SLA Breach
Definition
An instance where a required action was not completed before its SLA timer expired. Each breach is recorded against the incident ticket and reported in operational reviews. Repeated breaches in the same category indicate a systemic process or staffing problem.
- Trigger
- Required action not completed before the SLA timer expires
- Recorded against
- The incident ticket
- Reviewed in
- Operational reviews
- Repeated pattern signals
- A systemic process or staffing problem
Common questions
What is the difference between a delay and a breach?+
A delay can still occur while the SLA timer is running and the action is completed on time, while a breach specifically means the timer expired before the required action was finished.
Why track breaches by category rather than just counting them?+
Categorising breaches shows whether failures cluster around a particular incident type, shift, or team, which points to the actual process or staffing gap rather than treating every breach as random.
Related terms
- Contact Tree
- A structured list of individuals and teams to notify during an incident, showing the order of contact and the conditions under which...
- Escalation Criteria
- The documented conditions that require an analyst to transfer an incident to a higher tier or to external stakeholders. Examples include: severity...
- Handoff Package
- The bundle of information an analyst prepares before transferring an incident to a higher tier. Contents include incident ID, timeline, severity, containment...
- P1/P2/P3/P4 Severity Tiers
- A common four-level severity classification used in SLA structures. P1 (Critical) carries the shortest time windows; P4 (Low) carries the longest. The...
- Service-Level Agreement (SLA)
- A policy or contractual commitment defining how quickly the SOC must perform specific actions (acknowledge, escalate, contain, resolve) for incidents of each...