A service-level agreement (SLA) formally establishes measurable service expectations between a provider and a customer. These expectations commonly include availability targets, response times, resolution times, service quality thresholds, escalation conditions, reporting requirements, and other measurable performance indicators. NIST describes an SLA as a document that specifies technical performance promises and how performance or disputes will be handled. NIST security-control guidance also notes that service-level agreements can define performance expectations and measurable outcomes.

That makes an SLA the appropriate document when management needs to determine whether contractual performance requirements were violated. KPIs contained in the agreement provide objective measures against which actual service performance can be compared.

TTPs describe adversary behavior and have no contractual purpose. A return-on-investment report evaluates financial effectiveness rather than service obligations. A risk management plan describes how organizational risks will be identified and treated. A memorandum of understanding records cooperation or intent between parties, but it typically does not provide the detailed operational performance guarantees associated with an SLA.

The clues are customer, signed agreement, contractual breach, and measurable KPIs —all of which strongly identify a service-level agreement.

Study Guide Reference: Reporting and Communication → Service-Level Agreements → KPIs → Contractual Requirements → Performance Metrics → Compliance and Escalation.