What to Look For in a Managed IT Services SLA

When you buy managed IT services in Malaysia, the service level agreement (SLA) defines what you can hold the provider to. It turns the commitments in a proposal into service levels you can measure, report and enforce.

This guide sets out what a managed IT services SLA should define, the gaps that lead to disputes, and a checklist for reviewing any provider’s draft. If you are still comparing providers, our guide to what a managed services provider in Malaysia does covers the contract around the SLA.

What a Managed IT Services SLA Is

An SLA is the part of a managed services contract that sets measurable service levels, states how each is measured, and says what happens when one is missed. It sits beside the service catalogue, which lists what is provided, and the responsibility matrix, which says who does what. The SLA answers a different question: how fast, how well, and how you will know. A commitment that appears in a proposal but not in the SLA cannot be enforced as a service level.

Scope: What the SLA Covers and What It Excludes

Each service level should name the service it applies to, the assets, sites and users covered, and the hours it applies. Read the exclusions as carefully as the inclusions:

• End-of-life or unsupported equipment and software.
• Third-party applications and vendors, including faults the provider cannot fix itself but has agreed to manage on your behalf.
• Faults caused by changes made outside the provider’s change process.
• Time spent waiting for access, information or approval from your team.

Ask whether a service level still applies when the root cause sits with a third-party vendor that the provider manages for you.

Response Time vs Resolution Time

Response time is how soon a person starts work on an incident. Resolution time is how soon service is restored. A good SLA states both for every priority level, and four definitions decide whether the numbers mean anything:

1. Priority levels: How severity is assigned, by whom, and whether you can challenge the assignment.
2. Clock rules: When the clock starts (ticket logged or fault detected), what pauses it, and what stops it.
3. A response: A named person acting on the ticket. An automated acknowledgement does not count.
4. A resolution: Whether a workaround stops the resolution clock, and whether the underlying cause is then tracked as a problem record.

State the service hours and the holiday calendar that applies. Malaysian public holidays differ by state, so a service level written in business days needs a named calendar.

How Availability Is Measured in a Managed IT Services SLA

If the SLA includes an availability commitment, the percentage matters less than what sits behind it. Four things define it:

1. What is measured: The service as users experience it, or a single server, link or component.
2. Where it is measured from: Inside the provider’s network, or from the user’s side.
3. The measurement period: A month, a quarter or a year, and how the period resets.
4. Exclusions: Planned maintenance, who approves it, and how much notice you receive.

A commitment measured per component can be met while users cannot work. Ask who owns the monitoring data and whether you can see it.

Escalation Paths and Named Roles

An SLA should state who is contacted at each stage, in what order and by when:

1. Functional escalation: Handover to a specialist team when the first line cannot resolve the incident, with a time trigger written as an obligation.
2. Management escalation: The service delivery manager and senior contacts on each side, with triggers based on priority and elapsed time.
3. Major incident process: A named incident lead, a schedule for updates to your team, and a written post-incident review within an agreed period.
4. Vendor escalation: Who raises and chases cases with hardware and software vendors, and who holds the vendor support contracts.

Keep names, roles and numbers in a contact schedule with a review date.

Service Credits and Remedies

A service credit is an adjustment to the fee when a service level is missed. It signals a failure, but it does not compensate for the effect on your business, so read the terms around it:

1. Claim mechanism: Whether credits apply automatically or must be claimed, and by when.
2. Cap: A limit on total credits in a period, and which fee they are calculated on.
3. Sole remedy: Whether credits are your only remedy for a missed service level.
4. Repeated failure: A right to require a remediation plan, or to terminate, when the same service level is missed repeatedly.

Reporting and Measurement

A service level only exists if both sides can see the result. The SLA should state where the data comes from, what the monthly report contains, and who can check it:

1. Source of data: The provider’s tools, a shared tool or your own monitoring, and your right to see the raw records.
2. Report contents: Performance against each service level, incidents and problems with trends, each breach with its cause, and the actions agreed.
3. Service review: A scheduled meeting where both sides review results and agree changes, and a date to review the SLA itself when scope or volumes change.
4. Disputed measurements: A written process for resolving disagreement about what the data shows.

ISO/IEC 20000-1:2018, the international standard for IT service management published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), treats service level management and service reporting as defined processes. A provider certified to it should be able to show how it runs both.

Exit Terms and the SLA

Service levels should keep applying until the contract ends and the transition is complete. Check that the SLA states:

• The notice period and the transition period, with service levels applying throughout.
• Return of your data in an agreed format and within an agreed time.
• Handover of documentation, runbooks and configuration records.
• The transition assistance included, and how any further help is charged.
• That credits accrued before exit remain payable.
• The provider’s cooperation with your incoming provider.

Managed IT Services in Malaysia: Regulatory Points for the SLA

If you are regulated by Bank Negara Malaysia (BNM), its policy document on Outsourcing, in effect since 1 January 2019, sets expectations for financial institutions on due diligence of service providers and on service level agreements. Draft the SLA with your compliance team so that each requirement maps to a clause you can evidence.

For personal data, the Personal Data Protection Act 2010 (PDPA), as amended in 2024, has made data processors directly subject to its security principle since 1 April 2025. Data controllers have had to notify the Personal Data Protection Commissioner of personal data breaches since 1 June 2025. The SLA should therefore require the provider to tell you about any incident affecting personal data within a defined time, so you can meet your own obligation.

6 Common SLA Gaps That Cause Disputes

Managed IT Services SLA Checklist

• Services, assets, sites, users and service hours named for each service level
• Exclusions listed and specific, including third-party vendors
• Priority levels defined, with a way to challenge the assignment
• Response and resolution targets set for each priority level
• Clock start, stop and pause events written down
• Response defined as a named person acting on the ticket
• Treatment of workarounds and problem records stated
• Availability measure defined: what, where, measurement period and exclusions
• Holiday calendar named
• Functional, management and vendor escalation paths with named roles and time triggers
• Major incident process with a named lead and a post-incident review
• Service credit mechanism, cap, sole remedy and repeated-failure rights agreed
• Monthly report contents, data source and service review agreed, with a date to review the SLA
• Process for disputed measurements in place
• Exit terms keep service levels in force through transition, and cover return of data and documentation
• Incident notification time defined for personal data
• Regulatory requirements mapped to specific clauses, where you are regulated

How We Can Help

At Strateq, we have worked in enterprise IT in Malaysia for more than 40 years, and have been a system integrator since 1983.

Our Enterprise System Solutions and Enterprise Business Solutions units hold ISO/IEC 20000-1:2018 for IT service management, the standard that defines service level management and service reporting as processes.

In petrol retail, where we have operated since 1993, our service desk solution, SMART SD, includes service level management and measures turnaround time (TAT) and recovery time objectives (RTO) against the SLA.

For the managed services and IT service management that an SLA like this would cover, see our enterprise solutions and services.