Buyer's guide
What a good SLA looks like, and the clauses that make one worthless
A good SLA answers three things: how quickly somebody replies, how quickly you are working again, and what happens when neither occurs. One that promises only the first is telling you when the conversation starts.
By Claire Donnelly · Last reviewed 11 August 2026 · 5 min read
The short version
- Response time is when somebody replies; fix time is when you are working again
- Whoever defines "critical" controls whether a target is ever missed
- Check what pauses the clock - an unlimited hold on you makes targets meaningless
- Averages hide the outliers, and the outliers are what actually hurt
- A target with no consequence attached is a statement of intent, not a commitment
What an SLA is actually for
A service level agreement exists to convert a promise into something measurable. Without one you have a supplier saying they are responsive, which is what every supplier says.
The trouble is that a weak SLA does the opposite. It provides the comfort of numbers while leaving the provider every route to meet them: they classify the ticket, they start and stop the clock, they measure the result, and nothing follows if a target slips. Each of those can be reasonable or unreasonable depending on how it is written, which is why the definitions matter far more than the headline figures.
Read an SLA backwards. The exclusions and the definitions tell you what the targets are actually worth.
What to judge an SLA on
-
1. How priority is defined, and who decides it
Every target hangs off the priority given to a ticket. If the provider alone decides what counts as critical, they also decide whether they can ever miss. Look for priorities defined by business impact, and a way to challenge a classification.
Red flag: Priorities listed as P1 to P4 with no definitions, or classification left entirely to the provider
-
2. Whether response and fix are separate commitments
A response target means somebody has acknowledged you. A fix target means you are working again. These are wildly different promises, and quoting only the first is the most common way an agreement sounds stronger than it is.
Red flag: A single "response time" figure with no fix target anywhere in the document
-
3. What the clock runs on, and what stops it
Targets are counted in business hours, so four hours logged at half past four may mean the following lunchtime. Check how business hours are defined, what happens at weekends, and how long the clock can be paused while the provider waits on you.
Red flag: The clock pauses whenever a ticket is "awaiting customer", with no limit on how often or how long
-
4. Who measures it, and what you are shown
Performance is nearly always measured by the provider from their own system, which is normal. What matters is that you see it. Reporting that shows the misses as well as the hits is what turns an SLA into something anybody checks.
Red flag: No reporting commitment, or reports showing only averages and percentages met
-
5. What happens when a target is missed
A target with no consequence is an intention. Service credits are the usual remedy and are rarely large, but their real value is procedural: a miss has to be acknowledged and recorded rather than quietly absorbed.
Red flag: No remedy at all, or credits you must spot and claim yourself inside a short window
-
6. What sits outside the agreement
Exclusions are where an SLA is really written. Third-party faults, unsupported software, anything classed as a project and anything the provider deems beyond its control commonly fall outside the targets. Read this list before the numbers.
Red flag: A broad, undefined exclusion for anything "outside the provider's reasonable control"
The clauses that quietly gut an agreement
Four things turn a reasonable-looking SLA into decoration.
Unlimited clock-stops. If the timer pauses every time the provider asks you a question, an unresponsive supplier can keep a ticket technically within target indefinitely. A sensible agreement caps it.
Self-assessed priority. When only the provider decides what is critical, the target follows the classification rather than the impact.
Targets that apply to the ticket, not the problem. Closing and reopening a ticket resets the clock. If nothing prevents that, one long problem becomes several short ones.
Remedies you have to chase. Credits that must be claimed within a fortnight, in writing, by a customer who does not know a target was missed, are credits that will not be paid.
None of these is unusual, and none is necessarily sinister – most are boilerplate nobody has revisited. They are worth raising before signature, while they are still editable.
Read these lines before you sign
- The definition of each priority level, in plain business terms
- The fix or resolution targets, stated separately from response
- The definition of business hours, and the position on weekends
- Every circumstance in which the clock pauses
- The reporting you will receive, and how often
- The remedy for a missed target, and who has to initiate it
- The full list of exclusions
What good actually looks like
A good agreement is usually shorter and plainer than a bad one. Priorities are described in terms you recognise – “most of the office cannot work” rather than “Severity 1”. Response and fix are both stated. Business hours are defined, and so is what happens outside them. Reporting arrives without being asked for, and includes the failures.
Most importantly, it reads like something written to be used rather than to be produced in an argument. If understanding your own SLA requires a careful hour and a highlighter, that is itself the finding.
One honest caveat: an SLA is a floor, not a relationship. A provider who hits every target while being unhelpful is meeting the contract and failing you. The document is worth getting right precisely so that you can stop thinking about it.
Common questions
Is a four-hour response time good?
It depends entirely on what "response" means and how the clock runs. Four hours to a real engineer who starts work is good. Four hours to an automated acknowledgement is nothing at all. Ask what happens at the end of those four hours.
Should we expect guaranteed fix times?
For clearly defined faults, yes. For anything complex, an honest provider will commit to continuous effort and communication rather than a fixed hour, because some problems genuinely cannot be time-boxed. Be wary of anyone promising a fix time for everything.
Are service credits worth having?
Not for the money, which is usually modest. They are worth having because they create a record. A provider who must report and credit a miss is a provider who notices misses.
What if we do not have an SLA at all?
Then you have whatever the provider chooses to give you on the day. That can work perfectly well with a supplier you trust, and it gives you nothing to point at when it stops working. Ask for one at renewal.
Can we negotiate an SLA as a small business?
More often than people assume, particularly on definitions rather than headline figures. Asking to cap the clock-stop, or to have priority defined by impact, is a reasonable request that a good provider will discuss.
Written by Claire Donnelly
Not sure what your current agreement commits to?
Send it over and we'll read it properly - what the targets mean, what is excluded, and where it would not protect you. Useful whether or not you ever change provider.
Ask us to read it