An IT managed services SLA is the part of the contract that says how fast a provider must act and how it proves it. SLA stands for service level agreement. Many small businesses sign one without reading past the price. This guide explains the terms in plain words, so you can ask better questions before you sign.
1. Response time is not fix time
These two numbers get mixed up all the time. Response time is how long the provider takes to start work on your ticket. Fix time, sometimes called resolution time, is how long it takes to solve the problem.
A provider can promise a 15 minute response and still take two days to fix the fault. That is not a breach, because only the first number was promised. Ask for both numbers in writing.
Ask what counts as a response. An automatic email from the ticket system should not count. A named person who looks at the problem should.
Also ask when the clock runs. Some contracts count business hours only. A fault at 5pm on Friday may then not be touched until Monday morning. If your shop trades on weekends, say so and ask for the hours that match.
2. Priority levels set the speed
Most SLAs sort problems into levels. A common set is critical, high, medium and low. Critical may mean the whole office is down. Low may mean one person wants a new mouse.
Each level gets its own response and fix target. So the level matters as much as the number. Find out who decides the level. If only the provider decides, a real emergency can be rated as medium.
A fair contract lists examples for each level. A payment system that is down may be critical for you, even if the provider calls it routine.
3. Uptime figures look close but are not
Uptime is the share of time a service is meant to be working. It is usually shown as a percentage. The gap between figures is bigger than it looks.
- 99 per cent allows about 7 hours of downtime in a 30 day month.
- 99.9 per cent allows about 43 minutes in a 30 day month.
- 99.99 per cent allows about 4 minutes in a 30 day month.
This is simple arithmetic: a 30 day month has 43,200 minutes, and the allowed downtime is the remaining share.
Then ask what the figure covers. Is it the whole system or one part? Is it measured every month, or averaged across a year? A yearly average can hide one very bad month.
Uptime also often applies only to services the provider runs itself. Your internet line, your software licences or a cloud vendor may sit outside it. Ask for a list of what is in and what is out.
4. Exclusions and credits
Most SLAs list events that do not count against the provider. Planned maintenance is the usual one. Others are faults caused by your staff, problems at a third party, or events outside the provider's control.
Some exclusions are fair. Others are wide enough to cancel the promise. Read each one and ask how often it is likely to apply. Ask how much notice you get for planned work, and whether it is done outside your trading hours.
Next, look at what happens when a target is missed. Many contracts offer a service credit, which is a small discount on the next bill. Check how much it is, whether you must claim it, and by when. A credit worth a few dollars does little to cover a day of lost sales. The SLA is not a replacement for the law, either.
Under the Australian Consumer Law, services must be carried out with due care and skill, be fit for the stated purpose, and be supplied in a reasonable time if no time is agreed. These guarantees reach a business that buys services costing less than $100,000. The Australian government's business.gov.au site also says a store policy cannot override these rights. This is general information only. A lawyer who knows technology contracts should read the service level terms in your IT support agreement before you commit to it.
5. Security and incident reporting
Your provider often holds admin access to your whole network. That is useful, and it is also a risk. The Australian Signals Directorate (ASD) has warned that attackers target managed service providers to reach their customers. Its guidance, last updated in October 2021, is written for providers, but a buyer can use it as a checklist.
It says providers should put incident notification clauses in the contract, so the customer is told about any cyber incident that may endanger its network. It also says providers should talk openly with customers about what security to expect, and should know where the boundary lies between their systems and the customer's. It also advises recording and reviewing what the provider does on customer networks.
Turn that into questions. How fast will you be told of a breach? Does the provider use multi-factor authentication on its own admin accounts? Do you get logs of what it did on your systems? Who is responsible for backups, and how often are they tested?
6. Reports and review
A number you cannot check is only a claim. Ask for a monthly report that shows each ticket, the level, the time to respond and the time to fix. It should also show uptime for the month against the target.
Ask for the longest times as well as the averages, since averages hide slow cases.
Book a review every quarter. Use it to look at misses, repeated faults and changes in your business. If you add staff, a new shop or a new system, the SLA may need new targets.
Finally, check how you can leave. If the provider keeps missing targets, you need a way out that does not cost a fortune. Look for a clause that lets you end the contract after repeated misses, and ask that your data and passwords are handed over in a set time.
The limit of any SLA is simple. It shows what a provider has promised, not how it behaves under pressure. Ask for references from clients of a similar size, and call one.