SERVICE DEFINITION- D&B DATA INTEGRATION TOOLKIT The Data Integration Toolkit enables you to automate the integration of D&B data directly into your systems and applications without the need to change your technology, helping reduce the costs associated with process re-engineering. The Toolkit delivers D&B information as XML tagged data for easy dissemination and enables secure transactions over the internet. 1. Find companies, register companies for monitoring and cleanse addresses 2. Make requests for data or reports via Java or COM toolkit interfaces, or directly using XML via D&B’s secure server 3. Process these requests via the Toolkit. The information you need is gathered from D&B’s global databases and third party sources via D&B’s internal “Global Data Access” technology and returned to your system or application. The Data Integration Toolkit is the first global set of tools that can be integrated directly into new or existing ‘legacy’ applications, enabling you to reduce development efforts to focus on: o Re-engineering business applications and processes o Developing tools to automate manual processes o Implementing CRM and ERP applications o Defining and building technical architecture o Enhancing Web Services with D&B data Using the Toolkit you are able to access D&B data transactionally via your corporate Intranet, Win32 application, browser, or other container environment and integrate it directly into your internal applications and third party enterprise software solutions. Choosing the platform that’s right for you There are two ways to utilize the Data Integration platform: 1) The Java and COM Data Integration Toolkits The Java and COM Data Integration Toolkits offer software encapsulating the functionality offered in the Data Integration transactions. Both versions present this functionality as an intuitive, highly comprehensible set of objects which can be utilized by client applications to access Data Integration products and services. The required Toolkit can be downloaded from the Data Integration Web Site and installed on a client computer. Client developers can then utilize the Toolkit in their Windows™, Unix, Web-based, or alternate platform applications. 2) The XML Data Integration Toolkit While the Java and COM Data Integration Toolkits are based on XML transactions for all products and services they currently support, the XML Data Integration Toolkit provides tools to assist users in developing applications which use those transactions directly. When the XML Data Integration Toolkit is used, it is not necessary to install D&B software on your production servers. Using the Data Integration Toolkit The Data Integration Toolkit components are easy and intuitive to understand and are easily customized to suit your organization’s processes, systems and applications. The following can be downloaded directly from the Internet, along with documentation: • Example code in various programming languages • Sample applications • Detailed API specifications clearly outlining the object model and relationships • COM and Java API Toolkits • XML Schemas • Data Dictionary • Error codes and messages Applications built on either Java or COM Data Integration Toolkits or that communicate directly with the D&B servers through XML Data Integration Toolkit transactions can be designed to run through a standard set of steps according to the needs of your business. Using a choice of the XML transactions you can find a company and identify its unique D-U-N-S Number, D&B’s universal identifier that links disparate data on companies worldwide. Based on this D-U-N-S Number, you can retrieve either tagged data or formatted reports. In addition, companies can be monitored for changes to critical data using the Toolkit’s Data Monitoring solution. You can also use D&B’s Global DecisionMaker, a powerful ASP application, to set your own decision strategy and generate an automated decision based on your own data and data from D&B’s global database of over 230 million businesses worldwide. Additional transactions allow you to cleanse an address from your database, identify available products on a company and retrieve previously ordered products .As an example, the process flow you design could include logging in, searching, selecting a match, ordering information, delivering this into your application and archiving the information ordered for future reference. Security Using the D&B Toolkit, you can very quickly and securely embed these transactions into your new or existing application. The Toolkit communicates with the D&B servers using XML over HTTP encoded in SSL. Information and technical support Dedicated groups within D&B are responsible for specific aspects of support, from the pre-sales stage, through the development process and on through post-production. During the initial stages, members of a skilled D&B team can work with you and your D&B representative to help you achieve your business objectives, providing consultation and technical support. To help you further, you can access extensive information by going to the Data Integration Toolkit website at: http://toolkit.dnb.com and selecting the Data Integration Toolkit option. And for specialist assistance while building your application or for more information