Search

sat) MOTOROLA ASTRO Security Update Service Statement of Work

Revision History

Change log
‘Version |Date [Author =——“<i«éi‘~™ ‘CS escrripptiorn = SSCS
2.0 10/24/2014 Billy VanCannon Release
2.1 04/15/2015 Michael Palmer Service team updates
2.2 05/26/2015 Michael! Palmer Removed IAVM reference
2.3 2/15/2016 Gedi Jomantas Scope adjustment

““" This document can be combined with other similar Statements of Work to form a
complete Service offering to the Customer. *******

Appraved by Motorola Solutions LGA&C 9/18/2014 - = Motorola 2017
Page 2of5

ASTRO Security Update Service Statement of Work

FMIOTOROLA

Security Update Service Overview

To verify compatibility with your ASTRO system, Motorola's Security Update Service (SUS)
provides pre-tesied 3” party software (SW) security updates.

This service was formerly called Pre-tested Software Subscription (PTSS). Additionally, SUS
Platinum has been eliminated. The additional SUS Platinum features have been merged into
this one SUS offering.

This Statement of Work (“SOW"} is subject to the terms and conditions of Motoroia’s
Professional Services Agreement, Service Agreement or other applicable agreement in effect
between the parties (“Agreement”). Motorola and Customer may be referred to herein
individually as a “Party or together as “Parties”

1.0 Description of Security Upgrade Services

Motorola shall maintain a dedicated vetting lab for each supported ASTRO release for the
purpose of pre-testing security updates. In some cases, when appropriate, Motorola will
make the updates available to outside vendors, allow them to test, and then incorporate
those results into this offering. Depending on the specific ASTRO release and customer
options, these may include updates to antivirus definitions, OEM vendor supported Windows
Workstation and Server, Solaris and Red Hat Linux (RHEL) operating system patches,
VMware ESXi Hypervisor patches, Oracle database patches, PostgreSQL patches, and
patches for other 3% party Windows applications such as Adobe Acrobat and Flash.

Motorola has no control over the schedule of releases. The scheduie for the releases of
updates is determined by the Original Equipment Manufacturers (OEMs), without consultation
with Motorola, Antivirus definitions are released every week. Microsoft patches are released
on a monthly basis. Motorola obtains and tests these updates as they are released. Other
products have different schedules or are released “as-required.” Motorola will obtain and test
these updates on a quarterly basis.

Once tested, Motorola will post the updates to a secured extranet website and send an email
notification to the customer. If there are any recommend configuration changes, warnings, or
workarounds, Motorola will provide detailed documentation along with the updates on the
website. Motorola will also provide labels on the extranet site that can be printed and appiied
to DVD's. The customer will be responsible for the download and deployment of these
updates to their ASTRO System.

Approved by Motorola Solutions LGA&C 9/13/2014 <o Motorola 2017

Page 30/5

oe | MOTOROLA ASTRO Security Update Service Statement of Wort

2.0 Scope

Security Update Service supports the currently shipping Motorola ASTRO System Release
(SR) and strives to support 5 releases prior. Motorola reserves the right to adjust which
releases are supporied as business conditions dictate. Contact your Customer Service
Manager for the latest supported releases.

SUS is available for any L or M core system in a supported release. SUS is also available for
K cores but only for Windows PC’s such as MCC 7500 consoles.

Systems that have non-standard configurations that have not been certified by Motorola
Systems Integration and Testing (SIT) are specifically excluded from this Service unless
otherwise agreed in writing by Motorola. Service does not include pre-tested intrusion
detection system (IDS) updates for IDS solutions. Certain consoles, MOTOBRIDGE,
MARVLIS, Symbol Equipment, AirDefense Equipment, AVL, and Radio Site Security
products are also excluded. Motorola will determine, in its sole discretion, the third party
software that is supported as a part of this offering.

3.0 Motcrola has the following responsibilities:

3.1 Obtain relevant 3" party SW security updates as made available and supported
from the OEM's. This includes antivirus definition updates, OEM vendor
available/supported operating systems patches, hypervisor patches, database
patches, and selected other 3 party patches that Motorola deployed in ASTRO
system releases covered by this SUS. Motorola does not control when these
updates are released, but current release schedules are listed for reference:

McAfee Antivirus definitions— Weekly
Microsoft PC and Server OS patches — Monthly
Solaris, RHEL OS, VMware hypervisor patches — Quarterly

3.2 Each assessment will consist of no less than 36 hours of examination time io
evaluate the impact each update has on the system.

3.3 Testing of updates fo verify whether they degrade or compromise system
functionality on a dedicated ASTRO test system with standard supported
configurations.

3.4 Address any issues identified during testing to support functionality by working
with Motorola selected commercial supplier and/or Motorola product development
engineering team. If a solution for the identified issues cannot be found, the patch
will not be posted on Motcrola’s site.

3.5 Pre-test STIG recommended remediation when applicable.
3.6 Release all tested updates to Motorola's secure extranet site.

