SLA stands for Service Level Agreement: a contract between a service provider and a customer that sets out the service level owed, how it is measured, and what happens when it is missed. Unlike a general statement of intent, an SLA has numbers in it, and those numbers carry a consequence.
SLA, SLO and SLI
These three get used interchangeably and mean different things. Getting them straight matters when you negotiate, because a provider can hit every SLA while the service still feels unreliable to you.
| Term | What it is | Example |
|---|---|---|
| SLI (indicator) | The raw measurement. | Successful requests as a share of all requests |
| SLO (objective) | The internal target for that measurement. No contractual force. | 99.95% of requests succeed each month |
| SLA (agreement) | The contractual promise, usually set below the SLO, plus the remedy. | 99.9% or you receive service credits |
The gap between the SLO and the SLA is deliberate. A provider that promises exactly what it targets has left itself no margin, so treat an SLA identical to the advertised SLO as a warning rather than a selling point.
What an SLA needs to say about security
Availability is the clause everyone reads. The clauses that matter for your own compliance are usually further down, and they are the ones an auditor asks to see when your supplier handles personal or business-critical data.
| Clause | What to require |
|---|---|
| Breach notification | A fixed window in hours, not "without undue delay". Your own 72-hour clock starts once you know, so the later your supplier tells you, the less of it you have left. |
| Audit and evidence rights | The right to request an ISO 27001 certificate or SOC 2 report, and what happens if it lapses. |
| Subprocessors | Notice before a new one is added, and a right to object. |
| Recovery targets | RTO and RPO as numbers, so continuity claims are testable. |
| Exit | Data return format, deletion deadline, and assistance during migration. |
Where SLAs meet ISO 27001
Supplier agreements are covered by Annex A 5.20, addressing information security within supplier agreements, sitting under A.5.19 for supplier relationships generally. A.5.22 then expects you to monitor and review what the supplier actually delivers.
That last one is where most organisations fall short. Signing a strong SLA is evidence of a control being designed; showing that you read the reports and acted on a breach of it is evidence of the control operating, which is what an auditor tests.
Common mistakes
The most common is treating service credits as a remedy. A credit worth a few percent of one month's fee does not cover a day of downtime, so it prices the provider's risk rather than protecting yours. Read it as a signal of confidence, not compensation.
Next is measuring nothing. If nobody compares the monthly report against the agreed target, the SLA is a filing-cabinet document, and you will discover it during an incident rather than before one.
Last is the uptime definition itself. Check whether planned maintenance is excluded, how a partial outage is counted, and who does the measuring. A 99.9% promise that excludes maintenance windows and only counts total failures can coexist with a service you cannot rely on.