on specific functionality you can also contact the dedicated support team directly, via e-mail at Toolkit@dnb.com The target Impact Level (IL) at which we believe the G-Cloud Service is able to hold and process information is currently IL2 D&B do not currently hold ISO 27001 accreditation. However, D&B uses ISO/IEC 27002 (Information Security Code of Practice) as a framework for information security practices and uses ISO/IEC 27001 (Information Security Requirements Specifications) (Standard Specification) as a framework for its Information Security Program. Security policies are internal documents, but can be viewed on site” D&B Business Continuity, Technical Infrastructure & Information Security At D&B, our company and brand are built on enabling customers to Decide with Confidence…during normal business operations and in the event of an unexpected incident. Our Business Continuity planning began in 1984. The goal is to create a control environment that meets or exceeds all expectations, based on regulatory guidelines and industry practices that enable our customers to Decide with Confidence. The end result of these efforts is a philosophy that ensures that control objectives are developed and implemented on a proactive basis. This philosophy is core to the day-to-day operations of D&B and its service providers. D&B has entered into a technology outsourcing agreement with Acxiom that encompasses the primary and recovery data centers. We feel that this agreement has put us in a position to continue with this philosophy and improve upon it as the company grows and the technological challenges become more complex. Approach The Business Continuity philosophy at D&B is holistic, designed to protect the safety of associates, provide the assurance that our customers can rely on D&B to deliver products and services and safeguard the reputation of the Company. Business Continuity Management Our charter is the protection of team members, physical plant, data and physical security. Plans encompass risk management of critical functions, assets, technology, vendors and records. Detailed plans include alternate work locations, cross training of associates, and communication with internal and external constituents. Situational awareness of worldwide incidents that may impact operations is maintained through a sophisticated system that provides real-time alerts to D&B leaders. Plan maintenance occurs on an annual basis or more frequently if required by operational changes. For answers to any questions on our Business Continuity Plans, please contact Jack McAdams, Leader of BusinessContinuity at mcadamsj@dnb.com Technology Infrastructure Our Disaster Recovery program is centered onto minimizing disruption to our customers. Our Technology Recovery Plans focus on individual site recovery as well as critical Business Process Recovery. The Disaster Recovery plans are tested on a semiannual basis with action plans established to address issues from the test. The tests validate the procedures and note any changes or modifications that are required. These items, along with general maintenance (e.g., organizational changes, vendor contacts, etc.), are included in the regular plan maintenance process. Planning for the next test commences at the end of the maintenance process. This lifecycle approach ensures the business recovery plans are continually updated. For answers to any questions on our Technology Disaster Recovery Plans, please contact Pete Miller, Leader of Disaster Recovery at millerpe@dnb.com Information Security Information security impact is essential to our brand and quality delivery. We have an information security approach that is updated routinely to adapt to the changing environment and technology employed by D&B. D&B’s security and risk approach is managed as a closed loop process. A risk reduction model for data control is established based upon many business drivers for our overall business. A set of security policies and general practices within D&B help to guide these protection activities as a whole. The goals are implemented through a variety of activities undertaken by D&B including process definition, policy setting, hardening standards and procedures, technology investments, and education. The D&B operational environment is then audited for compliance to the policies. Remediation action plans are developed to drive our compliance objectives. For answers to any questions on our Information Security Plans, please contact Vince O’Donnell, Leader of Technology Customer Security at odonnellv@dnb.com D&B Business Continuity Structure The Corporate Business Continuity Management Team, based at D&B World Headquarters, is charged with the responsibility of maintaining the ability of the corporation to deliver products and services to D&B customers should events disrupt the normal conduct of business. The team is part of the Global Customer Operations structure at D&B. The team is a resource providing guidance, direction and oversight for business continuity. The team also performs exercises of individual plans and is the focal point of operations should a business continuity event take place. Each D&B location has assigned one or more Site Incident Managers. These individuals are the local representative of