ANNEX I

Service Level Agreement for the systems and the applications for administrative cooperation and recovery of claims in the area of VAT

1. APPLICABLE ACTS AND REFERENCE DOCUMENTS

1.1. APPLICABLE ACTS

This Service Level Agreement (‘SLA’) takes into account the list of agreements and applicable decisions listed below.

Table 1

Applicable acts

[AD.1.] Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of value added tax (‘the Agreement’) (OJ L 195, 1.8.2018, p. 3) [AD.2.] Decision No 2/2019 of the Joint Committee established by the Agreement between the European Union and the Kingdom of Norway on administrative cooperation, combating fraud and recovery of claims in the field of the value added tax of … [date] on standard forms for the communication of information, the transmission of information via the CCN/CSI network and the practical arrangements for the organisation of contacts between central liaison offices and liaison departments

1.2. REFERENCE DOCUMENTS

This SLA takes into account the information provided in the following reference documents. Applicable versions of the documents are published on CIRCABC or ITSM Web Portal.

Table 2

Reference Documents

[RD.1.] CCN Mail III User Guide for NAs (ITSM Web Portal) [RD.2.] CCN Intranet – Local Network Administrator Guide (ITSM Web Portal) [RD.3.] Statistics – Guidelines and instructions (ANNEX rev1) to SCAC No 560 [RD.4.] VAT e-Forms – Functional Specifications [RD.5.] VAT e-Forms – Technical Specifications [RD.6.] Recovery e-Forms – Functional Specifications [RD.7.] Recovery e-Forms – Technical Specifications [RD.8.] CCN/CSI General Security Policy (ITSM Web Portal) [RD.9.] CCN Gateway Management Procedures (ITSM Web Portal) [RD.10.] CCN/CSI Baseline Security Checklist (ITSM Web Portal)

2. TERMINOLOGY

2.1. ACRONYMS

Table 3

Acronyms

ACRONYM DEFINITION CCN/CSI Common Communication Network / Common System Interface CET Central European Time CIRCABC Communication and Information Resource Centre Administrator DG Directorate General EoF Exchange of Forms ITIL (1) Information Technology Infrastructure Library ITSM Information Technology Service Management Party Within the scope of this SLA, ‘Party’ shall mean either Norway or the Commission. VAT Value Added Tax

2.2. DEFINITIONS

Table 4

Definitions

EXPRESSION DEFINITION CET Central European Time, GMT+1 and during summer time GMT+2 hours Working days and hours (ITSM service desk) 7:00 to 20:00 (CET), 5 days a week (Monday to Friday including holidays)

3. INTRODUCTION

This document consists of a SLA between the Kingdom of Norway (‘Norway’) and the European Commission (‘the Commission’), collectively referred as ‘the Parties to the SLA’.

3.1. SCOPE OF THE SLA

Article 5 of the Agreement specifies that ‘A service level agreement ensuring the technical quality and quantity of the services for the functioning of the communication and information exchange systems shall be concluded’.

This SLA sets out the relationship between Norway and the Commission concerning the use of the systems and applications for administrative cooperation and recovery of claims in the area of VAT, and between Norway and the Member States concerning the exchange of forms.

The following systems are operational and are subject to the terms of the SLA:

— Exchange of Forms (EoF);

— Monitoring, statistics and testing.

The Commission steers the process to achieve agreement for the administrative cooperation by means of information technology. This involves standards, procedures, tools, technology and infrastructure. Assistance to Norway is provided to ensure data exchange systems are available and are properly implemented. The monitoring, supervision and evaluation of the overall system is also provided by the Commission. Furthermore the Commission provides Norway with guidelines to be respected in relation to this exchange of information.

All targets referred to in the SLA will be applicable under normal working conditions only.

In case of events of force majeure, the applicability of the SLA for Norway will be suspended for the duration of these force majeure conditions.

Force majeure represents an unpredictable event or occurrence outside the control of Norway or the Commission, and which is not attributable to any act or failure to take preventive action by the responsible Party. Such events shall refer to government actions, war, fire, explosion, flood, import or export regulations or embargoes and labour disputes.

The Party invoking the force majeure shall inform the other Party without delay about the impossibility to provide services or to accomplish the SLA targets due to force majeure incidents, setting out the affected services and targets. When the incidence of force majeure has ceased the affected Party shall likewise inform the other Party without delay.

3.2. AGREEMENT PERIOD

The SLA is binding on the Parties from the day following its approval by the Joint Committee established by Article 41 of the Agreement (‘the Joint Committee’).

4. RESPONSIBILITIES

The purpose of this SLA is to ensure the quality and quantity of the services to be delivered by the Commission and by Norway in order to make the specified systems and applications for administrative cooperation and recovery of claims in the area of VAT available to Norway and to the Commission.

4.1. SERVICES PROVIDED BY THE COMMISSION TO NORWAY

The Commission shall make the following services available:

— Operational services as follows: — Helpdesk and operations: (a) Helpdesk Support; (b) Incident Handling; (c) Monitoring and Notification; (d) Training; (e) Security Management; (f) Reporting and statistics; (g) Consulting. — Reference centre: (a) Information management; (b) Documentation centre (CIRCABC).

