Worked costings and choosing a provider
Managed security SLAs and contracts: response times, service credits and unfair terms
The SLA definitions, contract clauses and questions that decide what a managed security provider must actually do, plus service credits and Australian unfair contract terms rules.
A managed security contract is only as good as its definitions: what counts as an incident, what "response" means, which hours are covered, what the provider may do without asking, and what you get if it misses a target. The questions in this guide turn a sales promise ("15-minute response, 24/7") into contract terms you can rely on. For Australian small businesses, standard-form contracts are also covered by the unfair contract terms rules in the Australian Consumer Law, which since 9 November 2023 prohibit unfair terms and allow penalties, so one-sided clauses are worth challenging before you sign.
This guide supports the selection method and the due-diligence checklist. It is general information, not legal advice.
Response time: define each step
Providers often quote a single number. Ask which of these steps it measures:
| Step | Meaning | Why it matters |
|---|---|---|
| Detection | The platform raises an alert | Depends on tooling, not people |
| Acknowledgement | A person or system records that the alert has been seen | Easy to meet automatically |
| Triage | An analyst decides whether it is real and how serious | Where human cover is tested |
| Notification | You are told, by the channel agreed | Check after-hours phone escalation |
| Containment | The device is isolated or account disabled | What actually stops the damage |
| Resolution | The threat is removed and systems restored | Often outside the managed fee |
A typical priority table in a contract might look like this (illustrative):
| Priority | Example | Triage and notify within | Containment target |
|---|---|---|---|
| P1 Critical | Active ransomware, admin account compromise | 15–30 minutes | Within 1 hour, without prior approval |
| P2 High | Malware on one device, suspicious sign-in from overseas | 1 hour | Within 4 hours |
| P3 Medium | Policy violation, blocked attack | 8 business hours | Next business day |
| P4 Low | Informational | Monthly report | Not applicable |
Ask whether targets apply 24/7 or only in business hours, and in which time zone. A target that counts only "business hours" can stretch a Friday-night P2 into Monday.
Containment authority
The most important clause is often the one that says whether the provider can act without asking. Agree in writing:
- which actions it can take immediately (isolate a device, disable an account, block an IP address, reset sessions);
- which need your approval, and who can give it at 3 am;
- what happens if nobody answers within a set time;
- that you will not hold the provider liable for reasonable containment actions taken within those rules.
Service credits
Service credits compensate you when targets are missed. They are rarely large, but they show the provider takes the SLA seriously.
Illustrative example: monthly fee $3,000 ex GST. The contract gives a 5% credit for each missed P1 target, capped at 20% of the monthly fee. In a month with two missed P1 targets, the credit is 2 × 5% × $3,000 = $300. With five missed P1 targets, the cap applies: 20% × $3,000 = $600, not $750.
Credits do not make you whole after an incident. The more useful remedies are the right to terminate for repeated failures and clear reporting so you can see performance.
Clauses to read twice
| Clause | What to look for |
|---|---|
| Scope schedule | Every device and log source listed; what happens to new ones |
| Exclusions | Unsupported systems, shadow IT, third-party SaaS, "acts of the customer" |
| Liability cap | Often limited to fees paid in the last 12 months; consider whether that is proportionate |
| Price changes | Can the provider change the price during the term? Is there a renewal cap? See renewal uplift |
| Term and auto-renewal | Minimum term, notice period, and when you must give notice |
| Data location and access | Where logs are stored; offshore access; subcontractors |
| Breach notification by the provider | How quickly the provider tells you if its systems are compromised |
| Exit and transition | Return of data and configurations, removal of agents, handover support and fees |
| Suspension | When the provider can suspend service, for example for late payment |
Unfair contract terms: the small business protection
The unfair contract terms rules in the Australian Consumer Law apply to standard-form contracts with a small business, which since 9 November 2023 means a business with fewer than 100 employees or turnover under $10 million in its last income year. Since that date unfair terms are prohibited, not just void, and courts can impose penalties. For a company, the maximum is the greatest of $50 million, three times the benefit obtained, or, if the benefit cannot be determined, 30% of adjusted turnover during the breach period.
Terms that can be unfair include ones that let the provider vary the price or scope on its own, terminate at will while you are locked in, or limit its liability while yours is unlimited. Whether a term is unfair depends on the whole contract; the main subject matter and the upfront price are excluded from the test. If a provider will not negotiate a term you think is unfair, you can raise it with the ACCC or get help from the Australian Small Business and Family Enterprise Ombudsman.
Frequently asked questions
Are 99.9% uptime targets relevant for security services?
They apply to the provider's portal or platform. Response targets matter more. A platform that is "up" but unmonitored overnight does not protect you.
Can I negotiate a standard contract?
Often yes, especially scope, notice periods, renewal caps and exit terms. Ask early, in writing.
What liability cap is reasonable?
There is no standard answer. Consider the provider's insurance, the harm a failure could cause and your own insurance. Get legal advice for large contracts.
Who owns the configurations and logs?
Make sure the contract says you do, or that you receive them on exit in a usable format.
Sources
- Australian Competition and Consumer Commission — unfair contract terms guidance for small business
- Australian Small Business and Family Enterprise Ombudsman — help with disputes and contract issues
- Federal Register of Legislation — Competition and Consumer Act 2010, Schedule 2 (Australian Consumer Law)
- ASD's Australian Cyber Security Centre — guidance on managed service provider security