the Corporate Business Continuity Management Team at their location. They function as the eyes and ears of the corporate team. The Corporate Business Continuity Management Team works in concert with the Technology Disaster Recovery Team to maximize effectiveness. Situational Awareness Some incidents may be anticipated based on conditions; others present a sudden onset of threat. It is our belief that it is better to avoid incidents or their impact than it is to react after the fact. Preplanning coupled with ongoing attention to potentially disruptive events enables D&B to avoid the impact of many incidents. Participation in collaborative groups and continual awareness of global events provide early warning in many cases. D&B subscribes to several services that provide situational awareness of incidents, advisories and events around the world. Alert notifications are programmatically provided to the Site Incident Managers for incidents in their respective locations. The Corporate Business Continuity Management Team receives all alerts and our Travel Department those which may impact company travelers. Communications The ability to communicate with stakeholders is a critical part of a response and recovery effort. D&B utilizes a fast response communications system that allows notification via telephone (office, home, mobile) and email. The system is designed to identify those who have received the message and at what time. Responses from recipients may be requested and documented. The system permits consistent communication, unlike conventional call trees and the like. The D&B Human Resources data system provides contact information for employees and is updated monthly. Communications to non-employee stake holders and others (customers, governmental authorities, media, etc) is addressed in the D&B Crisis Management and Communications Plan (CMCP). The CMCP is not part of the Business Continuity Plans, but is closely associated. Customer communications is effected via the DNB.COM website, direct communications from Corporate Communications, Relationship Managers or others as the situation dictates. Customer contact data is not maintained in the business continuity plans but is available through our CRM system. Activation and Escalation Business Continuity plans may be activated by senior management, business unit leaders or the Corporate Business Continuity Management Team. All involved stakeholders are notified immediately should a plan be activated. The Corporate Business Continuity Management Team assumes responsibility for communications, coordination and plan execution following activation. Most incidents (well over 95%) are addressed and closed by local management, the Site Incident Manager and the Corporate Business Continuity Management Team without escalation or plan activation. The leader of the team is also the chair of the Corporate Incident Management Team. This team consists of senior leaders representing all areas of the business that may be activated in those incidents when the leader of Corporate Business Continuity requires additional resources. The ultimate escalation is to the Crisis Management and Communications team. This team consists of the most senior leaders of D&B and is chaired by the Chief Executive Officer of D&B. The Crisis Management and Communications Team is activated only should an event require the highest executive level of participation. BCP Plan Methodology Plans are designed for worst case of all risk scenarios. D&B business continuity plans are based upon the identification of critical processes, associated dependencies and Recovery Time Objectives (RTO) for each. Critical processes are defined as those functions that are required for D&B to deliver contracted products and services to our customers. The dependencies for critical processes include human capital, systems, applications, facilities and infrastructure required to deliver product, vital records and third party requirements. Plans are maintained for individual business units at D&B locations that perform critical processes. Plan Preparation and Ownership Individual business continuity plan ownership resides with the appropriate business unit leader. Business continuity planning begins with a review of the Threat / Risk / Impact report (Impact Analysis) for the appropriate location. Changes are noted and the analysis updated. Plans are created and subsequently updated through an interview process. The Corporate Business Continuity Management Team conducts interviews with leaders and subject matter experts to determine critical processes, associated RTO, dependencies and contingency plans. Any weaknesses are identified and assigned to an owner for resolution. Plan Exercise, Update and Distribution Tabletop exercises are performed as appropriate. This means that some plans are tested more frequently than others as criticality or changes to the operation may dictate. The Corporate Business Continuity Management Team is responsible for conducting the exercise through a scenario based test. Results are provided to senior management and any observed areas requiring improvement are assigned to the business unit owner for resolution. Updated plans are finalized and distributed to the owner(s) and responsible parties in each