“How fast will you respond when something breaks?” is one of the first questions every business asks an IT provider — and the answers arrive wrapped in enough fine print that two providers quoting “one-hour response” can be describing completely different experiences. Here’s how service levels actually work, what realistic numbers look like at small-business scale, and the questions that separate a real commitment from a brochure.

The distinction everything hinges on: response vs. resolution

Response time is how quickly a qualified human engages with your issue — acknowledges it, starts working, communicates. Resolution time is when it’s actually fixed. Providers commit to the first and (honestly) can’t guarantee the second, because resolution depends on what’s broken — a password reset takes minutes; a failed server takes however long your recovery design says it takes. This isn’t a dodge; it’s physics. But it means the response commitment carries all the contractual weight, so pin down what “response” means in the agreement: a human working the issue, or an auto-reply with a ticket number? The gap between those two definitions is where disappointing support hides. (Ours means a person — it’s rather the point of answering the phone live.)

Severity tiers: why “it depends” is the right answer

Every sane SLA triages. A whole-company outage and a wonky second monitor shouldn’t queue equally — if they do, either emergencies wait behind trivia or every request gets emergency treatment priced accordingly. The standard shape:

  • Critical — business stopped (server down, ransomware suspected, nobody can work): response in minutes-to-an-hour, all hands, worked continuously until stable.
  • High — a team or function impaired (email down for a department, the line-of-business app failing): response within a few business hours.
  • Normal — one person inconvenienced, workaround exists: same or next business day.
  • Low — requests and questions (new-hire setup, “can you install…”): scheduled, with standard requests running on standard timelines.

Realistic benchmarks for well-run SMB support: critical issues engaged inside 15–60 minutes, normal issues same/next day, and — the number nobody quotes but everyone lives — most everyday tickets resolved on first contact. Ask for that first-contact resolution figure; it predicts daily experience better than any SLA table.

The fine print that actually matters

Five questions expose the difference between commitments and marketing:

  1. What are the coverage hours, and what happens outside them? “24/7” sometimes means a staffed team, sometimes an answering service that pages someone in the morning. Ask specifically: who answers a critical call at 2 a.m. Sunday, and what can they actually do? (For security events, this is the whole ballgame.)
  2. Who defines severity? If the provider unilaterally classifies your down-server as “high” instead of “critical,” the SLA protects them, not you. The definitions belong in writing, with examples.
  3. Does the clock ever stop? “Pending customer” and “pending vendor” statuses legitimately pause timers — and can be abused to make ugly numbers pretty. Fine in principle; ask how it’s used.
  4. Is there any accountability if targets are missed? Enterprise SLAs carry service credits; SMB agreements often don’t, and that’s survivable if you get the alternative: reporting. Actual response-time performance should appear in your quarterly review, because a provider who publishes their own numbers to you has aligned their pride with your experience. One who won’t share them has also told you something.
  5. How do we escalate when it’s not going well? A named path — service manager, then account lead — beats “call the main line again.” The best test of any provider isn’t their SLA table; it’s how ticket #4,000 gets handled when it stalls.

One more, structural: month-to-month agreements are their own service level. A provider you can leave with 30 days’ notice has to earn the response times every month; a three-year contract has… a different incentive. We’ve built on the first model since ‘97, and it does wonders for keeping SLA tables honest.

Your side of the bargain

Service levels are a two-way street, and businesses get better outcomes by holding up their half: report through the agreed channels (the ticket that exists gets the SLA; the hallway mention doesn’t), give symptoms and scope honestly (“three people since 9 a.m.” routes better than “EVERYTHING’S DOWN” — the same discipline that speeds vendor calls), don’t cry critical for conveniences (severity inflation is how real emergencies lose their lane), and keep a contact reachable — the clock-stops question cuts both ways.

The bottom line

A good SLA is mostly clarity: response defined as a human engaging, severities defined with examples, coverage hours defined without asterisks, and performance reported to you voluntarily. The numbers matter less than the definitions, and the definitions matter less than the reporting — because a provider willing to show you their actual response times every quarter rarely has response times worth hiding. That phrase — without asterisks — matters most outside the metro core, where the capital’s businesses in particular have learned to read for the quiet exception.