Glossary
Service level agreement
A contractual commitment on measurable service parameters, with a defined measurement method and declared consequences for missing them.
- SLA
An SLA is only useful if it defines three things: the parameter, how it is measured and what happens when it is missed. Most define only the first. “99.9 % availability” does not say whether it is measured monthly or annually, whether scheduled maintenance counts, or who supplies the measurement.
In security, the parameters that actually matter are rarely in the contract: the notification deadline for an incident affecting your data, the deadline for applying critical patches, the response time for an evidence request, and the committed recovery time. If your supplier’s incident notification is slower than your own regulatory duty to report, you have inherited a structural breach.
It is also worth agreeing in advance who produces the measurement. An SLA measured solely by the supplier is a statement, not a verifiable commitment.