business unit. Pandemic Management The potential of a pandemic event impacting D&B operations was recognized as a threat in 2005. D&B has expanded the Business Continuity plan to include pandemic-specific factors. Additional pandemic Management information is available through your D&B Relationship Manager. For answers to any questions on our Business Continuity Management, please contact Jack McAdams (mcadamsj@dnb.com) Our Technology continuity program is centered onto minimizing disruption to our customers. Our Technology Recovery Plans focus on individual site recovery as well as critical Business Process Recovery. The Disaster Recovery plans are tested on a semiannual basis with action plans established to address issues from the test. The tests validate the procedures and note any changes or modifications that are required. These items, along with general maintenance (e.g., organizational changes, vendor contacts, etc.), are included in the regular plan maintenance process. Planning for the next test commences at the end of the maintenance process. This lifecycle approach ensures the business recovery plans are continually updated. Additional details are available upon request to millerp@dnb.com The Data Centers have redundancy throughout the infrastructure. The UPS system is comprised of: utes of support. Any utility outage longer than 5 seconds causes the system to automatically start the generators and switch the power grid over for a minimum of 15 minutes. If another event occurs, the counter starts over. ooling towers rated at 400 tons each and two (redundant) water pumps. These units are used alternately (by week), and can be run in parallel if needed. enabled by the Facilities group. We have installed an Analyzer II; a highly sensitive Smoke Detection System – dual interlock sprinkler system in all computer rooms. Additional Features to Ensure Reliability (PDU). of the power cables are located within a power tray system, and all electrical receptacles are mounted directly onto this tray to ensure they are not kicked or pulled by any other cables under the floor. for personnel and equipment; they are elevated 6 inches from the sub-floor to protect equipment, in the unlikely event of a water leak. -floor area. led (with matching labels on the connected server rack) and documented. separate tray that is mounted under the floor or from the ceiling, these are separate from the power trays. Data Backup Process D&B has invested in the IT infrastructure to provide redundancy and fault tolerance. Mainframes are configured as multiple systems operating in a Sysplex environment. Web and midrange systems are clustered with load balancing and fail-over capability at a warm site. Network Area Storage utilizes EMC2© Storage devices with Business Continuity Volumes. These BCV volumes are replicated to our Acxiom recovery environment on a weekly basis and stored on a remote EMC storage device to meet our recovery time objective. D&B employs redundant OC3 network links to multiple Internet Service Providers to provide fault tolerance for telecommunications services. Offsite data backups to tape are scheduled weekly starting on Fridays and continue throughout the weekend. Daily replication takes place for specific Gold systems to our remote disaster recovery site. Replication is from both SAN and NAS storage systems. Recovery of Declared Disaster at Primary Data Center Our Technology recovery plan has provisions to enable us to restore our critical databases, data center operations and telecommunications capabilities within 48 hours in the event an unexpected incident renders our computer facility unusable. The recovery plan includes detailed steps for the declaration of a disaster through the resumption of services. Areas covered in the recovery plan: (48 Hour RTO) Escalation and Notification Procedures Hot-Site Facility Notification Process Offsite Storage Facility Notification – delivery within 2 hours Perform Detailed Damage Assessment Establish Command Center Activate Recovery teams Telecommunications Recovery Technical recovery Team Storage Management Recovery Team Applications Recovery Team Database Recovery Team Production Operations Recovery Team Perform Application/System recovery at alternate recovery location. Establish Customer facing application access. A detailed Technology recovery document covers these and other critical steps to reestablish the functionality of the primary data center in the event of disaster. This document is considered confidential and customer copies are not permitted. These plans include evacuation procedures, communications plans, alternative recovery contingencies and failover plans for key business capabilities. All plans can be made available for onsite review at D&B Headquarters. For answers to any questions on our Technology Disaster Recovery Plan, please contact Pete Miller, Leader of Disaster Recovery at millerpe@dnb.com. Training- D&B provide training on the use of the systems. Including offering on line and telephone assistance A trial can be provide it will normally be over a two week period with limited data access Pricing has been included in the pricing matrix attached. Onboarding of customers are dependent on the completion of the documentation and internal