Service Level Agreements (SLAs) define what each party owes; vendor management ensures suppliers meet their obligations. The worked example computes SLA breach penalties.
12.4 SLA and Vendor Management
SLA, OLA, UC - the contracts
Type
Between
Example
SLA
IT to business
99.95 % uptime for online banking
OLA
IT team to IT team
DB team responds in 15 min for SEV1
UC
IT to external supplier
Cloud provider 99.99 % VM SLA
A 99.9 % SLA to the business needs OLAs and UCs that sum to at least 99.9 % - usually higher to absorb operational reality.
What an SLA must contain
Section
Content
Service description
Scope + boundary
Availability target
Percent + measurement method
Response + resolution
By severity
Reporting cadence
Frequency + format
Penalties or credits
Per breach + cap
Exclusions
Force majeure, etc.
Review schedule
Annual or quarterly
Worked example - SLA breach penalty calculation
Item
Value
SLA target
99.95 % monthly uptime
Permitted downtime
~21.9 minutes / month
Actual outage
92 minutes
Excess
70.1 minutes
Penalty per excess minute
PHP 25,000 service credit
Cap
10 % of monthly fee
Raw penalty
70 x 25,000 = PHP 1,750,000
Cap applied
PHP 2,500,000 (10 % of 25m)
Credit due
PHP 1,750,000
Vendor lifecycle
Stage
Activity
Selection
RFP + due diligence + risk assessment
Onboarding
Contract + UC + security review + provisioning
Operation
Regular reviews; SLA scorecards
Renewal
Renegotiate; new SLAs; price adjustments
Exit
Data return + key destruction + transition support
Vendor risk dimensions
Dimension
Question
Financial
Can they stay in business?
Operational
Do they have BCP / DR?
Security
SOC 2 / ISO 27001; pen test results
Compliance
RA 10173 processor agreements
Concentration
How dependent are we on one vendor?
Geopolitical
Sanctions, sovereignty
Common pitfalls
Pitfall
Result
No measurement method
Both sides argue interpretation
Cap too low
Breach cheaper than performance
Single vendor critical service
No exit plan
Auto-renewal nobody tracks
Locked in another 3 years
Mentor’s tip: SLA = IT to business; OLA inside IT; UC out to supplier. Measurement method + penalty schedule + exit clause are the three sections most contracts get wrong. Track vendor risk on the same tier as the system the vendor supports.
Discussion
Loading…