A service level agreement, or SLA, is the part of an IT contract that puts support promises in numbers. Response time is how long until your provider acknowledges a ticket. Resolution time is how long until it is fixed. Priority tiers set different targets for each, and uptime guarantees cap the downtime you are owed.
Every IT support contract rests on one document that most buyers skim, the service level agreement. The SLA sets the promises your provider is willing to put in writing, from how fast they pick up a ticket to how much downtime they allow in a year. This guide explains what response time and resolution time actually mean, how priority tiers and uptime guarantees work, and which numbers to check before you sign. Every figure below comes from a named, current source, so you can judge a contract on evidence rather than sales language.
An SLA in IT support is the part of a contract that defines the service you are promised in measurable terms. It converts vague assurances such as "fast support" into specific numbers your provider agrees to hit, like a 15-minute response to a critical outage or a 99.9% uptime target. A complete IT support SLA covers three distinct promises, and confusing them is the most common contract mistake buyers make.
Read those three lines together, because a promise about one says nothing about the other two. A tight response target next to a silent or vague resolution target is a warning sign, not a strong contract.
The difference between response time and resolution time is what the clock measures. Response time counts the minutes from when you submit a ticket until a real person acknowledges it and begins work. Resolution time counts from ticket creation until the issue is fixed or a working workaround is in place. A fast response is the promise to show up, and a resolution is the promise to finish.
The distinction matters because a provider who commits only to response time is structurally rewarded for answering quickly and then stalling. The clock has already stopped, the ticket stays open, and nothing in the contract pushes them to close the loop. If an agreement names a response target but stays quiet on resolution, treat that gap as something to negotiate, not overlook (see this breakdown of response versus resolution). Good SLAs commit to both, and they measure compliance against each target separately, with mature service desks aiming for a 95% or higher SLA compliance rate.
SLA priority tiers rank incidents by business impact so the most damaging problems get the fastest promises. A company-wide outage or a security breach is not treated like one stuck printer, and the tier decides the target response and resolution time for each. Most IT support agreements use four levels, and typical business-hours response targets, per published ITSM benchmarks, look like the tiers below.
After-hours targets loosen but still exist, with critical issues typically set at 30 minutes and high-priority issues at two hours. Ask how each tier is defined in writing, because the definitions decide which clock your outage runs against.
Uptime guarantees cap how much downtime your provider will allow, expressed in nines. A 99.9% uptime SLA sounds nearly perfect, yet it still permits real hours of outage every year. The higher the guarantee, the less downtime you are contractually owed, and the jump from 99.9% to 99.99% is larger than it looks. The allowances below are simple arithmetic on a year of 8,760 hours.
An uptime number only means something when a response and resolution commitment sits behind it. A guarantee with no fast response target is a refund policy, not a support policy, because it pays you a small credit while your systems stay down.
Response time is a business number because downtime costs money by the minute, not by the ticket. The faster your provider engages a critical issue, the shorter the outage and the smaller the loss. For most mid-size and large organizations, even a single hour offline is expensive, which is exactly why the P1 response target belongs at the center of any SLA review.
Set those numbers next to a support contract and the math is direct. A 15-minute response on a critical outage instead of a two-hour response can be the difference between a contained incident and a five-figure loss. That is why buyers should weigh response and resolution targets as financial terms, not technical footnotes.
The SLA metrics worth tracking go beyond response time to measure whether issues actually get solved well. First contact resolution, mean time to resolve, and customer satisfaction reveal the quality behind the speed. A provider can hit every response target and still deliver weak support if tickets reopen or drag on for days.
Mean time to resolve tells the rest of the story. Industry-leading service desks now close their overall ticket load in under 15 hours on average, while teams without modern tooling average more than 30 hours for the same work, per the same 2026 help desk benchmarks. Customer satisfaction also shifts by channel, with live chat averaging about 87% satisfaction against 61% for email and 44% for phone. When you review an SLA, ask for reporting on all three metrics, not just the response clock, because they show whether the promised speed produces real fixes.
Security incidents make response time a survival metric, not a convenience. The longer a breach goes undetected and uncontained, the more it costs, which is why security response belongs in your SLA next to everyday support. Speed of containment is now one of the largest levers on the final price of a breach.
An everyday helpdesk SLA and a security response SLA are not the same promise. Confirm that your agreement names a fast response for security events, defines who is alerted, and states how an incident is escalated. A provider that treats a suspected breach with the same clock as a password reset is measuring the wrong thing.
To evaluate an IT support SLA, read past the headline uptime number and confirm the five terms that decide real-world service. Each one closes a gap that vague contracts leave open, and together they tell you whether the promised numbers will hold when something breaks. Tuminto builds these commitments into its IT support and helpdesk service, and every buyer should demand the same clarity from any provider.
An SLA is only as strong as the terms you can measure and enforce. When the numbers are specific, the definitions are written down, and the reporting is transparent, the agreement protects your business instead of the provider.