checks. The data volumes and size of data packets to be delivered will be taken into account Service Level Definitions Service Hours The Data Integration Toolkit service delivers products from D&B’s host databases around the world. The Data Integration Toolkit environment at D&B comprises: A Central Gateway Service which receives and processes customer requests and provides access to the Archive (or “ReUse”) ”Database – the Customer’s datastore of previously ordered products. Regional D&B host databases around the world which, in total, deliver data on over 92 million businesses in over 150 countries. The Central Gateway is accessible to customers 24 x 6.5. It’s normal service hours are: 09:00 EST Sunday to 11pm EST Saturday. The US and Canadian data hosts and most of the other D&B host databases are accessible 24 x 6.5 in line with the Toolkit Central Gateway. The Host Availability Table in Appendix A shows the available hours for all of the D&B data hosts. Routine Maintenance Central Gateway The Toolkit is unavailable each week from 11pm EST Saturday night until 9am EST Sunday morning. That is the routine maintenance period for the Central Gateway. During this time, no enquiries can be processed nor can the Customer access their Archive. Requests placed during the maintenance period are likely to experience a timeout or receive an error message which could be one of “signon failed/system unavailable/connect failed/internal D&B error/signon failed” depending on what components of the toolkit environment happen to be under maintenance at the time. Regional D&B Hosts The regional D&B data hosts have individual timetables for routine maintenance – refer to Host Availability Table in Appendix A for routine maintenance hours. The US and Canadian hosts are maintained at the same time as the Toolkit Central Gateway. During the hours indicated in the Host Availability Table, each host database is disabled so that routine maintenance and update activities can take place. During this downtime, the Data Integration Toolkit will not process enquiries on businesses in the countries stored on that host but will process requests on other hosts that are not currently down for maintenance. A request that is routed to a host which is down for maintenance will receive a “system unavailable/connect failed/internal D&B error” response. Scheduled Maintenance D&B takes all reasonable steps to avoid any planned downtime outside the routine toolkit maintenance times. However, if more than ten hours is required for a major upgrade , D&B may need to undertake additional maintenance outside of routine downtime by taking the Toolkit Central Gateway off line earlier than 11pm EST on a Saturday. This typically happens no more than once or twice per year. At least 5 days notice of such scheduled maintenance will be given to customers who normally use the toolkit within the affected hours. Likewise, the regional D&B data hosts occasionally need to schedule downtime for essential maintenance outside of the routine maintenance period. At least 5 days notice of such scheduled maintenance will be given to customers who normally place enquiries on the affected host during the affected hours. Not all scheduled maintenance activity requires a service outage. All of the servers in the Toolkit Central Gateway are load balanced. This enables D&B to apply certain changes outside of the Routine Maintenance period without impacting the service by deploying and testing the change one server at a time. PROBLEM MANAGEMENT D&B has an established Problem Management process to enable effective management, prioritization and root cause analysis of all incidents affecting its production systems as well as improving management information related to service performance, availability and reliability. The Data Integration Toolkit Service is monitored and supported 24x7. Problem Reporting and Escalation Procedures In the event that the Customer experiences a problem with the production toolkit service and reports this to the Customer Resource Centre (see Section 5.3), the CRC will pass all the relevant details to the Global Service Centre (GSC). This is the focal point within D&B's Technology division for logging and managing incidents affecting D&B's production systems. D&B use the Unicenter Service Desk (USD) system for incident logging and escalation. Provided sufficient information has been provided, the GSC will raise a problem ticket in USD, assign an initial severity and route the ticket to the appropriate support team for investigation. The CRC provide the Customer with the problem ticket number. This should be quoted in any subsequent communication with the CRC concerning the incident. If a Severity 1 incident (see Section 6.2 for definition) is logged against the Toolkit, the GSC will send an immediate email notification to all D&B Managers concerned. The alert is also automatically emailed to all D&B Customer Resource Centres worldwide. The GSC will issue hourly updates for the duration of the incident to the CRCs. If the support team is unable to restore the service within 15 minutes of receiving the problem ticket, a Service Recovery Team (SRT) will be immediately convened. This comprises the Service Manager, the Support Manager and key team members