<p>One of the most important contractual agreements that an organization can execute with a partner is a service-level agreement, or SLA. IT leaders should make sure that their organization is following some best practices to ensure that their partner is compliant with the SLA.</p><div class="ad-wrapper ad-embedded"> <div id="halfpage" class="ad ad-hp"> <script>GPT.display('halfpage')</script> </div> <div id="mu-1" class="ad ad-mu"> <script>GPT.display('mu-1')</script> </div> </div> <p>An SLA documents the products or services that the service provider will furnish and defines the service standards that the provider is obligated to meet. Creating an SLA helps organizations avoid potential issues in the future, including subpar service from the provider.</p> <p>Learn more about some best practices for ensuring SLA compliance.</p> <section class="section main-article-chapter" data-menu-title="Why are SLAs important?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Why are SLAs important?</h2> <p>Service providers of all kinds, including managed service providers, use SLAs to ensure that their customers are satisfied. SLAs also define the circumstances in which a provider could be penalized for unsatisfactory performance.</p> <p>Companies that work with service providers benefit from SLAs because the contract outlines the criteria for acceptable provider performance and specifies how to address service delivery issues.</p> <p>SLAs are external if they are established with a third-party organization and internal if they are established with another department within an organization. The former is very common, and the contents of an SLA can be an important deciding factor for companies when evaluating prospective service providers. SLAs have become increasingly important as cloud vendors and <a href="https://www.techtarget.com/searchitchannel/Guide-to-building-and-executing-an-MSP-business-model">MSPs</a>, which might support some or all of an organization's IT operations, have grown in popularity.</p> <p>Meanwhile, a company might <a href="https://www.techtarget.com/searchnetworking/tip/SD-WAN-and-SLAs-Why-crafting-internal-SLAs-is-a-smart-move">use an internal SLA</a> if, for example, an IT department develops a product for the customer service department. The SLA would lay out the customer service department's expectations for the IT department.</p> <p>Service providers might establish two service agreements with companies. One is a master service agreement that defines the general terms and conditions for the working relationship. The second is the SLA, which goes into greater detail on specific provider activities, defines required performance levels and discusses the penalties for failing to achieve the desired results.</p></section> <section class="section main-article-chapter" data-menu-title="What is SLA compliance?"> <h2 class="section-title"><i class="icon" data-icon="1"></i>What is SLA compliance?</h2> <p>SLA compliance is achieved when service providers satisfy SLA requirements. SLAs must be clearly written and provide sufficient detail to avoid any uncertainty about expectations.</p> <p>SLAs are often linked with an organization's KPIs. Here are some examples of SLA performance metrics that are based on a company's KPIs:</p> <ul class="default-list"> <li>Achieve four-nines, or 99.99%, uptime and availability for a particular system.</li> <li>Reduce mean time to repair, or MTTR, of a particular system by 75%.</li> <li><a href="https://www.techtarget.com/searchcustomerexperience/tip/How-to-improve-the-contact-center-experience-for-customers">Increase contact center first-call connections</a> to service representatives to 95%.</li> <li>Reduce carbon footprint readings by 50%.</li> <li><a href="https://www.techtarget.com/searchnetworking/answer/What-are-the-3-most-common-network-issues-to-troubleshoot">Reduce network latency</a> by 80%.</li> <li>Reduce system response times by 50%.</li> </ul> <p>Achieving compliance is a two-way street. The provider and the company receiving the services both have a vested interest in achieving compliance with SLA metrics.</p> <p>The company's employees must carefully monitor the systems and resources that the provider is working on. While doing so is relatively easy if a company uses on-site systems and <a href="https://www.techtarget.com/searchdatacenter/tip/Cloud-vs-traditional-data-center-Which-is-right-for-you">data centers</a>, monitoring the provider is more challenging if the provider manages systems and resources. Providers might not want customers looking over their shoulders.</p> <p>Providers should make every effort to achieve SLA compliance, as doing so ensures that they will get paid for their work and avoid costly litigation. SLA compliance is also key for maintaining good customer relations and renewing contracts.</p></section> <section class="section main-article-chapter" data-menu-title="Types of SLAs"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Types of SLAs</h2> <p>There are three types of service-level agreements: customer, internal and multilevel.</p> <h3>1. Customer SLA</h3> <p>A customer SLA is also referred to as an external SLA and is established between a service provider and its customers. A customer SLA involves both parties negotiating an agreement about the services that the service provider will supply as well as penalties for nonperformance or poor performance.</p> <p>Components of a customer SLA typically include the following:</p> <ul class="default-list"> <li>A concise description of the service expected by the customer.</li> <li>Details about the service.</li> <li>Required performance levels for the service.</li> <li>The roles and responsibilities of each party.</li> <li>The procedures for reporting and escalating performance issues.</li> <li>Penalties for lack of compliance with SLA metrics.</li> <li>Terms and procedures for canceling the SLA.</li> </ul> <h3>2. Internal SLA</h3> <p>As discussed above, this agreement is typically used within an organization. An internal SLA would be created if an <a href="https://www.techtarget.com/searchitchannel/feature/How-to-write-an-IT-service-level-agreement">IT department and its internal customer</a> establish an agreement for delivery of a specific product or service.</p> <p>Companies might have multiple SLAs in progress. For example, an IT department could be working on projects for the customer service department and the finance department.</p> <h3>3. Multilevel SLA</h3> <p>A multilevel SLA is used when a provider is supplying different service performance levels to a series of customers using the same service.</p> <p>For example, a <a href="https://www.techtarget.com/searchcloudcomputing/definition/Software-as-a-Service">software-as-a-service</a> provider might deliver a package of basic services and support to all of its customers, but offer different price ranges for different service levels.</p></section> <section class="section main-article-chapter" data-menu-title="Components of SLAs"> <h2 class="section-title"><i class="icon" data-icon="1"></i>Components of SLAs</h2> <p>SLAs are legal contracts and should include some specific elements, such as the following.</p> <h3>Overview of the contract</h3> <p>This section discusses the basics of the agreement, including the parties involved and the date it will become effective, and gives a general introduction of the <a href="https://www.techtarget.com/searchitchannel/feature/Data-not-opinion-should-drive-MSP-best-practices">services that the provider will deliver</a>.</p> <h3>Product and service description</h3> <p>This section describes every service that the provider would potentially offer, along with performance completion dates and times, and delivery dates and times.</p> <p>The section also discusses the method of service delivery, availability of maintenance service, provider hours of operation and service locations, and a detailed list of all hardware, software and network services.</p> <h3>Exclusions</h3> <p>This section is a list of services that the provider does not offer. Discussing the services that are not available helps avoid confusion.</p> <h3>Service performance</h3> <p>This section discusses the specific performance metrics that both parties have agreed to, as well as the methods that will be used for monitoring and measuring them, and a description of unacceptable performance.</p> <h3>Penalties</h3> <p>This section spells out the compensation or payment that the customer will receive if a provider does not achieve SLA compliance.</p> <h3>All parties and stakeholders</h3> <p>This section defines the parties that are involved with the SLA as well as their responsibilities.</p> <h3>Provision of security</h3> <p><a href="https://www.techtarget.com/searchsecurity/news/366614215/Study-outlines-severe-security-issues-in-cloud-providers">Defining the security measures</a> that the provider must carry out is important for ensuring the continued operation of the contracted resources.</p> <p>This section might include details on specific agreements about <a href="https://www.techtarget.com/searchsecurity/definition/security">IT security</a> and nondisclosure agreements.</p> <h3>Disaster recovery and risk management</h3> <p>Outlining disaster recovery and <a href="https://www.techtarget.com/searchsecurity/tip/How-do-SLAs-factor-into-cloud-risk-management">risk management requirements</a> is also important for ensuring that the contracted services are not disrupted by an unplanned event.</p> <p>This section can discuss any <a href="https://www.techtarget.com/searchsecurity/definition/What-is-risk-management-and-why-is-it-important">risk management</a> activities that the provider will carry out as well as a technology disaster recovery plan.</p> <h3>Monitoring, tracking and reporting</h3> <p>This section defines the methods for monitoring service performance, as well as the mechanisms for tracking and reporting issues.</p> <p>It also identifies who will receive this information.</p> <h3>Testing, performance review, change processes and continuous improvement</h3> <p>The SLA should be regularly reviewed and improved in terms of quality, accuracy and legal language.</p> <p>This section should also include discussion of how <a href="https://www.techtarget.com/searchitoperations/tip/Get-familiar-with-these-SLA-maintenance-tips">changes to the SLA</a> should be carried out, including approved change management processes.</p> <h3>Agreement termination</h3> <p>The next-to-last part of an SLA should define the criteria for terminating the agreement or indicate an expiration date.</p> <p>Establishing a notice period for such activities can help avoid any confusion.</p> <h3>Authorized signatures</h3> <p>The final part of the SLA should consist of the signatures of all authorized parties and stakeholders.</p></section> <section class="section main-article-chapter" data-menu-title="12 best practices for SLA compliance"> <h2 class="section-title"><i class="icon" data-icon="1"></i>12 best practices for SLA compliance</h2> <p>Here are some best practices that CIOs and IT leaders should follow when creating an SLA <a href="https://www.computerweekly.com/microscope/news/366572012/MSPs-seen-as-answer-by-skill-strapped-customers">with a service provider</a>:</p> <ul class="default-list"> <li>Establish an understanding of the necessary elements to include in an SLA, including KPIs to track and SLA-business goal alignment.</li> <li>Establish measurable SLA performance metrics.</li> <li>Identify the parties that will be involved in the services provided for both the provider and the company receiving the services.</li> <li>Decide who will serve as the daily contact on both the provider's side and the side of the company receiving the services.</li> <li>Secure approval from the company's legal department for the SLA as well as any future updates.</li> <li>Add an indemnification provision to the agreement so that the company receiving the services is protected.</li> <li>Establish who is responsible for monitoring and analyzing performance to confirm SLA compliance.</li> <li>Establish a step-by-step procedure for reporting any SLA-related performance issues.</li> <li>Establish a step-by-step procedure for presenting any SLA compliance violations to the provider and negotiating penalties.</li> <li>Review and update SLA performance criteria when company operations change.</li> <li>Establish a process for reporting SLA performance to senior management and stakeholders.</li> <li>Set up a schedule of meetings for reviewing SLA performance. SLA performance discussion can be part of a <a href="https://www.informationweek.com/it-leadership/how-to-hold-productive-it-team-meetings">weekly IT staff meeting</a> or a separate meeting that specifically covers SLAs.</li> </ul> <p><i>Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.</i></p></section>
