Service Description

High Level Summary

OpenText™ Core Universal Discovery and CMDB ("Universal Discovery and CMDB") is a native cloud application that delivers a CMDB ("UCMDB") and automated discovery of servers, software, and service models ("Universal Discovery"). Micro Focus oversees the deployment, infrastructure, operation, availability, security and data protection and support of the service. Some components, like the Universal Discovery Data Flow Probes ("DFP" or "probe"), Advanced Discovery of Networks for Universal Discovery ("ADN"), and content deployment, must be deployed and maintained by Customer.

SaaS Delivery Components

= Included, ⚪ = Optional for an additional fee

SaaS Operational Services

= Included, ⚪ = Optional for an additional fee

*Restrictions apply. Only certain IDPs and integrations are supported.

Architecture Components

Micro Focus deploys Universal Discovery and CMDB using a shared infrastructure platform. The shared platform is monitored for 24x7 availability, and Micro Focus provides related 24x7 infrastructure support, including application version upgrades. Customer access to Universal Discovery and CMDB is through the Internet over HTTPS.

Micro Focus does not install, deploy, or manage on-premise components that may be required to use Universal Discovery and CMDB. Customer is responsible for installing, configuring, deploying, updating, and paying any additional fees (if required) for any additional on-premise components for its applications.

Universal Discovery and CMDB

Premium Discovery provides the discovery of one (1) Operating System Instance (OSI) and includes the capability to discover the configuration of servers, whether physical, virtual or cloud. Capabilities also include discovering installed and running software, mapping the inter-dependencies between servers and their software, and the dependencies between services and servers. Premium Discovery also includes all functionality described in Asset Discovery.

The creation of discovery code and content by a customer is allowed and is included within the Premium Discovery license. Any OSI discovered with a customer-created discovery job will consume one (1) premium license per OSI.

Asset Discovery provides the discovery of one (1) Operating System Instance (OSI) and includes the capability to discover the configuration of servers or workstations, whether physical, virtual or cloud, configuration information about the servers or workstation themselves including the software installed on these servers or workstations and the environment in which the software is installed. Asset Discovery also provides for discovery of the virtual environment of physical virtualization products (like VMware or Hyper-V) as well as the ability to run audit reports in support of Oracle LMS measurement scripts.

CI Management provides for importing 20 nodes and their related CIs (controlled by a maximum of 1,000 CIs and relationships per CI Management license) or the straightforward import of 1,000 CIs and relationships, for every instance of the CI Management license.

Data Flow Probes provides for connections to additional deployments of DFP servers beyond the standard 1 DFP per 1,000 licenses.

Advanced Discovery of Networks for Universal Discovery is a SaaS add-on that provides enriched network discovery and topology using an on-premise component. Each ADN license unit allows for the discovery of one network device. Customer is responsible for installing, configuring, deploying, and updating the on-premise component and to confirm that the on-premise component is compatible with ADN.

UCMDB provides the ability to store data that has been discovered using Universal Discovery or imported from external sources into a database that allows for managing and querying the data in the manner required by the customer and then replicated to external sources.

Boundaries and Exclusions

Usage of Universal Discovery and CMDB and its licenses shall be governed by the following boundaries and exclusions:

• Discovery of OSI is limited to the number of purchased subscriptions
  • If all available Asset Discovery licenses have been consumed but there are available Premium Discovery licenses, discovery will consume Premium licenses until such time as they are all consumed
  • No new discovery will occur for any nodes beyond the purchased subscriptions
  • Nodes discovered with the purchased subscriptions will continue to be discovered, even if the maximum discovery count has been reached
• Discovery or import of CIs is limited to an average of 1,000 CIs and relationships per Premium or Asset Discovery license (evaluated as a whole over all licenses purchased)
• Data Creation, Import and Export
  • Discovered information imported to Universal Discovery and CMDB from an on-premise instance of Universal Discovery and CMDB is limited to 1,000 CIs and relationships in Universal Discovery and CMDB per on-premise discovery unit-based license
  • Importing data into Universal Discovery and CMDB from another Micro Focus tool will consume the CI Management license at the rate of 1000 CIs and relationships per license
  • Using any custom integration to replace an available discovery capability is not permitted
  • Exporting nodes from UCMDB to any other system will incur no additional charge
  • Node data created or updated in SMAX, AMX or HCMX that is replicated to UCMDB via the Micro Focus standard integration ("Native SACM") will incur no additional charge up to 1,000,000 CIs and relationships. Additional CIs stored in Universal Discovery and CMDB beyond this amount will consume CI Management licenses.
  • Full export of Universal Discovery data to a 3rd party tool must not occur more often than one (1) time per week
  • Incremental export (changes only) of Universal Discovery data to a 3rd party tool must not occur more often than one (1) time per hour
• Discovery of network and storage devices does not consume any license as long as the number of discovered devices is not greater than the number of Premium and Asset licenses to which the customer is entitled
• Universal Discovery Data Flow Probes ("DFP") must be hosted on-premise or in Customer public cloud account (in context of Customer)
• Universal Discovery probes must be current or within one version of the current UCMDB major version. Exact details can be found in documentation here: Probe Version Compatibility
• You are entitled to connect one Data Flow Probe (DFP) to Universal CMDB for every 1,000 Universal Discovery licenses you have in production.
  • These DFP connections may be spread across your production and non-production SaaS instances so long as the total number of DFPs connected to all your SaaS instances does not exceed your overall entitlement of DFP connections.
  • If you have insufficient DFP connections in your entitlement to provide at least one connection to one non-production instance, you may have one additional DFP connection for one non-production instance at no additional charge.
• Discovery of network devices with ADN consumes ADN license units. As ADN provides richer information about network devices, one should review and add additional "CI Management" licenses, if needed.
• The on-premise component of the ADN must be licensed and deployed separately by Customer, and be a compatible version to ADN. Compatible versions of the on-premise component and documentation for integrating the on-premise component can be found at: ADN Support Matrix
• Total licenses for non-production instances cannot exceed a quarter (25%) of the total Premium and Asset Discovery licenses purchased

UCMDB Usage Limits

Access to key components of UCMDB is restricted, as detailed below, to ensure access to data is limited only to those authorized, and to prevent any system stability issues.

SMAX Express (for Universal CMDB user management)

Four (4) units of SMAX Express are provided for the sole purpose of allowing Universal Discovery and CMDB administrators create and manage users for access to the Universal CMDB environment. These users are created within the SMAX Identity Management ("IDM") module and then are configured within Universal CMDB to apply their roles and capabilities.

There are no additional SMAX capabilities enabled or allowed beyond access to the IDM module unless Customer has purchased a separate SMAX capability independent of those available with the Universal Discovery and CMDB product.

Service Support

Customer may contact Micro Focus through submitting online support tickets or by telephone. The Micro Focus Support Team will either provide support to Customer directly or coordinate delivery of this support. Online support for Universal Discovery and CMDB and only the on-premise components mentioned above is available from the support portal (PCS): https://pcs.saas.microfocus.com

As part of the onboarding process, it is Customers' responsibility to provide details of users that require access to the support portal (PCS). These initial users will have an account created and can manage access for themselves and others to the support portal for Customer's Universal Discovery and CMDB.

Universal Discovery and CMDB includes an extensive online contextual help to aid with configuration of Universal Discovery and UCMDB to align with your business requirements. Full documentation of the capabilities of the Enterprise Service Management solution which includes Universal Discovery and CMDB, and the optional capabilities outlined in this service description is available at: https://docs.microfocus.com/itom/ESM:SaaS/Home

Community Resources

As part of the Universal Discovery and CMDB community you can get additional assistance and aid from peers as well as live and recorded webinars as part of our Community user groups: https://community.opentext.com/it-ops-cloud/ud-cmdb

Your suggestions for enhancements to our products are important to Micro Focus and as part of the community, Micro Focus allows you to review existing and submit new ideas or enhancements via the Idea Exchange. We encourage you to share, vote and enhance existing ideas with your feedback and comments to help Micro Focus product development. The popularity of an idea is measured through votes and comments at: Universal Discovery and CMDB - https://community.opentext.com/it-ops-cloud/ud-cmdb/ud-cmdb-customers-only/i/ideas

Service Operations Center

Micro Focus staffs and maintains a 24x7x365 Service Operations Center, which will be the single point of contact for all issues related to the support for SaaS. Customer will maintain a list of authorized users who may contact Micro Focus for support. Customer's authorized users may contact Micro Focus for support via the Web portal or telephone 24 hours a day, 7 days a week.