responsible for supporting the toolkit application and infrastructure. The SRT will endeavour to diagnose the cause of the problem and implement emergency measures to restore service. This may be through the application of a work around until a permanent solution can be applied. The Service Manager is responsible for ongoing communicating of the status of the incident to leaders in Customer Operations, Sales and Marketing. They in turn will ensure the information is cascaded out to their teams and upwards to senior Leadership, as appropriate; Any person receiving an escalation will be expected to increase the focus on the problem and take the necessary action to drive it through to final resolution. The GSC will follow up high severity tickets to ensure timely resolution and will route resolved tickets back to the original reporter for closure. . In the event of serious problems (for example, D&B service is inaccessible during agreed normal service hours), should the Customer feel that matters are not being treated with due urgency or severity, they are invited to escalate the problem to XXXXXXXXXXXX (see “Contacts will be provided”). All high severity incidents are reported to, and monitored by D&B Senior Leadership. The following chart summarises the support teams involved in the Problem Management process and their roles and responsibilities FUNCTION Requestor / Customer Resource Centre (CRC) PROBLEM MANAGEMENT TEAM ROLES AND RESPONSIBILITIES Report problem to the Global Service Centre Provide all relevant and required information for a problem ticket to be raised Interface with Customer for progress updates on Severity 1 and 2 tickets Global Service Centre Incident recording & alerting Initial Support & Classification Incident Closure Internal Support Group or External Vendor Incident investigation & Diagnosis Service restoration and & incident resolution Service Manager Incident investigation & Diagnosis Service restoration and & incident resolution Incident Closure Ensure all required information is obtained from the requestor Open problem ticket (within USD) Assign Severity Code Interface with Requestor / CRC for progress updates on Severity 1 and 2 tickets Confirm resolution on all Severity 1 and 2 tickets Send all escalation and progress mails Support the Service Manager as required Investigate problem and assess appropriate diagnostic procedures Execute steps to resume service as defined by process Update problem ticket regularly Provide Reason for Outage (RFO) Assist GSC with management of problem tickets Own and manage all Severity 1 tickets as well as any other tickets escalated to them through to resolution and closure Ensure escalations up through the different management levels are performed in a timely manner Liaise with internal support technicians and external vendors to determine root cause and implement measures to protect against reoccurrence 1st, 2nd & 3rd level Management Incident investigation & Diagnosis Service restoration and & incident resolution Having received a ‘SRT/Call to action’ mail or escalation from Service Manager Remove any roadblocks to the investigation Identify and make available additional resources as appropriate Interact with appropriate levels of management within external vendors, and internal support teams Problem Severity Definitions Each reported incident will be allocated a severity based on the business / customer impact. The following definitions are used as guidelines for the allocation of incident severity 1 through 5: The severity initially assigned to an incident is based on the impact reported at the time. The severity will be reassessed in the event of further information being received and may be raised or lowered accordingly. Severity 1: Critical Critical business impact affecting the Data Integration Toolkit, component or service. Any or all of the following constitute a severity 1: Serious corruption or unavailability of business data [i.e. ratings, trade, etc Two or more concurrent failures reported by the automated service monitoring system A critical alert is generated to the automated service monitoring system Threshold standards for services are exceeded. No alternative or back up is available for a network communication issue. If manual intervention is required on systems with redundancy / load balancing available [i.e. – Resonate® is not controlling removal of server from production, etc] A problem causing severely degraded service to the point that a system is essentially unavailable Serious corruption of business data [e.g. ratings, trade, etc]. Intervention by internal support technicians or external vendors is imperative. Severity 2: Urgent Significant business impact affecting the Data Integration Toolkit Any or all of the following constitute a severity 2: Alternative or back up is available for a network communications issue within 30 minutes of initial outage report. If downtime, after the initial outage report exceeds 30 minutes then the problem will be raised to a severity one. A problem causing degraded service in which the Customer is affected (e.g. poor response time the automated performance monitoring system is triggering alerts A technical problem has occurred causing a component of the production system to automatically switch