The Tuesday Test: Reading a Service Level Agreement as a Continuity Document

It is a Tuesday, a little after ten. The finance system will not authenticate. Half the team is locked out, the month-end close is two days away and the supplier's status page says "investigating". Someone asks the reasonable question: what did we actually buy?

The contract says 99.9%. That number, it turns out, answers almost nothing. It does not say who will call you, how quickly a restore will begin, whether yesterday's data exists, or what happens if the outage runs into a third day. Service level agreements are usually written to define a remedy for the supplier; buyers need them to define a recovery for the business. Those are not the same document, and the gap between them is where continuity is lost.

The percentage is the least interesting number in the contract

The arithmetic is worth doing once, slowly. A 99.9% monthly availability commitment permits roughly 43 minutes of unplanned downtime. Over a year, on an annual measure, it allows around eight hours and forty-five minutes. At 99.5% the monthly allowance rises to about three hours and forty minutes. None of these figures is unreasonable in itself; the problem is that the measurement period, the exclusions and the definition of "available" are frequently drafted so that almost nothing counts.

Look for three things. First, whether the calculation is monthly or annual — an annual measure lets a supplier absorb a dreadful quarter and still report compliance. Second, whether planned maintenance is excluded entirely and, if so, what notice applies. Third, whether degradation counts: a service that responds in forty seconds rather than two may be technically up while being commercially unusable.

Credits are a discount, not a remedy

Service credits are the standard remedy and are almost always capped at a modest percentage of monthly fees. If your team loses three days of invoicing capacity, a credit of ten per cent of one month's subscription is not compensation — it is a small discount on a service that failed. There is nothing improper about that, but it should be understood before signature rather than discovered during an incident.

Where the operation genuinely depends on the system, the conversation should move beyond credits to remedies that matter: a right to terminate for repeated failures, a defined threshold of cumulative downtime that triggers escalation, or a service improvement plan with dates attached.

Support: severity definitions hide the real terms

Most disputes about support are arguments about categories. A supplier's definition of a priority one incident may require that no user anywhere can access the service, which excludes the case where your entire finance function is locked out but others are fine.

Read the severity table as though you were writing the incident yourself. Ask whether response times are commitments or targets, whether they run in business hours or around the clock, and whether restoration or merely acknowledgement is promised. A four-hour response that consists of an automated ticket reference is not a support commitment in any meaningful sense.

Ensure the agreement names an escalation path with roles rather than a generic support address, and that you hold a named contact for major incidents. During a serious outage, the difference between a queue and a telephone number is measured in hours.

Recovery objectives need evidence, not intentions

Recovery time objective and recovery point objective sound technical, but they translate simply. The first asks how long the business can operate without the system; the second asks how much data it can afford to lose. Write down your own answers first — a warehouse operation may tolerate two hours and fifteen minutes of lost transactions; a payroll run in the week before payday may tolerate almost none.

Then ask the supplier for their own documented figures, and for evidence. When was a full restore last tested, and can they share the outcome? How frequently are backups taken, where are they held, and are they encrypted and immutable against ransomware? Is restoration performed by the supplier or delegated to a cloud provider whose terms you have never seen? A backup that has never been restored is a hope, not a control.

It is also worth clarifying what sits outside the service. If integration, single sign-on or a third-party data feed fails, the SLA may not apply at all, even though the business impact is identical.

Communication during an incident

Specify a cadence. A commitment to publish an update every sixty minutes during a priority one incident, with a plain-language statement of impact and the next review time, costs the supplier little and transforms the experience of an outage. Ask also for a post-incident report within five working days, covering cause, timeline and remedial actions with owners.

Exit rights and the awkward questions

Continuity planning includes the possibility that the relationship ends badly. Check the notice period, the format in which your data can be exported, whether transition assistance is included and at what cost, and whether source code or configuration escrow exists for any bespoke element. If the supplier is acquired, is the contract assignable without consent? If they become insolvent, what practical route exists to your data? These questions are uncomfortable at the buying stage and considerably worse at the renewal stage.

Four exercises to run before renewal

1. Tabletop the outage. Gather the system owner, finance and operations, and walk through a three-day failure using only the contract as your reference. Note every question the contract cannot answer.
2. Request the incident log. Ask for the previous twelve months of priority one and two incidents, with durations. A supplier unwilling to share aggregated figures is telling you something.
3. Demand a restore test. Not a description of the backup schedule, but evidence of a restoration performed and timed.
4. Test the escalation route. Ring the number on a quiet afternoon with a non-urgent query and see where it leads.

A renewal checklist

Confirm the measurement period, the exclusions and the definition of availability. Record your own recovery objectives and match them against the supplier's evidence. Verify severity definitions against realistic failure modes. Name escalation contacts. Secure an incident communication cadence and post-incident reporting. Confirm export formats, transition assistance and termination triggers. Diarise the next test twelve months out.

Uptime is a marketing figure. Continuity is a set of commitments that hold when the status page is red and the month-end clock is running. Buyers who read the agreement that way tend to have duller Tuesdays.