1 Notifications regarding release updates to Universal Discovery and CMDB will include details of any associated release readiness webinar, and online documentation which will detail the updates and new features in the planned release.

Service Monitoring

Micro Focus monitors SaaS availability 24x7. Micro Focus uses a centralized notification system to deliver proactive communications about service changes, outages, and scheduled maintenance. Details can be found on the relevant Service Health portal for your service which includes:

• Current availability of the Universal Discovery and CMDB environment that their tenants are part of
• Details of any upcoming planned maintenance
• Outage reports for any incidents that have been identified by our support teams
• Historical SLO data

The Link to Service Health portal for your service will be provided as part of your onboarding to Micro Focus SaaS and are also available via the support portal: https://pcs.saas.microfocus.com

Capacity and Performance Management

The architecture allows for addition of capacity to applications, databases, and storage.

Operational Change Management

Micro Focus follows a set of standardized methodologies and procedures for efficient and prompt handling of changes to SaaS infrastructure and application, which enables beneficial changes to be made with minimal disruption to the service.

Data Backup and Retention

The data backup and retention described in this section are part of Micro Focus's overall business continuity management practices designed to attempt to recover availability to SaaS and SaaS Data for Customer following an outage or similar loss of service for SaaS.

SaaS Data

The following types of SaaS Data reside in the SaaS environment:

• Supporting Data: This is data loaded by Customer to support the configuration item records. Examples of this could include, but not limited to, physical or logical locations, person and group records.
• Transactional Data: This is data that is related to the day-to-day delivery of service operations and support within the organization. Examples of this could include but not limited to service and support requests, incidents, and change records. Note, transactional data is typically linked to one or more supporting data records.
• Attachment Data: This refers to any type of file that has been attached to either supporting data or transaction data. For example, this could be but not limited to an image file an employee uploads for his profile picture on his personal record, a log file attached to an incident to assist with resolution, or a PDF troubleshooting guide attached to a knowledge article.

Backups

Universal Discovery and CMDB are implemented over AWS technology service stack in a redundant mode over multiple Availability zones (AZs) with elastic load balancing allowing us to quickly recover service in case of a disaster. Availability zones (AZs) are distinct geographical locations that are engineered to be insulated from failures in other AZs.

Micro Focus performs a backup of SaaS Data every 6 hours with a 6-hour recovery point objective (RPO). Micro Focus retains each backup for the most recent seven (7) days. The backup data is replicated to a protected vault within the same AWS Region as the Customer running service. The backup includes a snapshot of production database, including transactional database and analytics database, a copy of files stored on persistent volume and an export of all the Kubernetes objects.

Micro Focus's standard storage and backup measures are Micro Focus's only responsibility regarding the retention of this data, despite any assistance or efforts provided by Micro Focus to recover or restore Customer's data. Customer may request via a service request for Micro Focus to attempt to restore such data from Micro Focus's most current backup. Micro Focus will be unable to restore any data not properly entered by Customer or lost or corrupted at the time of backup or if Customer's request comes after the 7 days data retention time of such backup.

Disaster Recovery for SaaS

Business Continuity Plan

Micro Focus continuously evaluates different risks that might affect the integrity and availability of SaaS. As part of this continuous evaluation, Micro Focus develops policies, standards and processes that are implemented to reduce the probability of a continuous service disruption. Micro Focus documents its processes in a business continuity plan ("BCP") which includes a disaster recovery plan ("DRP"). Micro Focus utilizes the BCP to provide core SaaS and infrastructure services with minimum disruption. The DRP includes a set of processes that implements and tests SaaS recovery capabilities to reduce the probability of a continuous service interruption in the event of a service disruption.

Universal Discovery and CMDB are implemented using a cloud-based technology service stack in a redundant mode over multiple availability zones. The failure of one zone will not impact the service availability as the system will automatically failover from the other zones. In the event of a disaster impacting more than one zone at the same time, such as a complete cloud region, the DRP's target is to provide restoration of the Micro Focus Universal Discovery and CMDB within 24 hours (Recovery Time Objective, RTO) following Micro Focus's declaration of a disaster.

SaaS Security

Micro Focus maintains an information and physical security program designed to protect the confidentiality, availability, and integrity of SaaS Data.

