Service level agreement (SLA)

An SLA is only as meaningful as its definitions. The core clause specifies a service level indicator, how it is measured, over which window and with which exclusions: for example monthly uptime percentage defined as the minutes in the calendar month minus downtime minutes, divided by total minutes, where downtime means consecutive minutes in which a stated share of requests fail, measured by the provider's own monitoring. Scheduled maintenance, force majeure, customer-caused faults, beta features and failures of third-party networks are typically excluded. Two SLAs with the same 99.9% headline can therefore differ greatly depending on whether a minute counts as down at 1% or at 100% errors, and whether measurement is per region, per instance or per account.

The nines translate into small budgets. 99.9% monthly allows about 43.8 minutes of downtime in an average month (43.2 minutes in a 30-day month) and about 8.8 hours per year; 99.95% about 22 minutes a month; 99.99% about 4.4 minutes a month or 52.6 minutes a year. Availability of serially dependent components multiplies, so two independent services at 99.9% each give roughly 99.8% for a request that needs both, which is why an SLA offered to one's own customers must be looser than the product of the SLAs one depends on, unless redundancy is added.

Remedies in cloud SLAs are usually service credits on a tiered scale as a percentage of the monthly fee, often requiring the customer to file a claim within a set period, capped at a proportion of the bill and stated as the sole and exclusive remedy. A credit therefore rarely compensates the actual business loss of an outage; the SLA allocates financial risk rather than guaranteeing reliability. Response and resolution times for support tickets by severity are a second common SLA category, distinct from availability.

In ITIL terms the SLA is the external agreement with a customer, supported internally by operational level agreements (OLAs) between internal teams and underpinning contracts with suppliers. In SRE practice the SLA is backed by a stricter internal SLO, so the team reacts to burn long before contractual penalties trigger. Regulation increasingly prescribes SLA content: under DORA (Regulation (EU) 2022/2554, applicable since 17 January 2025), Article 30(2)(e) requires ICT service contracts of financial entities to include service level descriptions, and Article 30(3)(a) requires full service level descriptions with precise quantitative and qualitative performance targets for services supporting critical or important functions, so the entity can monitor performance and act without undue delay when levels are missed.