Appendix 4 to Schedule 3.16: ITIL Services Breakdown Structure

Appendix 4 to Schedule 3.16:

1. 
   Service Strategy
   

11. 
    Business Relationship Management.
    

12. 
    Service Portfolio Management.
    

1. 
   The Service Portfolio shall represent a complete list of the services managed and performed by the Operator. The Service Portfolio contains present contractual commitments, new service development and retired services. It also includes third-party infrastructure services which are an integral part of the service offerings to the MBTA.
   

1. 
   Customer Portfolio: the Operator shall have a process to produce an MBTA portfolio that is a database or structured document used to record all services provided by the Operator. The portfolio will be a resource that provides details of all the components within the MBTA to whom the Operator provides services to.
   
2. 
   Project Portfolio: the Operator shall have a process to produce a database or structured document used to manage MBTA projects throughout their lifecycle,; it will be used to coordinate the project(s).
   
3. 
   Customer Agreement Portfolio: the Operator shall have a process to produce and manage its agreement portfolio. It will be a database or structured document used to manage service contracts or agreements between an the Operator and the MBTA as well as those entered into by and between the Operator and any third party. Each IT service delivered to the MBTA should be called out in a contract or other agreement that is listed in the agreement portfolio.
   
4. 
   Application Portfolio: The Operator shall have a process to produce and manage an application portfolio. It will be a database or structured document used to manage applications throughout their lifecycle, and it will contain the key attributes of all applications.
   
1. 
   Financial management.
   

14. 
    Demand Management.
    

15. 
    Strategy Management for Commuter Rail IT Services:
    

17. 
    Service Design.
    

1. 
   Design Coordination.
   

2. 
   Service Level Management.
   

3. 
   Service Catalogue Management.
   

4. 
   Supplier Management.
   

5. 
   Availability Management.
   

6. 
   Capacity Management.
   

7. 
   IT Service Continuity Management.
   

2.8 Information Security Management.

18. 
    Service Transition.
    

1. 
   Transition Planning and Support.
   

2. 
   Change Management.
   

3. 
   Service Asset and Configuration Management.
   

4. 
   Release and Deployment Management.
   

5. 
   Knowledge Management.
   

6. 
   Change Evaluation.
   

7. 
   Service Validation and Testing.
   

19. 
    Service Operation.
    

1. 
   Event Management.
   

2. 
   Incident Management.
   

3. 
   Request Fulfillment.
   

4. 
   Problem Management.
   

5. 
   Access Management.
   

20. 
    Continual Service Improvement (CSI).
    

Appendix 5 to Schedule 3.16:

1. 
   MBTA External Connections Standards
   
2. 
   MBTA Firewall and Router Standards
   
3. 
   MBTA Personal Firewall Requirements Policy
   
4. 
   MBTA Wireless Policy and Standards
   
5. 
   MBTA Wireless Network Policy
   
6. 
   MBTA Acceptable Use Policy
   
7. 
   PCI-DSS 2.0
   
8. 
   MBTA Enterprise Security Incident Handling and Response Procedures and policies
   
9. 
   MBTA Information Technology Security Policy
   
10. 
    Enterprise Website Cookie Policy
    
11. 
    MBTA Information Systems (IS) Policy
    
12. 
    Mobile device management policy, MBTA Policy
    
13. 
    Policies cited in the References Section, below
    
14. 
    Commonwealth of Massachusetts Executive Order 504, 21 CMR 17.00, and other regulations and laws concerning personal information
    