3.7 Include documentation for installation, recommended configuration changes, and
identified issues and remediation for each update release.

3.8 Include printable labels for customers who download the updates to CD's.

3.9 Notify customer of update releases by email.

Approved by Motorola Solutions LGA&C 9/18/2014 Motorola 2017
Page 4o0f5

ASTRO Security Update Service Statement of Wark

3.10 A supported SUS ASTRO release matrix will be kept on the extranet site for
reference.

4.0 The Customer has the following responsibilities:

4.1 Provide Motorola with pre-defined information prior to contract start date
necessary to complete a Customer Support Plan (CSP).

4.2 Submit changes in any information supplied in the Customer Support Plan (CSP)
tc the Customer Support Manager (CSM).

4.3 Provide means for accessing pre-tested files (Access to the extranet website).

4.4 Deploy pre-tested files io the customer system as instructed in the “Read Me” text
provided.

4.5 implement recommended remediation(s) on customer system, as determined
necessary by customer.

4.8 Upgrade system to a supported system release as necessary to continue service.

4.7 Adhere closely to the System Support Center (SSC) troubleshooting guidelines
provided upon system acquisition. A failure to follow SSC guidelines may cause
the customer and Motorola unnecessary or overly burdensome remediation
efforts. In such case, Motorola reserves the right to charge an additional service
fee for the remediation effort.

4.8 Comply with the terms of the applicable license agreement between the customer
and the non-Motorola software copyright owner.

§.@ Disclaimer:
Motorola disclaims any and all warranties with respect to pre-tested antivirus definitions,

database security updates, hypervisor patches, operating system software patches, intrusion

detection sensor signature files, or other 3” party files, express or implied. Further, Motorola
disclaims any warranty concerning the non-Motorola software and does not guarantee that

customer's system will be error-free or immune to security breaches as a result of these
services.

Approved by Motorola Solutions LGA&C 9/18/2014

© Motorola 2017
Page 50f §

September 2013

Technical Support Overview

Motorola’s Technical Support service provides telephone consultation for technica! issues
that require a high level of ASTRO network expertise and troubleshcoting capabilities.
Remote Technical Support is delivered through the Motoroia System Support Center (SSC)
by a staff of technical support specialists skilled in diagnosis and swift resolution of
infrastructure performance and operational issues. Technical Support provides access to a
solutions database, as well as access to in house test labs and additional Motorola technical

resources

Motorola applies industry best practices in recording, monitoring, escalating and reporting for
Technical Support calls from its contracted customers, reflecting the importance of
maintaining mission critical sysierns.

The terms and conditions of this Statement of Work (SOW) are an integral part of Motorcla’s
Service Agreement or other applicable agreement to which it is attached and made a part
thereof by this reference.

1.0 Description of Technical Support Services

Motorola's System Support Center (SSC) will provide technical support to assist the
customer's technical resources of the Motorola's currently supported infrastructure. This team
of highly skilled professionals is available to the customer as an integrated part of the support
and technical issue resolution process. The SSC remotely supports the customer and works
with but not limited to fault diagnostics tools, simulation networks and fault database search

engines.

The Technical Support Operations is available 24 hours a day; 7 days per week to support
technical requests (see severity level response time commitments). Calls requiring incidents,
problems, or service requests will be logged in Motorola’s issue management system. This
ensures that technical issues are prioritized, updated, tracked and escalated as necessary,
until resolution. The Technical Support Operations shall assign the priority level as in
accordance with the agreed Severity Level Definitions stated in this document.

Motorola will track the progress of each case from initial logging to resolution. Motorola will
ensure that the customer is advised of the case progress and informed of tasks that require
further investigation and assistance from the customer's technical resources

The provision of this service requires that the customer provides a suitably trained technical
resource that delivers maintenance and support to the system, and who is familiar with the
operation of that system. Motorola provides technical consultants to support the local
resource in the timely closure of infrastructure, performance and operational issues.

1.1 Scope

Technical Support service is available 24 hours a day, 7 days a week based on Severity
Level Definitions.

1.2 Geographic Availability

Technical Support is available to any customer regardless of their geographic location and
timeframes are based on the customer's local time zone.

Appraved by Motorola Contracts and Compliance September 2013 < Motorola 2013
Page 3 of 7

ed PPT

1.3 laclusions

Technical Support service will be delivered on Motorola sold infrastructure including
integrated 3" party products.

1.4 Limitations and Exclusions

The following activities are outside the scope of the Technical Support service, but are
optional services that are available to remote Technical Support customers at an additional

cost:
1.4.1

1.4.2

1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10

Emergency on-site visits required to resolve technical issues that cannot be
resolved by with SSC working remotely with the local customer technical
resource.

Third party support for equipment not sold by Motorola as part of the original
system.

System installations, upgrades, and expansions.

Customer training.

Hardware repair and/or exchange.

Network security services.

Network transport.

Information Assurance.

Motorola services not included in this statement of work.

Any technical support required as a result of a virus or unwanted intrusion is
excluded if the system is not protected against these security threats by
Motorola's Pre-tested Security Update Service when applicable.