In order to provide these services, the Commission shall maintain the following applications:

— Statistical applications;

— CIRCABC;

— Service desk tool.

4.2. SERVICES PROVIDED BY NORWAY TO COMMISSION

Norway shall do the following:

— communicate to the Commission any available information relevant to their application of the Agreement;

— communicate to the Commission any exceptional conditions;

— provide annually the statistics regarding the communication of information set out in Article 20 of the Agreement.

5. SERVICE LEVEL REVIEW

This chapter provides a detailed description of the quantitative and qualitative aspects of the services to be provided by the Commission and by Norway as described above.

5.1. COMMISSION SERVICE LEVELS

5.1.1. Service desk

5.1.1.1. Agreement

The Commission shall make available a Service Desk in order to respond to any questions and to report any problems which Norway experiences with the systems and applications for administrative cooperation and recovery of claims in the area of VAT or any component that could affect them. This Service Desk will be operated by ITSM and its operating hours shall be the same as the ITSM working hours.

The availability of the ITSM Service Desk shall be ensured in at least 95 % of the operating hours. All questions or problems can be communicated to the service desk during the ITSM working hours by telephone, fax or e-mail and outside those working hours by e-mail or fax message. Where these questions or problems are sent outside the working hours of the ITSM they shall be automatically deemed to have arrived at 8:00 CET on the next working day.

The Service Desk shall register and classify the service calls in a Service Management Tool and shall inform the reporting Party of any change in status regarding their service calls.

The ITSM shall deliver a first line support to the users and shall dispatch any service call, which is the responsibility of another party (e.g. developer's team, ITSM contractors) within the specified time. ITSM shall ensure compliance with the registration deadlines in at least 95 % of the cases occurring over a reporting month.

The ITSM shall monitor the resolution procedure for all service calls and shall start an escalation procedure by informing the Commission where the resolution period exceeds a predefined threshold, which will depend on the type of problem.

The priority level shall determine both the response and the resolution times. This is set by ITSM, but Member States or the Commission may require a specific priority level.

The registration time is the maximum time interval that is allowed to pass between the time of the receipt of the email and the sending of the acknowledgment email.

The resolution time is the time interval between the registration of the incident and the resolution information being sent to the issuer. This also includes the time involved in closing the incident.

These shall not be absolute deadlines as they take into account only the time when ITSM acts on the service call. When a service call is dispatched to Norway, the Commission or another party (e.g. developer's team, ITSM contractors) then this time does not form part of the resolution time of ITSM.

ITSM shall ensure the compliance with the registration and resolution deadlines in at least 95 % of the cases occurring over a reporting month.

Table 5

Registration times and resolution times (working hours / days)

PRIORITY REGISTRATION TIME RESOLUTION TIME P1: Critical 0,5 h 4 h P2: High 0,5 h 13 h (1 day) P3: Medium 0,5 h 39 h (3 days) P4: Low 0,5 h 65 h (5 days)

5.1.1.2. Reporting

The Commission shall report on all service calls related to the systems and applications for administrative cooperation and recovery of claims in the area of VAT as follows:

— all the service calls closed during the month for Norway;

— all the service calls created during the month for Norway;

— all the service calls pending at the reporting date and time for Norway.

5.1.2. Statistical Service

5.1.2.1. Agreement

The Commission shall generate statistics about the number of exchanged forms in the VAT and recovery domain using CCN/Mail, which are available on the ITSM Web portal.

5.1.2.2. Reporting

The Commission shall produce a report on the conformance test reports, where applicable, and shall make them available to Norway.

5.1.3. Exchange of Forms

5.1.3.1. Agreement

The following table illustrates the maximum transmission deadline or answer time for the exchange of forms as defined in the legislation.

Table 6

Performance EoF

CCN/Mail mailbox Form Deadline VIESCLO Exchange of Information under Articles 7, 10, 12 and 18 of the Agreement General exchanges The time limit for providing information is as quickly as possible, and no later than 3 months following the date of the request (Article 8 of the Agreement). However when the requested authority is already in possession of the information the time limit shall be reduced to a maximum period of one month (Article 8 of the Agreement). VIESCLO Exchange of Information under Articles 7, 10, 12 and 18 of the Agreement Request for notification Request for notification with immediate answer (Article 12 of the Agreement). TAXFRAUD Exchange of Information under Articles 7, 10, 12 and 18 of the Agreement Anti-fraud exchanges Missing trader information shall be sent as soon as the information becomes available. TAXAUTO Automatic exchanges The categories of information subject to automatic exchange, in accordance with Article 11 of the Agreement, are to be determined by the Joint Committee. REC-A-CUST; REC-B-VAT; REC-C-EXCISE; REC-D-INCOME-CAP; REC-E-INSUR; REC-F-INHERIT-GIFT; REC-G-NAT-IMMOV; REC-H-NAT-TRANSP; REC-I-NAT-OTHER; REC-J-REGIONAL; REC-K-LOCAL; REC-L-OTHER; REC-M-AGRI Request for information under Art. 22 of the Agreement Request for notification under Art. 25 of the Agreement Request for recovery under Art. 27 of the Agreement Request for precautionary measures under Art. 33 of the Agreement Request for information: — acknowledgment of receipt within 7 calendar days; — update at the end of 6 months from the date of acknowledgment. Request for notification: — acknowledgment of receipt within 7 calendar days. Request for recovery and request for precautionary measures: — acknowledgment of receipt within 7 calendar days; — update at the end of every 6 months from the date of acknowledgment.