Technical and Organizational Measures

Micro Focus regularly tests and monitors the effectiveness of its controls and procedures. No security measures are or can be completely effective against all security threats, present and future, known and unknown. The measures set forth in this section may be modified by Micro Focus but represent a minimum standard. Customer remains responsible for determining the sufficiency of these measures.

Physical Access Controls

Micro Focus maintains physical security standards designed to prohibit unauthorized physical access to the Micro Focus equipment and facilities used to provide SaaS and include Micro Focus data centers and data centers operated by third parties. This is accomplished through the following practices:

• Presence of on-site security personnel on a 24x7 basis
• Use of intrusion detection systems
• Use of video cameras on access points and along perimeter
• Micro Focus employees, subcontractors and authorized visitors are issued identification cards that must be worn while on premises
• Monitoring access to Micro Focus facilities, including restricted areas and equipment within facilities
• Maintaining an audit trail of access

Access Controls

Micro Focus maintains the following standards for access controls and administration designed to make SaaS Data accessible only by authorized Micro Focus personnel who have a legitimate business need for such access:

• Secure user identification and authentication protocols
• Authentication of Micro Focus personnel in compliance with Micro Focus standards and in accordance with ISO27001 requirements for segregation of duties
• SaaS Data is accessible only by authorized Micro Focus personnel who have a legitimate business need for such access, with user authentication, sign-on and access controls
• Employment termination or role change is conducted in a controlled and secured manner
• Administrator accounts should only be used for the purpose of performing administrative activities
• Each account with administrative privileges must be traceable to a uniquely identifiable individual
• All access to computers and servers must be authenticated and within the scope of an employee's job function
• Collection of information that can link users to actions in the SaaS environment
• Collection and maintenance of log audits for the application, OS, DB, network, and security devices according to the baseline requirements identified
• Restriction of access to log information based on user roles and the "need-to-know"
• Prohibition of shared accounts

Availability Controls

Micro Focus's business continuity management process includes a rehearsed method of restoring the ability to supply critical services upon a service disruption. Micro Focus's continuity plans cover operational shared infrastructure such as remote access, active directory, DNS services, and mail services. Monitoring systems are designed to generate automatic alerts that notify Micro Focus of events such as a server crash or disconnected network.

Controls regarding disruption prevention include:

• Uninterruptible power supplies (UPS) and backup power generators
• At least two independent power supplies in the building
• Robust external network connectivity infrastructure

Data Segregation

SaaS environments are segregated logically by access control mechanisms. Internet-facing devices are configured with a set of access control lists (ACLs), which are designed to prevent unauthorized access to internal networks. Micro Focus uses security solutions on the perimeter level such as: firewalls, IPS/IDS, proxies, and content-based inspection in order to detect hostile activity in addition to monitoring the environment's health and availability.

Data Encryption

Micro Focus uses industry standard techniques to encrypt SaaS Data in transit. All inbound and outbound traffic to the external network is encrypted.

Audit

Micro Focus appoints an independent third party to conduct an annual audit of the applicable policies used by Micro Focus to provide SaaS. A summary report or similar documentation will be provided to Customer upon request. Subject to Customer's execution of Micro Focus's standard confidentiality agreement, Micro Focus agrees to respond to a reasonable industry standard information security questionnaire concerning its information and physical security program specific to SaaS no more than once per year. Such information security questionnaire will be considered Micro Focus confidential information.

Micro Focus Security Policies

Micro Focus conducts annual reviews of its policies around the delivery of SAAS against ISO 27001, which includes controls derived from ISO 27034 – "Information Technology – Security Techniques – Application Security". Micro Focus regularly re-evaluates and updates its information and physical security program as the industry evolves, new technologies emerge, or new threats are identified.

Security Incident Response

In the event Micro Focus confirms a security incident resulted in the loss, unauthorized disclosure, or alteration of SaaS Data (“Security Incident”), Micro Focus will notify Customer of the Security Incident and work to reasonably mitigate the impact of such Security Incident. Should Customer believe that there has been unauthorized use of Customer's account, credentials, or passwords, Customer must immediately notify Micro Focus Security Operations Center via SED@opentext.com.

Micro Focus Employees and Subcontractors

Micro Focus requires that all employees involved in the processing of SaaS Data are authorized personnel with a need to access the SaaS Data, are bound by appropriate confidentiality obligations and have undergone appropriate training in the protection of customer data. Micro Focus requires that any affiliate or third-party subcontractor involved in processing SaaS Data enters into a written agreement with Micro Focus, which includes confidentiality obligations substantially similar to those contained herein and appropriate to the nature of the processing involved.

Data Subject Requests

Micro Focus will refer to customer any queries from data subjects in connection with SaaS Data.

Scheduled Maintenance

To enable Customer to plan for scheduled maintenance by Micro Focus, Micro Focus reserves predefined timeframes to be used on an as-needed basis. Micro Focus reserves one (1) monthly four (4) hour window (Scheduled to occur on Sunday in the 00:00 to 23:00 Greenwich Mean Time, the exact 4-hour time block is dependent on the location of the Universal Discovery and CMDB farm location). These windows will be used on an as-needed basis.

Planned windows will be scheduled at least two (2) weeks in advance when Customer action is required, or at least four (4) days in advance otherwise.

Scheduled Version Updates

"SaaS Upgrades" are defined as major version updates, minor version updates, and binary patches applied by Micro Focus to Customer's SaaS in production. These may or may not include new features or enhancements. Micro Focus determines whether and when to develop, release and apply any SaaS Upgrade. Customer is entitled to SaaS Upgrades during the applicable SaaS Order Term unless the SaaS Upgrade introduces new functionality that Micro Focus offers on an optional basis for an additional fee.

Micro Focus determines whether and when to apply a SaaS Upgrade to Customer's SaaS. Unless Micro Focus anticipates a service interruption due to a SaaS Upgrade, Micro Focus may implement a SaaS Upgrade at any time without notice to Customer. Micro Focus aims to use the Scheduled Maintenance windows defined herein to apply SaaS Upgrades. Customer may be required to cooperate in achieving a SaaS Upgrade that Micro Focus determines in its discretion is critical for the availability, performance, or security of SaaS.

Universal Discovery Infrastructure Updates

The Universal Discovery DFP directly communicates to the Universal Discovery and CMDB tenant to which Customer is assigned. The DFP version must be compatible with the Universal Discovery and CMDB version, and Customer is responsible to update DFP within six (6) months from the version update of Universal Discovery and CMDB. DFP updates may be done by Customer at any time and do not require advance notice with Micro Focus.

If Customer does not apply a DFP update within six (6) months of a Universal Discovery and CMDB version update, Customer's Data flow Probes will no longer function and will only be available for automated updates to the latest DFP version to restore discovery functionality.

If Customer does not apply a DFP update within twelve (12) months of a Universal Discovery and CMDB version update, the DFP will lose its ability for automated updates, and Customer will be required to manually update each DFP under this condition to restore discovery functionality.

Universal Discovery Content Updates

As part of the scheduled version update process, Customer will have the option to update their Universal Discovery content to the latest version once the Universal Discovery and CMDB version update has been completed. The latest Universal Discovery content pack will be available from within the CMS UI for each Customer to choose to deploy on their own schedule.

Updates to Universal Discovery content is the responsibility of Customer. Current content versions are supported for three (3) major releases (including the current major release the Customer is using). Content version must be maintained by the Customer to ensure the version they are using is supported with the current version of Universal CMDB deployed on their tenant. Use of a content version that is outside of the support matrix for the current version of Universal CMDB will require the Customer to update content to a supported version before any discovery-related PCS ticket can be managed.

Service Decommissioning

Upon expiration or termination of the SaaS Order Term, Micro Focus may disable all Customer access to SaaS, and Customer shall promptly return to Micro Focus (or at Micro Focus's request destroy) any Micro Focus materials.

Micro Focus will make available to Customer any SaaS Data in Micro Focus' possession in the format generally provided by Micro Focus. The target timeframe is set forth below in Termination Data Retrieval Period SLO. After such time, Micro Focus shall have no obligation to maintain or provide any such data, which will be deleted in the ordinary course.

Service Level Objectives

Micro Focus provides clear, detailed, and specific Service Level Objectives (SLOs) for SaaS. These SLOs are targets used by Micro Focus to deliver the service and are provided as guidelines. They in no way create a legal requirement or obligation for Micro Focus to meet these objectives.

Micro Focus will provide self-service access to Customer to the Service Level Objectives data online at https://pcs.saas.microfocus.com

Solution Provisioning Time SLO

Solution Provisioning is defined as Universal Discovery and CMDB being available for access over the internet. Micro Focus targets to make Universal Discovery and CMDB available within two (2) business days of the customer's Order being booked within the Micro Focus order management system.

