[Doc 8386 content is unavailable at this time.]

This document describes the responsibilities and service levels for the Division of Information Technology (DoIT) and the customers of the ECM/Imaging Service.

Part One: Service Operations

1. Server - All servers will be hosted on the DoIT Platform and will be fully supported by the DoIT Systems Engineering Department.
2. Software - Perceptive Content from Lexmark International, Inc. is the application that delivers the ECM/Imaging Service. This application is fully supported by the DoIT's Internet Infrastructure Applications Technology (IIAT) department.
3. Availability - The service runs 24x7x365 with minimal downtime for scheduled and emergency maintenance (reboots and Windows Server Patching handled by DoIT's Systems Engineering). If problems arise, identified issues are addressed by system administrators during normal business hours 8x5 and off-hours on a best-effort basis.
4. Maintenance and Upgrades - The service has a scheduled maintenance window on Friday evening from 20:00-22:00. The service may be taken down during this time for maintenance on the application, database or hardware. Change records, if necessary, will be submitted. Typically Perceptive releases 2-3 minor upgrades per year. We schedule major upgrades as they are released. We upgrade Test/Development servers first. Upgrades to Production are usually done on Friday nights. Department leads have access to the system on the day following the patching/upgrade for Production testing. Positive test results finalize the work or the patch/upgrade is rolled back.
5. Change Management - DoIT is fully invested in Change Management and Continuity of Operations Planning best practices. The Imaging system customers will be notified of all planned outages in advance with a minimum 10-day notice for standard changes. See Continuity of Operations Planning, section 3.3.3 Change Records Classes & Types - Characteristics for more information on notification guidelines by change record classification.
6. Emergency Changes - Customers will be notified when an emergency change is required. Due to the nature of emergencies, deploying a fix (reboot, etc.) for the problem that causes the emergency is the first step taken. Notification will be provided as possible via the change management system by email to the Department Leads with a 24-hour notice. Change management is integrated with DoIT's Outage page and updates will post here: http://outages.doit.wisc.edu/
7. Backup - Incremental Backups are run nightly, saving 3 versions for 6 months. These backups are run only for disaster recovery purposes. Individual document restores will not be available. Once a week a journal based backup is run for anything that has changed since the last reboot. The journal rebuild is done at the same time.
8. Database - Oracle is the database that is being used for the Perceptive Content application. All files are stored on the DoIT Enterprise Storage Service.
9. External System Integration - Work to integrate additional applications (i.e. PeopleSoft, WISDM).
10. Authentication - ImageNow uses LDAP for credential authentication. Authentication against external customer identity management systems are handled via SSH tunnel. Integration with external systems, if required, are the joint responsibility of the appropriate individuals (system administrators and middleware technologists). The Perceptive Experience client uses Shibboleth-protected University of Wisconsin System federated login with scoped UIDs.
11. Security
    1. Client
       1. All data is encrypted in transfer.
       2. Triple DES is used for communication between desktop client and imaging system.
       3. SSL/TSL COMODO certificates are configured in the webserver to which Perceptive Experience connects.
    2. System
       1. Both hardware and software firewalls are implemented and supported by DoIT Systems Engineering and Networking. Application servers and the database server firewalls are IP restricted and are not open to the world.
       2. Imaging system servers are housed on a restricted data network.
       3. The eForms server is open to the world, but there is no way to access the primary imaging system from this host.
       4. Systems are regularly monitored and events are managed from the server.
       5. Account provisioning/deprovisioning and system activity are regularly monitored.
       6. Tripwire: a filesystem integrity checker is installed.
       7. Document uploads to the Imaging system require SSH-enabled FTP (SFTP).
12. Department Leads - Each Imaging departmental customer/group will have a Department Lead designated by the customer. Department Leads are the primary contact that the DoIT Imaging team will use for communications. A full list of Department Lead responsibilities is included in the Customer Responsibilities section of this document.
13. Restricted Data - Restricted data must be maintained with the highest level of security. Restricted data includes:
    1. Social security number
    2. Driver's license number or state identification number
    3. Financial account number (including credit/debit card) or any security code, access code of password that would permit access to an individual's financial account
    4. Deoxyribonucleic acid profile as defined in S. 939.74 (2d) (a)
    5. Unique biometric data, including fingerprint, voice print, retina or iris image or any other unique physical representation
    6. HIPAA-Protected health information (any information about health status, provision of health care, or payment of health care). Security measures are reviewed and implemented to ensure all Restricted Data is secure and appropriately handled. Deviations from Restricted Data policy requires approval from DoIT Security and the Department dean/director. Restricted Data Security Standards can be reviewed at: Policy: Restricted Data Security Management.
14. HIPAA - Partners must notify the ECM/Imaging Service Team leader if HIPAA data is stored in the Imaging System so that appropriate procedures are implemented.
15. PCI Data - Financial data (cp. Sec. 12.C. above) must not be scanned into or stored in the Imaging System. Contact DoIT Security at PCI-help@bussvc.wisc.edu if there is a need to store PCI or Restricted data.

