What is SLA?

A typical SOC SLA tiers response time by severity, because a critical alert (active ransomware, confirmed C2) and a low-severity alert (a single failed login) do not carry the same urgency. A common structure: Critical, acknowledge within 15 minutes and reach initial investigation within 30 minutes; High, acknowledge within 1 hour and investigate within 4 hours; Medium, acknowledge within 4 hours and investigate within 8 hours; Low, acknowledge within 24 hours. Some organizations add a separate time-to-contain metric for confirmed incidents, since acknowledging an alert quickly means little if containment still takes hours.

SLAs are enforced mechanically, not on trust. Ticketing and SOAR platforms stamp the alert-creation time, the acknowledgment time, and each subsequent status change, then calculate elapsed time automatically. Dashboards surface compliance in real time so a shift lead can see which open alerts are approaching breach before they actually breach, and can reassign or escalate proactively. When a breach does happen, the postmortem asks why: understaffing during a specific shift window, a spike in alert volume from a noisy detection rule, a skill gap on a particular alert type, or a tooling failure that delayed triage.

For managed security service providers (MSSPs) and MDR vendors, SLAs are contractual line items with financial penalties attached to breaches, and monthly or quarterly reports to the client demonstrate compliance percentages. Internally, SLA compliance sits alongside false-positive rate and mean-time-to-contain as one of the primary KPIs used to evaluate SOC health, staffing adequacy, and detection-content quality. A SOC that consistently misses SLA on a specific alert type usually has a detection-tuning problem, not just a staffing problem, since well-tuned alerts triage faster.

SLAs also shape how work is distributed across a shift. A queue where every alert is weighted equally leads analysts to work tickets in arrival order, which is efficient for throughput but wrong for risk: a Critical alert that arrived five minutes ago should jump ahead of a Medium alert that arrived twenty minutes ago. Mature SOCs build the severity-and-elapsed-time weighting directly into the ticketing queue's sort order so the highest-risk, closest-to-breach item always surfaces first, rather than relying on each analyst to do that math manually under pressure.