Customer is responsible for installing, configuring, deploying, updating, and paying any additional fees (if required) for any additional on-premise components for its applications. Any on-premise components of the solution are not in scope of the Solution Provisioning Time SLO.

Additionally, the import of Customer data into the application is not in scope of the Solution Provisioning Time SLO.

SaaS Availability SLA

SaaS availability is the Universal Discovery and CMDB production application being available for access and use by Customer over the Internet. Micro Focus will provide Customer access to the SaaS production application on a twenty-four hour, seven days a week (24x7) basis at a rate of 99.9% (“Target Service Availability" or "TSA").

Measurement Method

TSA shall be measured by Micro Focus using Micro Focus monitoring software running from a minimum of four global locations with staggered timing. On a quarterly basis, the TSA will be measured using the measurable hours in the quarter (total time minus Downtime Exclusions) as the denominator. The numerator is the denominator value minus the time of any outages in the quarter (duration of all outages combined) to give the percentage of available uptime (2,198actual hours available / 2,200 possible available hours = 99.9% availability).

An "outage" is defined as two consecutive monitor failures within a five-minute period, lasting until the condition has cleared.

Downtime Exclusions

The TSA shall not apply to or include any time during which SaaS is unavailable in connection with any of the following (specifically, the number of hours of unavailability in the measured period per the Measurement Method section above due to the following shall not be included in either the numerator or the denominator for the measurement):

• Overall Internet congestion, slowdown, or unavailability
• Unavailability of generic Internet services (e.g. DNS servers) due to virus or hacker attacks
• Outages caused by disruptions attributable to force majeure events (i.e., unforeseeable events outside of Micro Focus' reasonable control and unavoidable even by the exercise of reasonable care
• Outages not caused by Micro Focus or not within the control of Micro Focus (i.e. unavailability due to problems with the Internet), unless caused by Micro Focus' service providers
• Unavailability due to Customer equipment or third-party computer hardware, software, or network infrastructure not within the sole control of Micro Focus
• Scheduled maintenance activities
• Scheduled SaaS Upgrades
• Customer exceeding the service restrictions, limitations or parameters listed in this Service Description and/or the Order
• Unavailability due to customizations made to the Micro Focus SaaS which are not validated, reviewed and approved in writing by both parties
• System downtime requested by Customer
• Suspensions of the Micro Focus SaaS by Micro Focus as a result of Customer's breach of the SaaS Terms

Reporting

Micro Focus will provide self-service access to Customer to the availability data online at https://pcs.saas.microfocus.com

In addition, Micro Focus will provide an Actual Service Availability Report ("ASA Report") in accordance with this Service Level Commitments section to Customer upon request. If Customer does not agree with the ASA Report, written notice of non-agreement must be provided to Micro Focus within fifteen (15 days) of receipt of the ASA Report.

Remedies for Breach of Service Levels

i. Sole remedy. Customer's rights described in this section state Customer's sole and exclusive remedy for any failure by Micro Focus to meet the agreed service levels.

ii. Escalation. Quarterly ASA below 98% shall be escalated by both parties to the Vice President (or equivalent).

iii. Credit. Subject to the terms herein, Micro Focus will issue a credit reflecting the difference between the measured ASA for a quarter is less than the TSA. ("Remedy Percent"). For clarity, several example calculations using this formula are illustrated in the table below:

Customer must request credits in writing to Micro Focus within ninety (90) days of receipt of the ASA Report resulting in such credit and identify the support requests relating to the period where the SaaS production application was not available for access and use by the Customer over the internet. Micro Focus shall apply the requested credits on a quarterly basis.

Online Support Availability SLO

Online Support Availability is defined as the SaaS support portal https://pcs.saas.microfocus.com being available for access and use by Customer over the Internet. Micro Focus targets to provide Customer access to the SaaS support portal on a twenty-four hour, seven days a week (24x7) basis at a rate of 99.9% ("Online Support Uptime").

Measurement Method

Online Support Uptime shall be measured by Micro Focus using Micro Focus monitoring software running from a minimum of four global locations with staggered timing. On a quarterly basis, Online Support Uptime will be measured using the measurable hours in the quarter (total time minus planned downtime, including maintenance, upgrades, etc.) as the denominator. The numerator is the denominator value minus the time of any outages in the quarter (duration of all outages combined) to give the percentage of available uptime (2,198 actual hours available / 2,200 possible available hours = 99.9% availability).

An "outage" is defined as two consecutive monitor failures within a five-minute period, lasting until the condition has cleared.

Boundaries and Exclusions

Online Support Uptime shall not apply to or include any time during which the SaaS support portal is unavailable in connection with any of the following (specifically, the number of hours of unavailability in the measured period per the Measurement Method section above due to the following shall not be included in either the numerator or the denominator for the measurement):

• Overall Internet congestion, slowdown, or unavailability
• Unavailability of generic Internet services (e.g., DNS servers) due to virus or hacker attacks
• Force majeure events
• Actions or inactions of Customer (unless undertaken at the express direction of Micro Focus) or third parties beyond the control of Micro Focus

Initial SaaS Response Time SLO

The Initial SaaS Response Time refers to the support described herein. It is defined as the acknowledgment of the receipt of Customer's request and the assignment of a case number for tracking purposes. Initial SaaS Response will come as an email to the requester and include the case number and links to track it using Micro Focus online customer portal. The Initial SaaS Response Time covers both service request and support requests. Micro Focus targets to provide the Initial SaaS Response no more than one hour after the successful submission of Customer's request.

SaaS Support SLOs

There are two types of SaaS Support SLOs: Service Request and Support Request SLOs:

• The Service Request SLO applies to the majority of routine system requests. This includes functional system requests (product add/move/change), informational, and administrative requests.
• The Support Request SLO applies to issues that are not part of the standard operation of the service and which causes, or may cause, an interruption to or a reduction in the quality of that service.

The Response and Resolution Targets are provided as guidelines and represent typical request processing by Micro Focus SaaS support teams. They in no way create a legal requirement or obligation for Micro Focus to respond in the stated time. The Response and Resolution Targets, including their scope and determining factors (such as impact and urgency), are further described at https://pcs.saas.microfocus.com.

Termination Data Retrieval Period SLO

The Termination Data Retrieval Period is defined as the length of time in which Customer can retrieve a copy of their SaaS Data from Micro Focus. Micro Focus targets to make available such data for download in the format generally provided by Micro Focus for 30 days following the termination of the SaaS Order Term.

Standard Service Requirements

Roles and Responsibilities

This section describes general Customer and Micro Focus responsibilities relative to SaaS. Micro Focus's ability to fulfill its responsibilities relative to SaaS is dependent upon Customer fulfilling the responsibilities described below and elsewhere herein:

Customer Roles and Responsibilities

Micro Focus Roles and Responsibilities

Assumptions and Dependencies

This Service Description is based upon the following assumptions and dependencies between the Customer and Micro Focus:

• Customer must have internet connectivity to access SaaS
• SaaS support will be delivered remotely in English only
• A SaaS Order Term is valid for a single application deployment, which cannot be changed during the SaaS Order Term
• The service commencement date is the date on which Customer's Order is booked within the Micro Focus order management system
• The import of Customer data into SaaS during the implementation requires that the information is made available to Micro Focus at the appropriate step of the solution implementation and in the Micro Focus designated format
• Customer must ensure that its administrators maintain accurate contact information with Micro Focus
• Customer has determined, selected, and will use options in the Customer environment that are appropriate to meet its requirements, including information security controls, connectivity options, and business continuity, backup, and archival options
• Customer will establish and follow secure practices for individual account-based access for accountability and traceability

Furthermore, SaaS is provided based on the assumption that Customer will implement and maintain the following controls in its use of SaaS:

• Configuring Customer's browser and other clients to interact with SaaS
• Configuring Customer's network devices to access SaaS
• Appointing authorized users
• Configuring its SaaS account to require that end user passwords are sufficiently strong and properly managed
• Procedures for access approvals, modifications, and terminations

Good Faith Cooperation

Customer acknowledges that Micro Focus's ability to provide SaaS and related services depends upon Customer's timely performance of its obligations and cooperation, as well as the accuracy and completeness of any information and data provided to Micro Focus. Where this Service Description requires agreement, approval, acceptance, consent or similar action by either party, such action will not be unreasonably delayed or withheld. Customer agrees that to the extent its failure to meet its responsibilities results in a failure or delay by Micro Focus in performing its obligations under this Service Description, Micro Focus will not be liable for such failure or delay.