Part Two: Responsibilities

Service Provider Responsibilities

1. Server Support - Provide support for hardware and operating systems, including patching, hardware and software updates, firewalls, and secure access to file systems. DoIT purchases appropriate maintenance agreements for the hardware and software.
2. Application Support
   1. Provide support for Perceptive Content, including patching, upgrades, vendor interactions, secure access to the application, problem troubleshooting and issue resolution (may require work with the vendor).
   2. Working support cases with the vendor may require that we provide them with material to enable case resolution. The following statement taken from the contract between the UW-Madison and Lexmark governs use of such material: "General Data Protection - The CONTRACTOR agrees that data provided to them during the provision of service shall be used only and exclusively to support the service and service execution and not for any other purpose."
3. Security - Provide Security Policies, Implementation, and Annual Audits for compliance. All users will be created and authorization verified via DoIT-maintained processes. User accounts require an HRS appointment.
4. Multiple Environments - Create and maintain working development, test, and production environments for the ImageNow application for customer use.
   1. Development - The development environment allows customers to create and test folder structures, workflows and processes, user groups, iScript development, etc. in an environment that is not identical to the production environment.
   2. Test - The Test environment is a copy of production which will be refreshed on the first Friday of every month. Additional access may be given to developers as needed. Changes developed and tested in the Development environment move to Test where Test's similarity to Production allows additional testing and refinement.
   3. Production Moves - Finalized changes in Test move into the production environment.
5. End-User Support - Second Level End User support will be provided by the DoIT Help Desk. Calls may be escalated to either DoIT Technologists or the customer depending on the nature of the issue (cp. item 8 under Customer/Partner Responsibilities).
6. Request Forms - Respond to Support, New Work, and New Customer requests within reasonable time period.
7. Administrative Tasks
   1. Accounts - Adding new users and removing past users. User accounts require an HRS appointment.
   2. Groups - Adding/modifying groups and group privileges.
   3. Areas/Departments Management - Set-up Test/Development servers so that users can test and experiment. Move the set up to production when testing is satisfactorily completed.
8. Planning - Three groups are constituted by which various levels of interaction between the ECM/Imaging Service Team and its Partners is available.
   1. Imaging Customer Advisory Group (ICAG) - The ICAG is composed of designated individuals who have the authority to represent a local Imaging system constituency in on-going planning and advising of the ECM/Imaging Service.
   2. Imaging Administrator/Security Team (IAST) - The IAST is a forum through which local department representatives (administrators, key users, etc.) can meet to discuss system issues, planning, or other topics of concern that relates to departmental use of the ECM/Imaging Service.
   3. Imaging Customer User Group (ICUG) - The ICUG is a forum through which users can discuss issues, develop best practices, contribute to on-going Perceptive client development processes, or talk about any topic of concern that relates to use of the ECM/Imaging Service.

Customer/Partner Responsibilities

1. Department Leads - All departments using the Imaging system will identify a Department Lead for the department to handle administrative tasks on the department's behalf. The Department Lead responsibilities are:
   1. Communication Contact - Communication point of contact for all users in the Department they represent.
   2. Imaging Administrator/Security Team Meetings - Participate in monthly Imaging Administrator/Security Team meetings.
   3. Testing Coordination - Coordinate all testing of patches and upgrades with their users.
   4. Local End-User Support - Provide local initial user support.
   5. Request Forms - Use provided Request Forms to initiate support and new work requests.
   6. User Account Management - Request for their department user account additions, changes, or deletions using the required Jira process.
   7. Retention Policy Implementation - "A basic preservation plan must be put into place before imaging can begin. The plan will identify the retention period for the records (taken from the RDA or GRS), how and when the digital files will be tested for errors, and when migration will be considered." (From: UW-System: Planning & Development of Imaging Process)
   8. Annual Audits - Coordinate and conduct an annual review of departmental users, drawers, doctypes, groups, workflows, retention implementation, and Imaging system processes for appropriate access control, use, and security vulnerability.
2. Imaging Environment Management - Use the Development Environment to setup, maintain, and test their Imaging work for the following areas which are then deployed to the Test Environment for testing prior to deployment to the Production Environment:
   1. Drawer setup and maintenance.
   2. Creation and Testing of Processes and workflows.
   3. Creation and testing of eForms.
   4. Creation and testing of Learnmodes.
   5. Adding/modifying/removing annotations.
   6. Adding/modifying/removing project types.
3. Security - Document Security using access controls, printing policies and redaction of restricted data.
   1. All restricted (e.g., HIPPA-protected) data must be stored in drawers separate from non-sensitive data with appropriate auditing controls enabled.
   2. The University tightly controls authorization for access to protected data. Authorization will only be granted with the approval of the Department Dean/Director.
   3. Department Dean/Director accepts full responsibility for the emailing or printing of images that contain restricted data. Any use of restricted data must follow the established guidelines.
4. Test Environment Use - Participate in the testing for all patches and upgrades prior to production deployment.
5. Testing - Thoroughly testing of all features, functions, application integrations and processes in the test environment prior to system upgrades. Notify DoIT technologists of any issues that are identified during the testing period prior to the upgrade.
6. Post Patching/Upgrade Updates - Update all processes, scripts and customizations as required by software patching and upgrades.
7. Clients
   1. Client installation/upgrades are not managed centrally. Notice is sent to Department lead regarding when and where they can get the upgraded client versions.
   2. System Access
      1. Access to the Imaging system does not require VPN if the client used is within your office space (this includes ECM/Imaging Service Partners).
      2. Connections to the internet through an untrusted network, either wired or wireless, require the use of secure connections using the WiscVPN service (for UW-Madison users) or a VPN service provided by the partner campus (see https://kb.wisc.edu/90370 for more information).
8. End-User Support - End User support will be provided by the customer or data custodian. Calls may be escalated to either DoIT Technologists or the customer depending on the nature of the issue (cp. item 5 under Service Provider Responsibilities for End-User Support).
9. Scanner and CaptureNow - Purchase of scanner and CaptureNow licenses and maintenance or purchase of scanning outsourcing service. NOTE: the ECM/Imaging Service doe not supply scanning hardware, contracts for such, or licensing.
10. Document Scanning - Scanning of documents, including quality checking and linking to external applications as required.
11. Terms of Use - Adhering to the ECM/Imaging Service Terms of Use.