15. 
    Commonwealth of Massachusetts Enterprise Web Accessibility Standard
    
16. 
    Privacy and Security Regulations
    
17. 
    Other Applicable Laws
    

1. 
   Initiation.
   

1. 
   Evaluation & Recommendations
   
2. 
   Identify project stakeholders
   
3. 
   Develop Project Charter
   
4. 
   Deliverable: Submit Project Charter
   
5. 
   Project Sponsor Reviews Project Charter
   
6. 
   Project Charter Signed/Approved
   
1. 
   Planning.
   
   1. 
      Develop Project Management Plan
      
   2. 
      Collect Requirements, Define Scope, and create Work Break Down Structure (WBS)
      
   3. 
      Define Activities and Develop Schedule and identify critical path
      
   4. 
      Estimate Costs and Determine Budget
      
   5. 
      Develop Human Resource Plan
      
   6. 
      Develop Communications Management Plan
      
   7. 
      Develop Risk Management Plan
      
   8. 
      Develop Procurement Management Plan
      
2. 
   Execution.
   
   1. 
      Acquire and Develop Project Team
      
   2. 
      Project Kickoff Meeting and Project Staff Assignments
      
   3. 
      Distribute communication and Manage Stakeholder Expectations Design System
      
      1. 
         Conduct and Administer Procurements
         
      2. 
         Execute task list in the WBS and Project Plan that will include: Design and Development
         
      3. 
         Install Live System
         
      4. 
         Testing Phase(s)
         
      5. 
         Documentation User Training(s)
         
      6. 
         Go Live
         
      7. 
         On-going maintenance
         
3. 
   Control.
   
   1. 
      Iterative Project Management Plan Updates
      
   2. 
      Administer Procurements
      
   3. 
      Verify and Control Scope through performance metrics
      
   4. 
      Control Schedule and deliverables
      
   5. 
      Project Status Meetings
      
   6. 
      Monitor and Control through Integrated Change control
      
   7. 
      Monitor and Control Risks
      
4. 
   Closeout.
   
   1. 
      Final product or service or result transition
      
   2. 
      Close Procurement
      
   3. 
      Document Lessons Learned
      
   4. 
      Update Files/Records
      
   5. 
      Archive Files/Documents
      
   6. 
      Gain Formal Acceptance
      
   7. 
      Close Project phases or Projects
      

1. 
   Change/Configuration Management.
   

8. 
   Configuration Management.
   

1. 
   Planning: The Operator’s Configuration Management plan must cover a rolling three month period in detail, and the subsequent nine months in outline. Such plan shall be subject to MBTA review (if desired by the MBTA) twice a year, or upon request, and must include any impacts to strategy, policy, scope, objectives, roles and responsibilities, the Configuration Management processes, activities and procedures, the database, relationships with other processes and third parties, as well as tools and other resource requirements.
   
2. 
   Identification: This must cover the recording of information by the Operator, including hardware and software versions, documentation, ownership and other unique identifiers. Records must be maintained by the Operator in a Configuration Management Database covering the selection, identification and labeling of all configuration of every item in the Operator provided infrastructure and systems.
   
3. 
   Control: This must assure that only authorized and identifiable configuration items are accepted and recorded by the Operator from receipt to disposal. The Operator must also ensure that all Operator provided infrastructure and systems are under Change Management control.
   
4. 
   Monitoring: Accounting and reporting by the Operator must provide a view regarding current and historical data (data collection begins following the Operator implementation) concerned with each Operator provided item throughout its life-cycle. Changes to items and tracking of their records through various statuses, e.g. ordered, received, under test, live, under repair, withdrawn or for disposal, must be provided.
   
5. 
   Verification: the Operator shall provide reviews and audits that verify the physical existence of items, and checks that they are correctly recorded in the Configuration Management Database. Verification must also include the process of validating Release Management and Change Management documentation before changes are made to the MBTA’s live environment.
   
1. 
   Change Management Plan.
   

10. 
    Governance.
    

1. 
   The Operator shall have a single Configuration Management Process and Process owner.
   
2. 
   The Operator shall define the Roles and responsibilities and insert within the Configuration Management Process (“ConMP”).
   
3. 
   The Operator shall store All Configuration-Items within a repository according to pre-defined MBTA standards.
   
4. 
   The Operator shall perform quarterly audits to evaluate and improve the effectiveness of Configuration Changes and the ConMP.
   
5. 
   Configuration Item categories have been defined and are found in Section 2.1 (Overview of Operational Assessment Methodology) of this Appendix 7 (Configuration Management) to Schedule 3.16 (Information Technology Requirements) below.
   
6. 
   Configuration Standards must be continuously developed, employed and maintained by the Operator to provide accuracy and consistency of the Configuration Items Repository (“CIR”).
   
7. 
   The Operator shall provide a Configuration Item Repository update for all completed changes, including transfers, replacements and thefts, to hardware and software, are followed by.
   
8. 
   Each physical IT Configuration Item to be tracked shall have a unique identifier tag by the Operator.
   
9. 
   Configuration Items owned or leased by the MBTA are managed by the Operator.
   
10. 
    The Operator shall continuously manage and improve the ConMP as it will be a living document and subject to constant change.
    
11. 
    The ConMP will be developed by the Operator to manage all of the MBTA Configuration Items.
    
12. 
    All problems result in the creation of trouble tickets by the Operator.
    
13. 
    The Operator shall implement the Configuration Item Repository such that it will be universally accessible via Remote Access and Intranet.
    
14. 
    The Operator shall develop a Standard Operating Environment to update any configuration change.
    
15. 
    The MBTA holds the right to perform periodic reviews in order to maintain the integrity of the Configuration Item Repository.
    
16. 
    The Operator will collect configuration data and automate whenever possible to minimize the manual updates as required.
    
