Service-Level Agreements in Business Continuity Management

by Andrew Hiles, FBCI

Any support service, whether in-house, contracted or outsourced, stands to be accused of being insensitive to the requirements of its customers (or users) and of providing inadequate service. Equally customers of a support service may have unrealistic expectations of what can be reasonably provided by it. To overcome these gulfs support services are increasingly turning to Service Level Agreements. However, during the most crucial time for any business - recovering from as disaster - neither customer or recovery service supplier is usually protected by a Service Level Agreement.

A Service Level Agreement (SLA) is simply an agreement between the support service and the user quantifying the minimum acceptable service to the user. SLAs are particularly valuable in time - critical processing - which certainly includes recovery. They may be complex and lengthy or simple one-page documents - but they are frequently seen as indispensable to providing good service and sound relationships between vendor and customer.

A complete SLA covers:

• Purpose of SLA;
• Service hours and scheduled service outages;
• Service description;
• Responsibilities;
• Support hours and a definition of what is and what is not covered by "support";
• Service levels for each service product
• Service level for varying time regimes (e.g. evenings, overnight, weekends, public holidays)
• Peak period details;
• Charging (if appropriate);
• Security requirements;
• Impact of loss of service;
• Output requirements;
• Change control;
• Customer support and help desk facilities;
• Service level reporting;
• Contacts - both in the user area and within the support service area.

Key service level indicators can be defined by application and these may include:

• Availability;
• Response time;
• Reliability (including First Time Fix);
• Deliverables.

Most contracts for recovery sites and recovery services are brief and SLAs are rarely offered - although vendors are usually willing to negotiate one. Typically, a vendor contract for a recovery site will only offer "access" to equipment. Many contracts we have seen quote a day rate for "support" without specifying whether this is 24/365 or defining what support means. They rarely specify commitments in the event of the facility being fully occupied when another customer invokes.

Vendors usually rise to the challenge and pull all the stops out to support their clients _ but the lack of SLAs exposes both vendors to unreasonable demands and customers to recovery failure.

Would it not be safer for all parties to spell out in a little more detail what the required service comprises and what its quality should be? Or are customers content to rely on vendor goodwill, and vendors to simply hope that unrealistic customer expectations will not lead to litigation?

Copyright Andrew Hiles, Kingswell, 2000. Andrew Hiles is author of The Complete Guide to I.T. Service Level Agreements: Matching Service Quality to Business Needs; Business Continuity: Best Practices; and, Service Level Agreements: Winning a Competitive Edge for Support and Supply Services, and several other titles published by Rothstein Associates Inc.

home