The SLA response clock measures elapsed time against your provider's agreed working hours, not raw wall-clock time. The timer usually starts the moment a ticket enters the system through any channel, then pauses outside defined business hours, weekends, and holidays unless your contract buys 24/7 coverage. That single rule changes what a number like "one-hour response" means, so it belongs in writing before you sign.
Two details decide how the count behaves. The measurement window sets which hours the clock runs, so a call logged at 4:55pm Friday and answered at 9:05am Monday is a 10-minute response on a business-hours SLA, not a three-day one. Channel-specific rules can also apply, where a phone call starts the clock immediately while an emailed or portal request waits for the next business hour, per published ITSM guidance on when the SLA clock starts. Ask whether targets are counted in business hours or calendar hours, because the same figure can describe very different service.
A realistic response time depends on the priority tier and the coverage you pay for, and the practical ranges are tighter than most sales language admits. For managed IT providers, response targets typically run from 15 minutes to four hours for critical incidents, one to two hours for high-priority issues, and four to eight business hours for standard requests. A target only holds when the provider has the staffing, redundancy, and tooling to reach it, so an achievable four-hour fix beats an unrealistic 15-minute promise the provider cannot keep.
Treat extreme guarantees with caution. A sub-5-minute response commitment is rare, and providers that offer one usually price it as a premium tier with dedicated staffing behind it. Match the tier to the cost of the systems it protects, and confirm the target is written against a specific priority level rather than quoted as one flat number.
IT providers use three types of SLAs, and knowing which one you are being offered tells you how much the terms are tailored to your business. A customer-level SLA covers all services for one specific customer, a service-level SLA sets one general standard applied to every customer of a given service, and a multilevel SLA layers terms for a tiered or multi-party arrangement. Named benchmark authorities describe these as the standard three categories in any breakdown of SLA metrics and types.
The distinction matters at signing. A service-level SLA on a shared support plan gives you the provider's standard response and resolution targets, while a customer-level or multilevel SLA can commit tighter numbers tied to your priority tiers and coverage window. If your operations cannot tolerate the standard tier, ask whether a customer-level agreement with negotiated targets is available before you accept the default.
Response time is how long until your provider acknowledges a ticket and a real person starts work on it. Resolution time is how long until the issue is fixed or a working workaround is in place. Response is the promise to show up, and resolution is the promise to finish. A strong SLA sets a target for both, because a fast acknowledgment means little if the fix drags on for days.
A good response time depends on the priority of the issue. Benchmarks target roughly 15 minutes for a critical, business-stopping outage during business hours, one hour for a high-priority issue, four business hours for a medium issue, and one business day for a low-priority request. After-hours targets for critical issues are usually 30 minutes or less. Judge a response time against the priority tier, not a single number.
A 99.9% uptime guarantee allows about 8.76 hours of downtime per year, or roughly 43.8 minutes per month. It sounds nearly perfect, but it still permits real outage time. Raising the guarantee to 99.99% cuts allowed downtime to about 52.6 minutes per year, and 99.999% allows about 5.26 minutes per year. Higher nines mean less downtime you are contractually owed.
Most SLAs include service credits, which refund a percentage of the monthly fee when the provider misses a committed target. The contract defines the missed metric, the credit amount, and how you claim it. Service credits are a shared-risk mechanism, not full compensation for a business loss, so read how they are measured and capped before you sign.
SLA priority levels rank incidents by business impact so the most damaging problems get the fastest promises. Most IT support agreements use four tiers, from critical or P1, which covers company-wide outages and security breaches, down to low or P4, which covers minor single-user requests. Each tier carries its own response and resolution targets.
SLA response time is usually measured against the provider's agreed working hours, not raw calendar time, unless your contract buys 24/7 coverage. The clock starts when your ticket enters the system and pauses outside business hours, weekends, and holidays. That is why a call logged at 4:55pm Friday and answered at 9:05am Monday counts as a 10-minute response on a business-hours SLA. Confirm in writing whether targets are counted in business hours or calendar hours, because the same number can describe very different service.
Average response targets for managed IT providers run from about 15 minutes to four hours for critical incidents, one to two hours for high-priority issues, and four to eight business hours for standard requests. The right number depends on the priority tier and the coverage window you pay for. Judge a quoted response time against the tier it applies to rather than treating one figure as the whole promise.
A sub-5-minute response guarantee is rare, and providers that offer one usually price it as a premium tier with dedicated staffing behind it. A target only means something when the provider has the staffing, redundancy, and tooling to hit it consistently, so an achievable four-hour commitment is worth more than an unrealistic five-minute promise. Match the tier and its cost to the value of the systems it protects.
The three types of SLAs are customer-level, service-level, and multilevel. A customer-level SLA covers all services for one specific customer, a service-level SLA sets one general standard applied to every customer of a given service, and a multilevel SLA layers terms for a tiered or multi-party arrangement. Knowing which type you are offered tells you how tailored the response and resolution targets are to your business.
Promises you can measure
We will review your current contract, flag the gaps in response and resolution terms, and show you what strong support looks like, with no obligation.
Book a Consultation