Public Sector
The uptime number is the least important part of a service level agreement
An availability target is enforceable only when the contract defines what counts as available, how it is measured, and what a miss costs.
Most technology contracts include a service level agreement, and most of them cannot be enforced. The percentage is there, usually a string of nines, but the terms that give it meaning are missing or written in the vendor's favor. An agency can hold a strong availability number, live through a bad month, and still have no way to prove the miss and no consequence to apply.
A service level is only as good as four definitions: what counts as available, over what period it is measured, what is excluded, and what happens when the target is missed. Performance-based purchasing already expects the requirement itself to carry measurable standards and a way to monitor them. We write the service definitions for our own systems and reference builds against those four questions, because a commitment nobody can compute is not a commitment.
Availability means a user can finish a transaction
The weakest definition of uptime is that a host answers a network check. A server can respond while logins fail, the payment step times out, and the search index returns nothing.
Define availability as the success of a synthetic transaction that follows a real workflow: authenticate, submit a representative request, read it back. Name those transactions in the contract, and treat a response slower than a stated threshold as a failure. Set the threshold from observed normal performance, not from an aspiration.
Tier by function: if permits can be submitted but nothing can be paid for, the payment function is down even though the portal is up.
The measurement window decides the answer
The same outage passes or fails depending on the denominator. A percentage measured over a year allows about twelve times the downtime minutes that the same percentage allows over a calendar month, and one multi-day failure can be averaged away by quiet months.
Convert the percentage to minutes and write the minutes into the contract. Specify calendar month or rolling thirty days, and say how partial months at the start and end of the term are handled.
Say who measures, from where, and how often
Measurement mechanics decide the result. A polling interval of several minutes cannot detect a shorter outage, and requiring several consecutive failures before the clock starts discounts short outages to zero. Settle these in writing:
- The monitoring source, and whether the agency may check from outside the vendor's network.
- The polling interval, and the number of failures that opens an incident.
- When the clock starts, which should be the first failed check, not the moment a ticket is opened.
- When it stops, which should be verified restoration, not a report that a fix was deployed.
- Retention of the raw measurement data, and the agency's right to see it.
Exclusions are where the service level is really written
The exclusion list, not the percentage, sets the real obligation. Four patterns are worth challenging.
Uncapped scheduled maintenance. Cap the maintenance minutes per period, require advance notice, and set the window against the agency's operating calendar rather than the vendor's. Emergency maintenance needs its own definition and limit.
Third-party carve-outs. The vendor's cloud provider, content delivery network, and identity provider are its supply chain, and the vendor selected them, so their outages should count. An authorization under a program such as FedRAMP is a security assessment, not an availability commitment.
Broad agency-fault language. Narrow it to specific documented acts, not any configuration the vendor later decides was wrong.
Catch-all clauses covering anything outside the vendor's reasonable control. Left broad, this absorbs most real outages.
Availability is not the only promise
A system can be fully available and still failing: a defect that corrupts records, a batch job that stops running, an interface that silently drops transactions. Define severity by impact on agency operations. The agency makes the initial call, and the vendor may request reclassification rather than impose it.
Separate the response commitments that get blurred: acknowledgement by a person who can act, status update cadence, restoration or workaround, and permanent correction. Align coverage hours with the agency's calendar, including the periods when stakes are highest, such as filing deadlines, open enrollment, and elections.
Remedies that apply without a fight
Service credits are the standard remedy and they are weak. They are usually capped at a fraction of the monthly fee, and many contracts require the customer to notice the miss and file a claim within a short window, which is how earned credits go unclaimed.
Make credits automatic: the monthly report calculates them and the next invoice reflects them. Credits alone rarely change vendor behavior, so add a chronic failure clause: after a defined number of misses in a rolling period, the agency may terminate for cause without early termination charges, with data extraction and transition assistance required. Keep sole and exclusive remedy language away from security incidents, data loss, and confidentiality breaches.
What this means for your agency
You do not need a longer service level agreement. You need the definitions to exist. Put the availability definition, measurement method, exclusion limits, and remedy structure in the solicitation so every bidder prices the same promise.
During evaluation, ask each bidder for a sample monthly availability report and how the number was produced. Before any renewal, read a full year of those reports. If they do not exist, that answers the question about the service level.