What should be in a managed IT services SLA?
What should be in a managed IT services SLA?
A managed IT SLA should define priority levels, response and resolution targets against each, support hours, escalation paths, exclusions, reporting cadence, remedies when targets are missed, and the exit process. Anything that only commits to a response time and nothing else is a marketing document rather than a service level agreement.
Priority definitions come first
Every other number depends on these. Without written definitions, the provider decides what counts as critical, and it will rarely be what you would have chosen.
A workable structure:
P1 - Critical. Business stopped. All users, or a revenue-generating system, unable to work.
P2 - High. A department or a key function affected. A workaround may exist.
P3 - Medium. An individual affected, or a degraded service with a workaround.
P4 - Low. Requests, changes, questions, new starters.
Insist that the agreement names an example of each. “Email down for the finance team” is a P2 in one contract and a P3 in another.
Response is not resolution
Most SLAs commit to a response time. Fewer commit to a resolution target. A fifteen-minute response followed by four days of silence meets the letter of many agreements.
Ask for both, and accept that resolution targets are usually expressed as an objective rather than a guarantee for complex faults. That is reasonable. Having no target at all is not.
Priority | Typical response | Typical resolution target |
|---|---|---|
P1 | 15–30 minutes | 4 hours |
P2 | 1 hour | 8 business hours |
P3 | 4 business hours | 2 business days |
P4 | 1 business day | 5 business days |
Treat these as a reference point for negotiation, not a standard.
Hours, and what happens outside them
Define business hours precisely, including UK public holidays. Then define what happens outside them: is out-of-hours cover included, available at a rate, or unavailable? A P1 at 7pm on a Friday is the scenario the clause exists for.
If you operate across time zones, say so during procurement rather than after. We built a 24-hour support model for Hybrid Theory precisely because business-hours cover had stopped fitting the business.
Exclusions
The exclusions list is the most useful page in the document and the one most often skimmed. Look for how the agreement treats:
Third-party software and vendor liaison
Legacy or end-of-life systems
Project work and its threshold
Onsite attendance, and how many visits are included
Hardware procurement and warranty handling
Anything the provider did not install
None of these are unreasonable exclusions. The problem is discovering them during an incident.
Reporting and review
An SLA without reporting cannot be enforced. Specify:
A monthly report with ticket volumes, SLA attainment, repeat incidents and change activity
A quarterly review with a named person
Trend data, not just counts - the useful question is whether repeat incidents are falling
Remedies
Ask what happens when targets are missed. Service credits are common and usually modest. What matters more is the escalation path: who is notified, at what point, and what they are required to do.
A named escalation contact with a mobile number is worth more than a credit worth two per cent of a monthly fee.
Security and compliance obligations
Increasingly, this belongs in the SLA rather than a side letter. Cover incident notification timeframes, the provider’s own certifications, data location, subprocessors, and what they are obliged to do if they are breached.
NVOY is ISO/IEC 27001:2022 certified for the provision of IT managed services, professional services and supply of IT equipment - certificate 21497ISMS001, Alcumus ISOQAR, UKAS accredited, and independently verifiable.
Exit
The clause nobody negotiates and everybody eventually needs. Establish notice period, who owns documentation and configuration, what transition assistance is included, and how administrative credentials are handed over.
A provider confident in its service will not resist a clean exit clause.
Before you sign
Read the exclusions, the remedies and the exit terms first. The headline response times are the part of the document that has been optimised for procurement.
See our IT Support service, or what to ask a prospective provider.
BLOGS
