What to put in an IT SLA: a buyer's guide for UAE companies

The sections every IT SLA needs

Section	What it should say	Weak version to avoid
Priority definitions	P1 to P4 by business impact, with examples	"Urgent" and "normal", undefined
Response target	Hours until an engineer is working on it, per priority	"Acknowledged within 15 minutes" by auto-reply
Resolution target	Hours or days to fix or workaround, per priority	Not stated, or "best effort"
Hours of cover	When the clock runs, per priority; how out-of-hours is agreed	Silent, so disputes start on Friday evening
Channels	Phone, email, portal; which to use for P1	One shared mailbox
Escalation	Named people and timings at each level	"Contact your account manager"
Measurement and reporting	Monthly report against each target, with the raw list	No report, or a summary with no detail
Remedies	Service credits and a right to terminate on repeated misses	No consequence
Exclusions	Listed clearly, with how excluded work is charged	Vague "reasonable use" wording
Customer obligations	Access, contacts, approvals, supported hardware	Not listed, then used as excuses

Priority definitions that work

Priority	Definition	Examples
P1 Critical	Business stopped at a site or for a core system	Internet down at a site, ERP down, ransomware suspected
P2 High	A team or key person cannot work; no workaround	Finance cannot reach the bank portal on payment day
P3 Normal	One user affected, or a workaround exists	One laptop slow, a printer offline with another nearby
P4 Request	Planned change or question	New starter, access change, software install

Agree the actual hours for each target with your provider based on your business. What matters is that they are written, measured and reported.

Measurement: where SLAs quietly fail

• When does the clock start? When you raise the request by any agreed channel, not when the provider triages it.
• When does it pause? Only when waiting on you, and the pause should be visible in the report.
• What counts as resolved? Confirmed with the user, or auto-closed after a stated period without reply.
• Reopened tickets should count against the original target, not start a new clock.
• Raw data: ask for the ticket list behind the monthly percentages, so you can check it.

Remedies

• Service credits as a percentage of the monthly fee when a target is missed beyond a threshold.
• A service review meeting after any P1 incident, with a written root cause.
• A right to terminate without penalty after repeated misses over consecutive months.

Beyond tickets: other service levels to include

• Security: patching windows, how quickly the provider tells you about a security event it sees.
• Backup: backup success monitoring and how often restores are tested.
• Onboarding and offboarding: how far ahead you request a new starter, and how fast access is removed for a leaver.
• Onsite attendance: how quickly an engineer can be on site for a P1, per location.
• Reporting and reviews: monthly report and quarterly review dates.

Sample wording you can ask for

• "Response means a qualified engineer has started work on the request and contacted the requester."
• "The Provider will report monthly on performance against each target, and will supply the underlying ticket list on request."
• "If the Provider misses the P1 response or resolution target in any two months within a rolling six months, the Customer may terminate without penalty on 30 days' notice."
• "On termination, the Provider will hand over all documentation, credentials and administrative access, and cooperate with the incoming provider for the transition period."

This is a starting point, not legal advice; have your contract reviewed. The wider contract clauses are covered in the AMC vs managed services contract guide.

Where Missan helps

We have written and worked to IT SLAs in the UAE for 22+ years. Our contracts state response and resolution targets per priority, support runs during business hours, with agreed out-of-hours cover, and you get a monthly report. Many clients have been with us for more than a decade. See managed IT services or IT AMC contracts.

Related Missan services

• Managed IT services
• IT AMC contracts
• Emergency IT support
• How Missan client support works

Frequently asked questions

What is the difference between response time and resolution time?

Response time is how long until an engineer is actively working on your issue. Resolution time is how long until it is fixed or a working workaround is in place. A good SLA states both for each priority level, and defines response as human work starting, not an automatic acknowledgement.

What hours should an IT SLA cover?

State the hours the SLA clock runs for each priority. Most businesses need business-hours cover for everyday issues and agreed out-of-hours cover for critical systems. Write down how out-of-hours cover is requested and charged.

What are service credits?

A reduction in the fee when the provider misses SLA targets beyond an agreed threshold. Credits matter less for the money than for the signal: they force the provider to measure and report honestly. Pair them with a right to terminate after repeated misses.

Who decides the priority of a ticket?

The SLA should define each priority by business impact, with examples, and allow you to raise a priority when the impact is higher than it looks. Disputes should go to a named escalation contact.

Does Missan put SLAs in writing?

Yes. Our managed IT and AMC contracts include written response and resolution targets per priority, the hours they apply, monthly reporting and an escalation path.

This guide is general information for planning, not legal or tax advice. Regulations and deadlines change; confirm the current position with the official source linked in the text and with your own advisers. Last reviewed 28/10/2026.