III.D.3 Service Level Agreements
The institution should establish formal SLAs with its IT providers, including affiliates and third-party providers. Larger or more complex institutions should consider establishing SLAs for internally provided services, for example, by another division or department of the same institution. SLAs establish mutual expectations and provide a baseline for measuring IT performance. Management can tie SLAs to incentive and penalty actions. SLAs should be comprehensive to provide the institution with a high level of comfort in setting expectations. The use of performance benchmarks and outcome-based measurements could identify potential issues with attaining expectations set in the SLAs.
III.D.2 Performance Benchmarks
III.D.4 Policy Compliance