to backup [Resonate controlling removal of box/server from production, etc Missing or inaccurate data impacting decision making and affecting 10 or more cases Problems with a search engine affecting 10 or more cases Product fabrication errors affecting 10 or more cases Intervention by internal support technicians or external vendors is imperative Severity 3: Important Moderate business impact to production system, component or service. Any of the following apply: Degraded service experienced by single or small number of users. The automated performance monitoring system is registering sporadic errors/timeouts Missing or inaccurate data impacting decision making and affecting less than 10 cases Problems with a search engine affecting less than 10 cases Product fabrication errors affecting less than 10 cases Severity 4: Standard Small business impact to production system, component or service. Any of the following apply: Missing or inaccurate data on a small number of cases and not impacting decision making Severity 5: Low Potential business impact to one or more customers requiring investigation . For example: Missing or inaccurate data on a single case and not impacting decision making Minor typographical error on toolkit documentation Note: Solutions to all problems may be subject to internal change control procedures (governing Change Request submission, scheduling, testing, implementation, verification, etc.) Service Restoration Targets Severity 1 problems: D&B will assign sufficient resources to resolve a Severity 1 problem as quickly as possible with the goal of maintaining the service level defined in this document. D&B aims to resolve a Severity 1 problem within 4 hours and will use continuous effort to restore the service to normal operations. D&B typically resolve over 90% of Severity 1 problems within the SLD target. Severity 2 problems; D&B will assign sufficient resources to fix the problem within the target resolution timeframe of 24 hours. The timescale for resolution of severity levels 3, 4 and 5 is contingent upon local Service Levels or Management discretion . Code fixes will be prioritized according to the amount of open Severity 1 / 2 also being worked on. Where possible, D&B aim to slot fixes into the next scheduled release for that particular platform, Procedures for submitting batch and load test transactions The Data Integration Toolkit is designed for use in customer applications which operate in transactional mode. D&B scales its production resources to ensure it provides sufficient capacity for both production usage and test usage necessary to reach production. On occasions, D&B receives requests from toolkit customers wishing to schedule a database refresh or to run a pre-production load test. To ensure such requirements can be accommodated without impact to normal production users, D&B requests that all developers, both internal and external, observe the following procedures: Batch Extracts 1. All batch extracts must use an id designated for batches only (i.e. not customer's production activities). This can be requested via your D&B representative. 2. Single threaded transactions of up to 1000 1 cases in 24 hours can be launched at any time without any advance notice. Larger batches (involving more threads or more businesses to be enquired on) will require D&B approval before they can be submitted. Details of the proposed batch run(s) should be emailed to toolkit_techsupport@dnb.com., including: Batch toolkit id to be used number of businesses type of product country/ies where businesses are located desired start and finish date and time frequency contact person It is advisable to give at least 72 hours notice of a requirement for a large batch run. 3. Unless otherwise agreed via Toolkit Tech Support, batch extracts exceeding 1,000 businesses should start and end between the hours of 4:00 PM and 2:00 AM EST. Permission to schedule an extract outside of those hours (i.e. within core D&B global business hours) must be obtained in advance by emailing toolkit_techsupport@dnb.com. Load/Stress Test 1. All load test transactions must use a test id 1 Please Note: this assumes the maximum allowed transactions for the test user id used is not reached. If you are not sure what the maximum allowed number of transactions for your test user id is, please contact your local D&B office. 2. Stress tests must be clearly defined and well designed and will require D&B approval before they can be submitted. A detailed description of the planned test must be emailed to toolkit_techsupport@dnb.com., including: Customer's anticipated peak usage* (transactions per minute) Customer's anticipated annual usage* Objective of test Test toolkit id to be used number of each type of test transaction number of threads case country/ies desired start and finish date and time contact person *Anticipated peak and annual usage volumes are required to ensure test volumes are proportionate with the expected usage. A test that is an order of magnitude beyond expected peak usage cannot be justified. For example, designing a test for a website supporting 200 users would not require 200 continuous threads but rather should submit transactions at some multiple of the peak rate. Unless otherwise agreed by D&B, load tests should