ASP Licence Agreement, and is complemented by TTF's Privacy Statement, designed to protect the privacy, security and best interests of TTF's customers. TTF and Customer agree to abide by the terms of this SLA. TTF shall use commercial best efforts to provide continuous and consistent service with respect to this SLA. TTF reserves the right to add, subtract or amend the terms of this agreement at any time in the event of significant changes in market conditions which adversely affect TTF’s ability to provide its hosting services. Such changes shall be notified to Customer with at least 60 days notice. Service Availability This section describes TTF's uptime guarantee for the mrsa.no.com service. TTF will use commercial best efforts to provide customers with 99.5% network availability (note 1). Service status reports will be distributed monthly via e-mail to Customer’s nominated administrator. TTF reserves the right to plan a scheduled outage with forty-eight (48) hours advance notice. TTF will use commercial best efforts to schedule these outages at non-peak hours and limit their occurrence to strictly necessary upgrades and required maintenance. Details of all scheduled outages are maintained on www.mrsa.no.com in the Customer Care section and broadcast via e-mail to Customer’s designated administrator Customer Responsibilities It is Customer’s responsibility to notify all affected persons within their organisation of scheduled outages. Physical Security and Environmental Control This section describes how TTF protects the mrsa.no.com service against unauthorised physical access and the threats of fire, power, temperature, humidity and other physical forces. The mrsa.no.com hosting platform is located in secure offices in Manchester, UK. Physical access to the data centre is strictly limited to authorised personnel. Other persons are admitted only on an as needed basis (e.g., to maintain hardware components) and only under supervision. The data centre is protected by state-of-the art fire prevention and intruder alarm systems. Continuous conditioned power is supplied by UPS backup systems. Network Access and Security This section describes how TTF protects the service against unauthorised network access and the related security measures TTF takes to protect its customers. It also contains some customer technical requirements. TTF uses industry routers and switches and firewalls. Servers are installed in a load balanced and/or clustered configuration, as appropriate. TTF connects to an Internet backbone via an Easynet SDSL line by-passing British Telecom exchange. Customer Responsibilities: Customers are responsible for properly maintaining the functional operation of all workstation equipment including connectivity to the Internet. Prior to alleging any connectivity problems, the customer will verify that they are able to reach major sites such as www.msn.com or www.yahoo.com. ASP Service Level Agreement Page 1 of 3 Customers must use Microsoft Internet Explorer Browser version 5.0 or higher. Customer's Administrators must allow the running of all TTF ActiveX controls in order to carry out user and service administration provided by TTF’s Service Manager. All TTF Active X controls are provided with digital certificates by VeriSign. Customer is responsible for configuration of their Internet firewall to allow all necessary ports to be used. Data Security This section describes the significant measures TTF takes to protect customer information and contains important requirements for customers to follow to further enhance data security. All customer data is located in secure directories that require access authentication. All customer data is backed up to tape. Backup tapes are stored in a secure off-site location. Nightly incremental backups are taken Monday – Saturday with full back up on Sunday. Incremental backups are retained for two (2) weeks. Weekly backups are retained for ten (10) weeks. Monthly backups are retained for fifty-two (52) weeks. Customer Responsibilities: The following customer requirements enhance data security: Customers must use discretion granting administrator privileges. Users must not share their login identifier or password. Users should change their passwords at least every forty-five (45) days. Users must select passwords that are eight (8) characters or longer. We strongly recommend that passwords include mixed alpha and numeric text. Implementation of additions or changes to course content This section applies to new Revisions of courses as developed, tested and released by TTF. Minor corrections or changes to content will be made by TTF without reference elsewhere. Full details of the enhanced and/or new content of each major change will be posted on the Customer Care section of the website seven days before intended implementation. No change to course content will be made which requires additional hardware or software by end users. Customer Care Quality This section describes how TTF maintains high quality customer care to ensure customer satisfaction. TTF provides a variety of ways for customers to request help or otherwise make inquiries. Telephone support during normal business hours (9 – 5.30 Mon – Fri). The support telephone line is 02476 411288. E-mail to support@trainingfoundation.com Severity categories and response times are as follows: Severity #1 - assigned to outages that prevent access to the Service. Severity #2 - assigned to a situation that slows an organisation's response time Severity #3 - assigned to (1) a general question relating to a technical issue or (2) a request for functional enhancement of a course. Description Status Updates TTF Management Elevation [Note 1] Resolution report identifying the cause of the problem Severity 1 2 hours Yes Severity 2 24 hours As Needed Severity 3 2 business days As Needed Yes Yes As Needed ASP Service Level Agreement Page 2 of 3 If TTF fails to comply with the response procedures described above, it will give affected customers a full day's credit [Note 2]. Notes [1] TTF Management Elevation escalates customer communication responsibility of an open item's status, through progressive levels of TTF management, for each subsequent reporting cycle as follows: 1st elevation - supervisor of help-desk support; 2nd elevation - Customer Service Manager; 3rd elevation - Director of Operations; 4th elevation - CEO (or another officer of the company). [2] All credits are limited and will not exceed the total charge relevant for a specific period. Accepted for and on behalf of: The Training Foundation Ltd Signature: ……….…………. Full Name: ………………….. Job Title: ………..……….. Date: …………… Foundation House Millburn Hill Road Coventry United Kingdom CV4 7EZ Signature: .……………………….. Full Name: ……………………….. Job Title: …..…………………….. Date: ………..… ASP Service Level Agreement Page 3 of 3