5.1.3.2. Reporting

Norway shall also provide on an annual basis to the Commission statistical data via e-mail regarding to the communication of information as set out in Articles 20 and 39 of the Agreement [RD.3.].

5.1.4. Problem Management

5.1.4.1. Agreement

Norway shall maintain an adequate problem registration (2) and follow-up mechanism for any problems affecting their application host, system software, data and applications software.

Problems with any part of the CCN network (Gateways and/or Exchange Mail servers) shall be reported to ITSM immediately.

5.1.4.2. Reporting

Norway shall inform the ITSM where they have an internal problem with the technical infrastructure related to their own systems and applications for administrative cooperation and recovery of claims in the area of VAT.

Where Norway considers that a problem reported to ITSM is not being addressed or resolved or was not addressed or resolved in a satisfactory way, it shall report this to the Commission as soon as possible.

5.1.5. Security Management

5.1.5.1. Agreement (3)

Norway shall protect its systems and applications for administrative cooperation and recovery of claims in the area of VAT against security violations and shall keep track of any security violations and of any security improvements made.

Norway shall apply the security recommendations and/or requirements specified in the following documents:

Table 7

Security recommendations

Name Version Date https security recommendations of CCN /Mail III Webmail access – Ref. CCN /Mail III User Guide for NAs 3.0 15.6.2012 Security recommendations of CCN /Mail III Webmail access – Ref. CCN Intranet – Local Network Administrator Guide 4.0 11.9.2008

5.1.5.2. Reporting

Norway shall on an ad-hoc basis report to the Commission on any security violations and on any measures taken.

5.2. NORWAY'S SERVICE LEVELS

5.2.1. All Service Level Management Areas

5.2.1.1. Agreement

Norway shall register any unavailability problems or changes (4) regarding to the technical, functional and organisational aspects of Norway's systems and applications for administrative cooperation and recovery of claims in the area of VAT.

5.2.1.2. Reporting

Norway shall inform the ITSM where necessary in relation to any unavailability problems or changes regarding the technical, functional or organisational aspects of their system. ITSM shall always be informed for any changes regarding the operating personnel (operators, system administrators).

5.2.2. Service desk

5.2.2.1. Agreement

Norway shall make available a service desk for responding to incidents assigned to Norway, for giving assistance and to carry out testing. The working hours of the service desk should be the same as the working hours of the ITSM Service Desk during ITSM working days. Norway's service desk shall operate at a minimum between 10:00-16:00 CET during working days, except on its national holiday. It is recommended that Norway's service desk follows the ITIL service support guidelines in handling the questions and incidents.

5.2.2.2. Reporting

Norway shall inform the ITSM where necessary in relation to any availability problem related to its service desk.

6. QUALITY MEASUREMENT

6.1. AGREEMENT

The Commission shall evaluate the reports (activity reports generated by ITSM, notifications, statistics, other information) received from the ITSM and Norway, shall determine the levels of adherence to this SLA and in case of problems shall contact Norway in order to solve the problem and to ensure that the quality of the service is in line with this agreement.

6.2. REPORTING

The Commission shall report on a monthly basis to Norway the level of the service as defined in Section 5.1.2.

7. APPROVAL OF THE SLA

The Service Level Agreement has to be approved by the Joint Committee in order to be applicable.

8. CHANGES TO THE SLA

The Service Level Agreement will be reviewed following a written request from the Commission or Norway to the Joint Committee.

Until the Joint Committee decides on the proposed changes, the provisions of the current SLA remain in force. The Joint Committee acts as the decision making body for the present agreement.

9. CONTACT POINT

For any questions or remarks regarding this document, feel free to contact:

SERVICE PROVIDER - SERVICE DESK

support@itsmtaxud.europa.eu

(1) ITIL: http://www.itil-officialsite.com

http://www.best-management-practice.com/gempdf/itSMF_An_Introductory_Overview_of_ITIL_V3.pdf

(2) Linked to Problem and Change management processes of ITIL.

(3) These are the documents versions available at the time of writing this SLA. The reader is invited to check any subsequent updates on the CCN/CSI Portal (http://portal.ccntc.ccncsi.int:8080/portal/DesktopDefault.aspx?tabid=1).

(4) Use of principles described in the incident management in ITIL is recommended.