Decide and publish the rule: the SLA clock should start at a single, consistent event such as triage or disclosure, pause only for documented reasons, and stop when the fix is deployed or a mitigation is approved. Without written rules, two teams will report different numbers for the same work.
Why definitions come first
Teams argue about SLA performance when they really disagree about the clock. One team starts counting at disclosure, another when a ticket is created, another when the sprint begins. The numbers then look inconsistent and trust in the metric drops. Write the rule once and apply it everywhere.
Start points
| Start event | Pros | Cons |
|---|---|---|
| Public disclosure | Reflects exposure from outside view | Unfair if you could not have known |
| First detection by your tools | Measures response once visible | Hides slow detection |
| Triage confirms it applies to you | Avoids counting irrelevant items | Hides triage delay unless tracked separately |
| Ticket assigned to owner | Easy to read from the tracker | Hides everything before assignment |
A practical option is to track two intervals: detection to triage, and triage to fix. Each has its own owner and its own target.
Stop points
| Stop event | Notes |
|---|---|
| Fix merged | Easy to measure, but users may still be exposed |
| Fix deployed to production | Best reflection of risk ending |
| Approved mitigation in place | Valid if a documented mitigation standard exists |
Pause rules
Allow a pause only for a short list of reasons, each recorded with a date:
- Waiting on a vendor fix that does not yet exist
- A change freeze agreed in advance
- An approved exception while review is in progress
Do not pause for "team busy" or "sprint full". Those are capacity signals, and they belong in the report, not hidden in the clock.
Steps to adopt rules
- Write the start, pause and stop rules on one page.
- Get agreement from engineering and security leadership.
- Apply them in the tracker with fields, not free text.
- Recompute the last quarter with the new rules so you have a baseline.
- Note the rule change on any chart that crosses the date.
For dashboard construction, see how to build a vulnerability SLA dashboard and SLA tracking without spreadsheets.
What not to claim
Do not call an SLA "met" if the clock was paused without a recorded reason, and do not compare your numbers to another organization's unless you know how their clock works.
Safeguard's policies and gates can encode SLA rules per priority tier, and its evidence automation keeps a dated record for audits. You can see a first inventory with the free scan.
Quick check
Should low severity findings have an SLA?
Yes, a longer one, or an explicit rule that they are reviewed on a schedule. Having no rule makes them invisible.
Who approves a clock pause?
A named role in security leadership, recorded in the tracker so it can be audited later.
Last reviewed: 19 October 2026.
