Designing Your SLAs
Last updated
Commit to response, target resolution
The most important structural decision in an SLA: contractually commit to response times, and treat resolution times as targets, not guarantees. You control how fast a technician engages a ticket. You do not control how fast Microsoft restores a tenant, how fast a hardware vendor ships a part, or how deep the root cause turns out to be. Guaranteeing resolution means guaranteeing the behavior of vendors and problems you don't own.
The clean way to draw the line: response commitments are contractual terms; resolution times are published objectives – closer to an SLO – that you report on honestly but don't guarantee. Clients accept this readily when you explain the reasoning, and it keeps a slow vendor from becoming your breach of contract.
The priority matrix
Priority is a function of impact × urgency – how many people are affected, and how badly. The standard four-level matrix:
| Priority | Definition | Typical examples |
|---|---|---|
| P1 – Critical | Site down or active security incident; all users affected | Office-wide outage, server down, ransomware or active breach |
| P2 – High | Major function down or many users impacted | Line-of-business app degraded, a department offline |
| P3 – Medium | Single user impacted; workaround exists | One user's application failing, non-critical device down |
| P4 – Low | Minor issue or routine request | How-to question, new-user setup, cosmetic problem |
One rule that saves you: the MSP assigns final priority per the matrix, not the client. Every caller believes their issue is critical; the matrix is what lets you say "this is a P3" without it being personal. The matrix itself belongs in the SLA attachment to your MSA, where it can be revised without reopening legal terms.
Realistic targets for a small shop
Typical business-hours (8×5) numbers a small MSP can actually sustain, as of 2026:
| Priority | Response commitment | Resolution target (not guaranteed) |
|---|---|---|
| P1 | 30–60 minutes | ≤4 hours |
| P2 | 2 hours | ≤8 hours |
| P3 | 4–8 business hours | 24–72 hours |
| P4 | Next business day | 24–72 hours |
Shops running genuine 24/7 operations typically tighten P1 response to 15–30 minutes.
Set numbers you can hit at your worst staffing week – one tech on vacation, another out sick – not your best. A conservative SLA you beat consistently builds more trust than an aggressive one you miss.
Business hours vs 24/7
The common pattern: P1 and P2 covered 24×7 via an on-call rotation; P3 and P4 handled 8×5. That gives clients the assurance that a real emergency gets answered at 2 a.m. without pretending you staff a night shift.
A 1–3 person shop should sell business-hours SLAs with an emergency line, and price genuine 24/7 coverage as a premium tier. Real around-the-clock coverage requires roughly four or more technicians or an outsourced NOC – promise it with two people and one bad on-call month burns them both out. If a prospect genuinely needs 24/7, that's a pricing conversation, not a free checkbox.
Service credits as the sole remedy
The typical remedy for an SLA miss is a service credit of 5–20% of the monthly fee, scaled by severity and by repeat misses, and applied automatically – not "upon request," which quietly punishes clients for not auditing you.
Two pieces of language do the real work:
- Credits are the sole and exclusive remedy for SLA misses. This is what stops a missed response time from escalating into a damages claim. Without it, the credit schedule is a floor, not a ceiling.
- Penalties must be in the contract to be enforceable. An SLA that lives in a sales deck binds no one.
Many small MSPs skip credits entirely in the early years. The modern view is that a modest automatic credit signals accountability and works as a sales asset – prospects notice when you put money behind your numbers, and the sole-remedy language means the downside is bounded and known.
Measure attainment in the PSA
An SLA you don't measure is marketing copy. Configure the priority matrix and SLA clocks in your PSA so attainment is tracked per ticket:
- Pause the clock on "Waiting on Customer." Time spent waiting for a client to reply is not your response time; without pause states your numbers are fiction in both directions.
- Report attainment against the SLA per priority – "97% of P1s responded to within target" – rather than a single blended average, which hides exactly the misses that matter. For overall first response, under one hour during business hours is a commonly targeted number as of 2026.
- Report it in QBRs. SLA attainment is one of the few operational numbers clients actually understand; showing it quarterly in your QBR turns the SLA from a liability into proof of performance.
None of this works without ticket discipline underneath – accurate priorities, honest statuses, clocks that reflect reality. That's the ticket management process.
Why overcommitting kills small MSPs
Aggressive SLAs are the classic deal-closing temptation: a prospect hesitates, so you promise 15-minute response on everything. Here's what that costs a small shop:
- Every ticket becomes an interrupt. If everything must be touched in minutes, no one can do focused project work, documentation, or automation – the activities that actually reduce ticket volume.
- On-call falls on too few shoulders. Tight commitments across a 1–3 person team mean someone is always tethered to a phone. That's how you lose your first good technician.
- Misses compound. Missed commitments mean credits, awkward QBRs, and a client relationship anchored to a number you can never sustainably hit.
You don't win against a larger competitor by matching a response promise you can't staff. You win by publishing honest numbers and beating them every quarter.
Bottom line
Commit to response, target resolution. Use a four-level priority matrix that you – not the client – apply. Publish business-hours numbers you can hit in your worst week, cover P1/P2 with an on-call line, and sell true 24/7 as a premium tier only when you have the staff. Offer a modest automatic service credit and make it the sole and exclusive remedy. Measure attainment in the PSA with paused waiting states, and show the numbers at every QBR. Revisit the SLA attachment annually – it's an attachment precisely so you can.