1.5 Motorola has the following responsibilities:

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5.7

Enable customer access to the Motorola Technical Support Center (800-221-
7144), 24 hours a day, 7 days per week, to answer, document and respond
to requests for support.

Respond to requests for Technical Support in accordance with the response
times set forth in the Severity Level Response Time Commiiments_ section of
this document and the severity level defined in the Severity | evel Definitions
section of this document.

Advise caller of procedure for determining any additional requirements,
activities or information relating to issue restoration and/or characterization.

Maintain communication with the customer in the field as needed until
resolution of the case

Coordinate technical resolutions with agreed upon third party vendors, as
needed.

Escalate and manage support issues, including systemic issues, to additional
Motorola technical resources, as applicable.

Escalate the case to the appropriate party upon expiration of a response
time.

Approved by Motorola Contracts and Compliance September 20713

a’ Motorola 2013

Page 4 of 7

1.5.8

Determine, in its sole discretion, when a case requires more than the
Technical Support services described in this SOW and notify customer of an
alternative course of action.

1.6 The Customer has the following responsibilities:

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.6.9

Provide Motorola with pre-defined information prior to contract start date
necessary to complete Customer Support Plan (CSP).

Submit changes in any information supplied in the Customer Support Plan
(CSP) to the Customer Support Manager (CSM).

Contact the SSC in order to engage the Technical Support service, providing
the necessary information for proper entitlement services. Including but noi
limited to the name of contact, name of customer, system ID number, site(s)
in question, and brief description of the problem including pertinent
information for initial issue characterization.

Maintain suitable trained technical resources that provide field maintenance
and technical maintenance services to the system, and who are familiar with

the operation of that system.

Provide SSC access via the remote connection that has been established
through other sold services (e.g. Network Fauit Monitoring)

Supply suitably skilled and trained on-site presence when requested by the
SSC.

Validate issue resolution prior to close of the case in a timely manner.

Acknowledge that cases will be handled in accordance with the times and
priorities as defined in the Severity Level Definitions and in the Severity Level
Response Time Commitments section in this document.

Cooperate with Motorola and perform all acts that are reasonable or
necessary to enable Motorola to provide the Technical Support service.

Approved by Motorola Contracts and Compliance September 2013

& Motorola 2013

Page Saf7

1.7 Severity Level Definitions
The following severity level definitions will be used to determine the maximum response
times:

Severity
Level Severity Definition

| Severity 1 This is defined as a failure that causes the system and/or infrastructure a loss of

: voice functionality and no work-around or. immediate solution is available.

The following are examples of this kind of failure:

° 33% of call processing resources impaired
e Site Environment alarms:

o Smoke,

e Unauthorized access

o Temperature

o Power failure

Severity 2 This is defined as a fault that causes the system to operate with a continuous
reduction in capacity or functionality of core services (core services include, |
voice, data or network management).

| The following are examples of this kind of failure:

e Less than 33% of call processing resources impaired
e Failure of a single redundant component

Severity 3 This is defined as a fault which reduces the functionality, efficiency or usability of
core services (voice, data and network management) and there is a viable work-
around in place.

The following are examples of this kind of severity:
e Intermittent faults that are infrequent and minor impact to core
services
* Statistical reporting problems

| Severity 4 This is defined as a minor issue, which has littie or no impact on the functionality,
efficiency or usability of core services. The following are examples of this kind of

severity:

* Faults resulting in minor functions or features being unsupported
or unreliable in ways that are not noticeable to the user.

» Faults that have no impact in how the user perceives the sysiem
to work.

« Cosmetic issues.
Requests for information.
Preventive Maintenance

Approved by Motorala Contracts and Compliance Saplember 2013 i Motorola 2013

Page 6 of 7

2.1. Severity Level Response Time Commitments
The response times are based on the defined severity levels as follows:

[SeverityLevel|

Response Time

Severity 1

A Motorola SSC Technician will make contact with the customer technical
| representative within one hour of the request for support being logged in

the issue management system. Continual effort will be maintained to
restore the system or provide a workaround resolution. Response
provided 24 x 7.

Severity 2

A Motorola SSC Technician will make contact with the customer technical

representative within four hours of the request for support being logged at :
the issue management system. Response provided 8 x 5 on standard |
business days, which is normally Monday through Friday 8AM to 5PM,

excluding US Holidays. |

Severity 3

| A Motorola SSC Technician will make contact with the customer technical
| representative within the next business day of the request for support

being logged at the issue management system. Response provided 8 x 5
on standard business days, which is normally Monday through Friday
8AM to 5PM, excluding US Holidays.

Severity 4

A Motorola SSC Technician will make contact with the customer technical
representative within the next business day of the request for support
being logged at the issue management system. Response provided 8 x 5

on standard business days, which is normally Monday through Friday

8AM to 5PM, excluding US Holidays.

Approved by Motorala Contracts and Compliance September 2073

& Motorola 2013

Page 7 of 7