17. 
    Automated inventory frequency is determined by requirements of individual platforms.
    
18. 
    The Operator will provide baseline information for equipment procurement and investment forecasting. Such records will include location attributes and an up-to-date status field while having pre-defined records and attribute layouts.
    
19. 
    The Configuration Management System will be scalable to accommodate the anticipated growth in customers and MBTA infrastructure.
    
1. 
   Configuration Items.
   

1. 
   Hardware and Software
   
2. 
   Service
   
3. 
   Lifecycle Support Documentation
   
4. 
   Rack Elevation Diagrams
   
5. 
   Floor Diagrams
   
6. 
   Supplemental Drawings
   
7. 
   Test Artifacts
   
8. 
   Installation and Configuration Specifications
   
9. 
   Vendor Documentation and media
   
10. 
    Security Documentation
    

1. 
   Operator Service Center Technical Requirements.
   

12. 
    Operator Service Center Technical Requirements
    
    1. 
       The Operator Service Center shall efficiently integrate the Issue Tracking Portal with the MBTA Internal IT Environment for handling calls pertaining to the Commuter Rail IT Environment and Commuter Rail Services.
       
    2. 
       The Operator shall conduct necessary testing to ensure backward compatibility of its solutions and their integration with the MBTA Internal IT Environment, and such changes shall be conducted for any changes, upgrades to hardware or patches applied.
       
13. 
    Operator Service Center Integration.
    
    1. 
       The Operator must ensure that the Operator Service Center staff are properly trained on any major changes in the solutions and programs that they provide support on before the changes are effective.
       
    2. 
       The Operator must submit detailed Documentation to the MBTA concerning the Operator Service Center including, but not limited to the following:
       
       1. 
          Plan for maintaining the Operator Service Center
          
       2. 
          Plan for making sure that the Operator Service Center remains current on necessary or desirable Updates
          
       3. 
          Plan for deploying changes to the Operator Service Center
          
       4. 
          Testing requirements for changes in the Operator Service Center
          
       5. 
          Plan for ensuring backward compatibility with respect to Updates to the Operator Service Center
          
       6. 
          Plan for business continuity
          
       7. 
          Detailed description of the technical and database architecture of the solution
          

1. 
   Baseline Methodology for Information Gathering.
   

14. 
    Overview of Baseline Methodology.
    

15. 
    Collection of Data and Data Aggregating.
    

16. 
    Sequencing of Implementation.
    

17. 
    Consistency of Collection.
    

18. 
    Non-Exhaustive Deliverables.
    

1. 
   Documented Baseline Methodology for Baseline development
   
2. 
   Documented data gathering strategy
   
3. 
   Detailed list and description of data elements to be collected
   
4. 
   Timeline. Draft a template for a transition and implementation approach and high-level timeline which includes processes for the consolidation of the Operator's training on using data collections tools if applicable Baseline information gathering tools.
   
1. 
   Operational Assessment Methodology.
   
   1. 
      Overview of Operational Assessment Methodology.
      

2. 
   Required Elements.
   

1. 
   ITIL process implementation assessment for IT infrastructure services, functions and processes
   
2. 
   IT Business Continuity/Disaster Recovery process assessment
   
3. 
   IT assets and data center facilities assessment
   
4. 
   Outcome/deliverables must include, but not be limited to:
   
   1. 
      Documented methodology with framework criteria for Operational Assessments
      
   2. 
      Documented data gathering strategy
      
   3. 
      Detailed list and description of data elements to be collected
      
   4. 
      Training to the MBTA on using data collections tools if applicable
      
   5. 
      Operational Assessment information gathering tools
      
5. 
   Execute the Baseline Methodology for the MBTA.
   
6. 
   Conduct information gathering to create an independent, objective current Baseline for the participating Operators using the aforementioned methodology.
   
1. 
   Required Baseline Elements.
   

1. 
   Service content associated with the IT infrastructure service being provided including scale and scope of service utilization, customers served and volume of usage. This must include the identification of functions/services performed by affected IT personnel which may not be components of the IT infrastructure services/functions.
   
2. 
   Service performance costs including all cost components and fully loaded personnel cost information.
   
3. 
   Service performance quality including performance metrics.
   
4. 
   Outcome/deliverables must include, but not be limited to:
   
   1. 
      Individual Baseline report for the MBTA
      
   2. 
      Aggregated (roll-up) Baseline report for the MBTA
      
   3. 
      Electronic copy of all data collected and/or used for the MBTA
      
1. 
   Required Description of Baseline Assessments.
   

Appendix 10 to Schedule 3.16: