Service level agreementS Looking at slas from a Peter W.

Laberee - - laberee law pc constituencies perspective

( 2 c ) 2 0 1 2

Disclaimer

This discussion does not constitute legal advice and this presentation does not establish an attorney-client relationship. But you knew that anyway.

L a b e r e e

These remarks do not necessarily reflect the position of the Cloud Security Alliance or the New York Metro Chapter of the Cloud Security Alliance, or of any of the clients of Laberee Law PC.

L a w

( 3 c ) 2 0 1 2

Click icon to add picture

L a b e r e e

L a w

( 4 c ) 2 0 1 2

Service Level Agreements

What is a Service Level Agreement.

What Service? What Level? Is it an agreement?

Is there just one SLA out there? So . . . we just have to find it, sign it and we are done? . . . Right? . . . . Right? . . . .

L a b e r e e

L a w

( 5 c ) 2 0 1 2

Click icon to add picture

L a b e r e e

Constituencies approach
Which one is which . . . Arent they all the same?

L a w

( 6 c ) 2 0 1 2

CONSTITUENCIES . . .

I.T. Department Enterprise / Company Companys Customers Companys Customers Customers Regulatory Bodies / Government Companys Employees Risk Management group within Company Companys Owners Companys Management

L a b e r e e

L a w

( 7 c ) 2 0 1 2

. . . . And what they care about

Delivering good service. Jobs and budgets. Technical success and efficiency. Security. Perform core business functions with maximum profit and long-term stability and value. Usually NOT I.T. Getting service - - better, faster, cheaper. Often NOT I.T. Effectiveness. Results. Avoidance of delay, loss or other pain. Removed from immediate tactical goals of Companys IT department. NOT Companys IT problems. Compliance. Privacy. Protection of Network and shared resources and the commons, including security. Enforcement of non-I.T. laws. Support and resource. Keeping jobs and looking good. Privacy. No losses, no lawsuits, no increase in compliance costs, no insurance claims. Short- and mid-term Profits and long term value. Employment and compensation. Company performance. Usually I.T. as a means, not end.

L a b e r e e

L a w

( 8 c ) 2 0 1 2

SLA Constituencies game- - mix and match! I.T. Department

L a b e r e e

Enterprise / Company Companys Customers Companys Customers Customers Regulatory Bodies / Government Companys Employees Risk Management group within Company Companys Owners Companys Management

Delivering good service. Jobs and budgets. Technical success and efficiency. Security. Perform core business functions with maximum profit and long-term stability and value. Usually NOT I.T. Getting service - - better, faster, cheaper. Often NOT I.T. Effectiveness. Results. Avoidance of delay, loss or other pain. Removed from immediate tactical goals of Companys IT department. NOT Companys IT problems. Compliance. Privacy. Protection of Network and shared resources and the commons, including security. Enforcement of non-I.T. laws. Support and resource. Keeping jobs and looking good. Privacy. No losses, no lawsuits, no increase in compliance costs, no insurance claims. Short- and mid-term Profits and long term value. Employment and compensation. Company performance. Usually I.T. as a means, not end.

L a w

( 9 c ) 2 0 1 2

So what does an sla usually cover

Techies embrace them . . . lawyers love them . . . sales staff hate them . . . customers ignore them . . . . so . . . . Intended to be legally binding agreement Establish uptime and service levels for one business to provide cloud-based service and capacity to another business What service? What level? Level of what? Who drafted this SLA anyway?

L a b e r e e

L a w

( 10 c ) 2 0 1 2

SLAs have about 7 elements, or nuggets, which bear 1. Identification of parties. Who will be legally bound. Who is the consideration whenrecipient? provider and who is the preparing, reviewing, executing, performing undertimeallocating responsibility under: 2. Term; Length of or during which the parties are bound.

L a b e r e e

3. Performance metrics. 4. Defined terms. Infuses the performance metrics. 5. Exceptions or failures of performance. Remediation, correction ( . . . but rarely remedies or damages in the lawyers sense). 6. Process for identifying exceptions or failures and prosecuting remediation or correction and claims-making. 7. Exclusions. Re-allocation of responsibility. Not-my-fault.

L a w

( 11 c ) 2 0 1 2

Lingo dangers Consider the reliance, the comfort that users of contracts, including SLAs, get - perhaps unduly - - from nuggets like these in their contracts . . . .

L a b e r e e

L a w

Core components Best efforts Industry standard Best of breed Best practices Error Rate Request (or some other term for customer trying to get stuff Material . . . Substantial

( 12 c ) 2 0 1 2

General Architecture of a Cloud provider SLA.

Description of Services; some defined terms Reference to (if not description of) maintenance, scheduled downtime, notice of maintenance. Providers commitment to uptime Reporting Remedies - - often too grand a word - - it may be simply a credit for loss of uptime. Note it may not kick in unless customer asks for it. (How does customer know?) Calculation of credit Exclusions: customer equipment or software; customer connectivity; maintenance and similar interruptions after notice; Customer-related human error; old stand bys like force majeure. Special contract and liability exclusions: consequential, incidental and punitive damages exclusions.

L a b e r e e

L a w

( 13 c ) 2 0 1 2

Click icon to add picture

L a b e r e e

If only one or two constituencies build an sla . . . ..! It will show .

L a w

( 14 c ) 2 0 1 2

L a b e r e e

Comments? Questions?
Thank you

L a w

( 15 c ) 2 0 1 2

If you would like to talk in more detail about slas

Service Level Agreement

....

L a b e r e e

Network Data Center Infrastructure Cloud Server Hosts Migration Credits Network Data Center Infrastructure Cloud Server Hosts Migration Definitions Limitations

L a w

( 16 c ) 2 0 1 2

Terms of Use Topics

Cloud Terms of Service

L a b e r e e

L a w

Defined Terms [provider]s Obligations and [customer]s Obligations Access to the Services Access to Data Unauthorized Access to Your Data or Use of the Services Disclaimers Term Fees Limitation on Damages Indemnification No High Risk Use