What is SLA (Service Level Agreement)?

Three different clocks go by the name SLA in security, and they are easy to mix up.

• The operational SLA is internal: how fast the SOC acknowledges, investigates, and contains alerts.
• The provider SLA is a contract with an MSSP or MDR vendor, with remedies when the vendor misses.
• The remediation SLA belongs to vulnerability management: how many days a team has to patch or mitigate a finding after it is reported.

Operational SLAs tier the clock by severity, because a confirmed C2 beacon and a single failed login do not carry the same urgency. An example structure, illustrative and not an industry standard:

• Critical: acknowledge within 15 minutes and start investigating within 30;
• High: acknowledge within 1 hour and investigate within 4;
• Medium: acknowledge within 4 hours and investigate within 8;
• Low: acknowledge within 24 hours.

Some teams add a separate time-to-contain target for confirmed incidents, since a fast acknowledgment means little if containment still takes hours.

Compliance is the share of items that met the target in a period, per severity: incidents within target divided by incidents in scope, times 100. If 40 High incidents were opened in September and 34 were acknowledged within the hour, High compliance is 85%. Two rules keep the number honest.

1. Count incidents still open past their target as breaches, or a growing backlog will make the percentage look better.
2. And report the breach count and the median time next to the percentage, because 85% of 40 and 85% of 4,000 are different problems.

Microsoft Sentinel keeps the timestamps you need in the SecurityIncident table, which gets a new row every time an incident is created or updated. Microsoft's own triage-time example subtracts CreatedTime from FirstModifiedTime. That holds until an automation rule touches incidents on creation, by adding a tag or assigning a queue owner, and then every incident looks acknowledged within seconds; the ModifiedBy column shows who made each change.

The query below treats acknowledgment as the first record where the status left New or an owner was assigned, and takes that record's LastModifiedTime, which Microsoft documents as the time of the modification the record describes. If an automation rule assigns owners, drop the owner condition and rely on the status change. Sentinel incidents have four severities (High, Medium, Low, Informational), so the targets reuse the example's High, Medium, and Low values, over the last 30 days:

let targets = datatable(Severity: string, AckTarget: timespan) ['High', 1h, 'Medium', 4h, 'Low', 24h, 'Informational', 24h];
let acks = SecurityIncident
| where TimeGenerated > ago(30d)
| where Status != 'New' or isnotempty(tostring(Owner.assignedTo))
| summarize AckTime = min(LastModifiedTime) by IncidentNumber;
SecurityIncident
| where TimeGenerated > ago(30d)
| summarize arg_max(TimeGenerated, *) by IncidentNumber
| where CreatedTime > ago(30d)
| join kind=leftouter acks on IncidentNumber
| extend AckDelay = coalesce(AckTime, now()) - CreatedTime
| lookup kind=inner targets on Severity
| summarize Incidents = count(), Met = countif(AckDelay <= AckTarget), MedianAckMin = round(percentile(AckDelay / 1m, 50), 1) by Severity
| extend CompliancePct = round(100.0 * Met / Incidents, 1)
| order by CompliancePct asc

An incident nobody has touched counts as a breach once its age passes the target, so for month-end reporting run the query after the window closes. The lowest CompliancePct sorts first, and that row is where to look for a noisy rule flooding one severity or a shift with too few analysts.

Provider SLAs are contract terms. NIST describes a service level agreement as a commitment between a provider and its customers that covers responsibilities, the type of service, expected performance such as reliability and response times, and requirements for reporting, resolution, and termination. In an MSSP or MDR contract, read five clauses before the response-time table.

1. What starts the clock: log ingestion, alert creation, or the moment the provider's analyst triages.
2. What counts as a response: an email, a phone call, or a containment action taken on your behalf.
3. Who sets severity, since a provider that classifies its own alerts decides which clock applies.
4. Which exclusions apply, for example a log source that stops sending from your side.
5. And what you get when they miss: service credits, a right to terminate, or nothing.

Ask for raw incident timestamps in the monthly report so you can recompute compliance yourself.

Remediation SLAs set patch deadlines, and the best-known public example changed in 2026. From November 2021 until CISA revoked it on June 10, 2026, Binding Operational Directive 22-01 gave US federal executive branch agencies two weeks to remediate vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalog, or six months for CVEs assigned before 2021.

Its replacement, BOD 26-04, sets the deadline from four questions:

1. is the asset publicly exposed,
2. is the CVE in the KEV,
3. can an adversary automate the exploit,
4. and does it give total or partial control of the asset.

The answers map to 3, 14, or 60 calendar days, or a fix at the next scheduled upgrade for the lowest-risk cases. The fastest tier is three days plus a forensic triage to check whether the asset is already compromised; an exposed, KEV-listed, automatable flaw that gives total control lands there. The clock starts when CISA adds the CVE to the KEV or when the agency finds it on an asset and records it in the CDM dashboard, whichever comes first.

The directive binds only federal agencies, but CISA publishes the KEV status, automatability, and technical impact of every CVE through its Vulnrichment program, so any team can adopt the table as a ready-made clock. A SOC that sees exploitation attempts against a KEV-listed CVE can check whether the target asset missed its deadline, which changes how urgent the alert is.

SLAs also shape how work moves through a shift. A queue sorted by arrival time is efficient for throughput and wrong for risk: a Critical alert that arrived five minutes ago should jump ahead of a Medium alert that arrived twenty minutes ago. Mature SOCs build the severity and elapsed-time weighting into the ticketing queue's sort order, so the item closest to breach surfaces first without each analyst doing that math under pressure.