Purpose
Take a cloud or managed-service SLA and expose exactly where it falls short of enterprise best practice — weak uptime math, missing recovery objectives, toothless penalties, vague escalation paths, and silent security obligations — then hand the reviewer specific redline language and a ranked negotiation list. Turns a dense contract into an actionable protection audit.
When to Use
Invoke this skill when the user asks to:
- Review a cloud or managed service SLA before signing or renewing
- Compare a vendor's SLA against industry standards or a peer contract
- Identify missing RTO/RPO, penalty, or incident response terms
- Prepare for an SLA negotiation or contract redline
- Assess whether a current SLA actually protects them during an outage
- Build a case for service credits after a vendor breach
Inputs Required
Before starting, collect:
- SLA text or summary: Pasted clauses, an uploaded document, or a described set of terms
- Service type: What's being covered (IaaS, SaaS, managed hosting, backup/DR, MSP support, etc.)
- Business criticality: How critical the service is (mission-critical / important / non-critical) — drives which gaps matter most
- Current pain points (optional): Any past outages, disputes, or vendor issues shaping the review
- Target uptime or recovery needs (optional): Internal requirements (e.g., 99.99% uptime, 1-hour RTO)
- Contract stage: New signing / renewal / active dispute — affects negotiation posture
If business criticality or target objectives are missing, assume mission-critical enterprise standards and note the assumption in the report.
Instructions
Step 1: Uptime & Availability Commitment
Evaluate the availability guarantee against real-world requirements.
- Read the number precisely: 99.9% = 8.77 hrs/year downtime; 99.95% = 4.38 hrs; 99.99% = 52.6 min; 99.999% = 5.26 min. State the allowed downtime in plain hours/minutes.
- Measurement window: Is uptime measured monthly, quarterly, or annually? Longer windows hide clustered outages — flag anything beyond monthly.
- Definition of "downtime": Does it count degraded performance, partial outages, and single-region failures — or only total unavailability? Narrow definitions are a red flag.
- Whose clock: Is availability self-reported by the vendor, or measured by an independent tool? Self-reporting with no audit right is a gap.
- Common gap: "99.9%" with quarterly measurement and total-outage-only definition can permit hours of degraded service with zero credit.
Step 2: Recovery Objectives (RTO / RPO)
Check whether recovery is actually committed — not just implied.
- RTO present and defined: Is there a stated maximum time to restore service after failure? "Best effort" is not an RTO.
- RPO present and defined: Is there a stated maximum acceptable data loss window (e.g., 15 min, 1 hr, 24 hr)? Missing RPO means unbounded data loss risk.
- Backup and DR specifics: Frequency of backups, retention period, geographic redundancy, and tested failover cadence.
- Alignment check: Compare stated RTO/RPO against the user's business criticality — a 24-hour RTO on a mission-critical system is a severe gap.
Step 3: Penalty & Service Credit Clauses
Determine whether the SLA has teeth.
- Credit structure: What percentage credit applies at each breach tier, and against what base (monthly fee vs. total contract)?
- Meaningfulness test: A 10% credit on a $500/mo service after a full-day outage is symbolic, not compensatory — flag credits that don't reflect business impact.
- Claim burden: Must the customer detect, document, and formally request credits within a short window? Auto-applied credits are best practice; customer-initiated claims are a gap.
- Caps and exclusivity: Is the credit the "sole and exclusive remedy"? Are damages capped below the cost of a real outage? Flag both.
- Termination trigger: Does chronic breach (e.g., 3 months below SLA) allow the customer to exit without penalty? Missing = lock-in risk.
Step 4: Escalation Procedures
Assess whether help arrives fast enough when things break.
- Severity tiers defined: Are incident severities (P1/P2/P3) clearly defined with examples?
- Response vs. resolution: Distinguish response time (acknowledgment) from resolution/restoration time — vendors often commit only to the former.
- Escalation ladder: Named roles, escalation timers, and executive escalation path for unresolved incidents.
- Contact channels & hours: 24/7 for critical severity? Dedicated contact vs. general support queue?
- Common gap: 1-hour "response" that only means an automated ticket acknowledgment, with no resolution commitment.
Step 5: Security Incident Response & Data Obligations
Check the security and breach commitments most SLAs under-specify.
- Breach notification window: Is there a committed timeframe to notify the customer of a security incident (e.g., 24/48/72 hours)? Silence here is a serious gap.
- Incident response obligations: Vendor duties to investigate, contain, remediate, and report root cause.
- Data handling: Encryption at rest/in transit, data residency, and data return/deletion on termination.
- Compliance alignment: Does it reference required frameworks (SOC 2, ISO 27001, HIPAA, GDPR) relevant to the service type?
- Audit and reporting rights: Can the customer request evidence (audit reports, pen test summaries)?
Step 6: Maintenance, Exclusions & Loopholes
Find the fine print that quietly erodes the guarantee.
- Maintenance windows: Are scheduled maintenance windows excluded from uptime? How much notice is required, and is there a cap on maintenance hours per month?
- Force majeure scope: Overly broad force majeure or "third-party provider" exclusions can void nearly any claim.
- DDoS / attack exclusions: Are security-event outages excluded from availability? For hosting/IaaS this is a major gap.
- Change-of-terms rights: Can the vendor unilaterally amend the SLA? Flag any one-sided modification clause.
Step 7: Gap Report & Negotiation Priorities
Compile findings into a ranked report.
- Rate each of the seven dimensions: Strong / Adequate / Gap / Critical Gap.
- For every Gap or Critical Gap, provide: the problem, the business risk in plain terms, and specific replacement or added language the reviewer can propose in redlines.
- Rank the top 5 negotiation priorities by risk-weighted impact, factoring in business criticality and contract stage.
- Give one overall verdict: Sign as-is / Sign with priority redlines / Do not sign without changes.
Output Format
- Structure: Seven dimension sections, each with rating, findings, and redline language where gaps exist; followed by a ranked priority list and overall verdict
- Length: 1,000–1,400 words
- Format: Structured document with a summary rating table at the top, bulleted findings per section, and a numbered negotiation priority list
- Sections: Rating Summary Table → Uptime & Availability → RTO/RPO → Penalties & Credits → Escalation → Security & Data → Maintenance & Exclusions → Top 5 Negotiation Priorities → Overall Verdict
- Tone: Vendor management lead — precise, skeptical of vague language, protective of the customer's interests, never taking vendor terms at face value
Quality Checklist
Before delivering output, verify:
- [ ] All seven dimensions are rated (Strong / Adequate / Gap / Critical Gap)
- [ ] Uptime percentages are translated into actual allowed downtime in hours/minutes
- [ ] Every Gap and Critical Gap includes specific proposed redline language — not just "improve this"
- [ ] RTO/RPO gaps are checked against the stated or assumed business criticality
- [ ] The top 5 negotiation priorities are ranked by risk-weighted impact, not listed arbitrarily
- [ ] A single clear overall verdict is stated (no hedging)
Notes
- If the pasted SLA omits a dimension entirely, treat absence as a Critical Gap — silence in an SLA always favors the vendor.
- Service credits are almost never real compensation; frame them as breach signals and negotiate a termination-for-chronic-breach right as the true protection.
- For mission-critical services, the most commonly missing terms are RPO, security breach notification windows, and resolution (not response) time commitments — check these first.
- When contract stage is "active dispute," reframe findings toward evidence-building: which clauses the vendor has breached and what remedy the SLA text actually entitles the customer to.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills