A 12-clause self-check that separates accountable managed IT from vague support promises. Each clause carries sample wording you can lift straight into a renewal, plus the red flag that signals trouble. Built for owners, COOs, property managers, and IT leads who do not want to argue ownership in the middle of an incident.
12 SLA clauses worth fighting for
Severity tiers, acknowledgement, resolution, exclusions, onsite cadence, escalation, backup testing, patching, account management, change, data ownership, off-boarding.
Sample wording per clause
Drafting language calibrated for Kenyan multi-site operations — drop into the contract redline rather than re-draft from scratch.
Red flags to spot in vendor drafts
"Reasonable time", "best effort", "as needed" — the phrases that mean nothing inside an incident. Flagged per clause so you catch them on first read.
Five-question SLA strength score
Score acknowledgement, exclusions, restore testing, onsite cadence, and escalation ownership directly on this page.
How to use it with a vendor
A 4-step rhythm: score → mark up → drafting request → re-score on signing, with a 90-day review trigger on anything still amber.
What you get
A checklist for separating real managed IT accountability from vague support promises.
Web version
/resources/managed-it-sla-checklistFiles delivered
No download required — use the complete resource on this page.
Next action
Use the resource, then review the related service path: /services/it-audits.
This is ungated on purpose. Use it directly in the browser, then turn the result into an internal action plan.
The 12 clauses
The sample wording is calibrated for Kenyan multi-site operations and aligns to the way 912 runs managed engagements. Lift it directly into the renewal redline; the red flag tells you what a vendor draft is hiding when the clause is missing or vague.
Sample wording
"Severity 1 is a production outage affecting all users; Severity 2 is a partial outage or a critical function impaired; Severity 3 is a single-user or non-blocking incident; Severity 4 is a request."
Red flag
A single response window for all incidents — no tier, no urgency, no priority.
Sample wording
"Severity 1 acknowledged within 15 minutes 24x7; Severity 2 within 1 business hour; Severity 3 within 4 business hours; Severity 4 within 1 business day."
Red flag
"We will respond within reasonable time" — unenforceable.
Sample wording
"Severity 1 target resolution 4 hours; Severity 2 same business day; Severity 3 next business day; Severity 4 within 5 business days. Where vendor or upstream carrier action is required, the clock pauses against documented evidence."
Red flag
Resolution times conflated with acknowledgement times.
Sample wording
"This SLA covers the network, endpoint, server, and identity stack as enumerated in Schedule A. It excludes line-of-business applications X and Y, third-party SaaS subscriptions, and ISP carrier issues."
Red flag
"Excluding force majeure and third-party services" with no list.
Sample wording
"One scheduled onsite visit per calendar month per site, minimum 4 hours. Additional onsite visits triggered by Severity 1 or by mutual agreement, billed at the documented rate when outside scope."
Red flag
"As needed" or "on request" with no minimum cadence and no rate sheet.
Sample wording
"Tier 1 handled by service desk; Tier 2 by infrastructure lead; Tier 3 by named senior engineer; commercial escalation to account director. Names, emails, and phones in Schedule B, updated quarterly."
Red flag
Shared support inbox only, with no named human and no escalation path.
Sample wording
"Vendor performs one restore drill per protected workload per quarter, captures RTO and RPO, and lodges the evidence in the shared restore register. Reviewed at the quarterly governance meeting."
Red flag
Backup status report included; no restore proof required.
Sample wording
"Endpoint and server patches deployed within 14 days of vendor release; firewall and switch firmware reviewed quarterly; emergency CVEs handled out-of-cycle on the agreed change window."
Red flag
"Best-effort patching" with no window and no CVE response clause.
Sample wording
"Monthly service review summarising tickets opened, closed, and trending; quarterly business review covering roadmap, risk register, and budget. Agenda templates in Schedule C."
Red flag
No review cadence — vendor only appears when something breaks.
Sample wording
"Standard changes scheduled into the agreed monthly window; normal changes require 5 business days notice and a written rollback plan; emergency changes follow Section 6 with post-implementation review within 48 hours."
Red flag
Changes performed silently; no documented window; no rollback discipline.
Sample wording
"Client owns all configuration documentation, secrets, certificates, and operational data produced during the engagement. Credential vault is jointly accessible; emergency break-glass account documented in Schedule D."
Red flag
Vendor holds sole access to backups, vaults, or DNS — no break-glass path.
Sample wording
"On termination, vendor delivers a written handover pack within 15 business days covering credentials, network diagrams, runbooks, and open tickets, and remains available for transition support at the documented day rate for up to 30 days."
Red flag
"30-day notice and we hand over what we can" — no defined deliverables, no transition window.
Working rhythm
Score your current SLA against the 12 clauses before the next renewal date.
Mark each clause green (present and specific), amber (present but vague), or red (missing).
Bring the amber and red rows into the vendor renewal conversation as drafting requests — not feedback.
Re-score on signing. Anything still amber gets a 90-day review trigger.
Ready to talk about this in context for your business?
Schedule a strategy callBook a free 30-minute discovery call. We map your stack, identify duplicate spend, and propose a fixed-price One Contract plan within 5 business days.