start and end between the hours of 4:00 PM and 2:00 AM EST. Permission to schedule a test outside of those hours (i.e. within core D&B global business hours) must be obtained in advance by emailing toolkit_techsupport@dnb.com Unscheduled Maintenance Unscheduled Maintenance refers to any maintenance which does not fall into the previously defined “ Routine” or “Scheduled” Maintenance categories. On an exception basis, there may be a critical need to take the Toolkit or a data host out of service in order to perform unscheduled maintenance. Such an outage would typically be required in order to resolve a high severity production issue or to support a crucial business need. D&B will not be able to provide advance notice to the Customer of unscheduled maintenance. Unscheduled Maintenance history Since January 2003, there have been no incidents of Unscheduled Maintenance on the Toolkit or on the US data host, 3.5 Service Availability Targets Service Availability is defined as the amount of time the Data Integration Toolkit is available and capable of receiving, processing and responding to requests. D&B monitors service availability round the clock using automated testing against each of the four regional data hosts. (see “Service Management and Monitoring”). Two consecutive failures of a specific test is classified as a service failure. Service Availability is calculated as the cumulative number of service failures. D&B reports on service availability at monthly intervals. The service availability targets for the main regional hosts are: Europe US Australia Nordic 99% 99% 99% 99%. Service Response Time Target Response time is defined as the total amount of time taken for the Data Integration Toolkit service to respond to a request, based on the duration between a request arriving at the D&B system and the response leaving the D&B system. The service performance target is 99% for all toolkit enquiries Service performance targets are: Business Lookup Retrieval of data product under 5 seconds 10 - 15 seconds Retrieval of text product (BIR) 10 - 30 seconds Response time figures represent time from D&B’s receipt of request to D&B’s transmission of response. Internet traffic and Network passage represent additional factors the external customer must take into account. SERVICE MANAGEMENT System and Service Monitoring. D&B utilize Resonate Commander® to load-balance all servers within the Toolkit Central Gateway and to maintain uninterrupted service in the event of a server failing. The central database which serves the Data Integration Toolkit is clustered so that in the unlikely event of a failure, the system will automatically switch to backup. D&B employs technology which continuously monitors the availability and performance of the Data Integration Toolkit. Requests for lookups, text reports and data products from the 4 major data hosts (US, Europe, Australia and Nordic Region) are generated through the toolkit at five minute intervals round the clock. Each request is monitored from the point where the equivalent customer transaction would enter and leave the D&B network. The data is automatically analysed and then displayed to support teams. Should a test yield two consecutive failures, a service alert is immediately triggered to D&B’s dedicated support team which operates 24x 365. A problem ticket will be raised and assigned to the appropriate support team for investigation and resolution. Business Continuance. D&B maintains a Business Continuance plan which enables us to restore critical databases, outsourced data center operations and telecommunications capabilities within 48 hours in the event an unexpected incident renders our facilities unusable. The Data Integration Toolkit service is included in that plan. D&B has contractual arrangements with a world class outsource provider that will provide us with backup facilities and assist us with our recovery efforts. D&Bs business recovery plans are tested annually and are continually monitored and refined, as required. In the event that we activate our Business Continuance Plans, we will engage in immediate and timely communications with our customers through various vehicles including www.dnb.com, our Customer Resource Center at +1 800 234 3867 and through Sales Executives. We will also provide a toll free number to obtain the status of our recovery operation. CUSTOMER SUPPORT Data Integration Toolkit Website Should the Customer have questions on the Data Integration Toolkit during their initial integration or when developing their production application, they may refer to the documentation available at the following URL: Http://Toolkit.dnb.com Technical Support Should the customer have technical questions that cannot be answered by the documentation on the toolkit website, they may send an email to the following address: Toolkit_Techsupport@dnb.com This email address represents a global distribution list of D&B personnel experienced in the Data Integration Toolkit. This group will provide technical implementation and post- implementation support for developers. The team can also be contacted on the following US telephone number Monday to Friday 8am - 6pm EST: 1) 1-800-234-DUNS (3867) 2) Choose 4 from the first menu 3) Choose 2 from the second menu 4) Enter 7001