A supplier SLA is the set of service agreements you use to manage the performance of an outsourced service, such as security, cleaning or maintenance. Managing performance here does not mean having agreements on paper. It means you can tell at any moment, from an objective source, whether those agreements were met, and that any deviation feeds through to the invoice. GRIP is contract management software for supplier contracts used by organisations in healthcare, education and the public sector.
At 03:12 the alarm went off at a satellite site. The next morning the security officer reports that everything was handled according to the agreement. But you cannot reconstruct the actual response time, the 02:00 patrol round is recorded nowhere, and the camera at the rear entrance turned out to be offline. You have an SLA with your supplier, neatly documented. The problem: you cannot prove what really happened. That is exactly the moment an SLA proves toothless. This angle builds on our earlier pieces about NIS2 and supplier risks, now focused on security: from response time to patrol round.
Which KPIs genuinely drive a security contract
Not every KPI drives performance. A security SLA with ten soft agreements about “commitment” and a “proactive attitude” delivers nothing, because you cannot measure them. The hard KPIs that do drive performance can be read objectively from a system. Build your contract around those.
- Alarm response time: the time between the alert and arrival on site. For example: within 20 minutes at the main site, within 30 at satellite sites. An agreement, not a statutory standard.
- Completed patrol rounds: the number of rounds walked per night against the agreed number, including the checkpoints passed.
- Incident handling: the percentage of incidents logged, actioned and reported back within the agreed time.
- Control room availability: the uptime of the control room connection and the response speed to incoming alerts.
Soft factors such as collaboration and input are valuable, but they belong in the quarterly review, not the monthly performance measurement. Keep those two separate, otherwise your management of performance dilutes.
Measuring without a data source is guessing
A response time on paper is worthless if you cannot take the actual time from an objective source. The strength of a security contract is that almost every KPI has a system that records the truth. Link each agreement to one data source, so you never depend on the supplier’s word.
- Patrol control system or GPS: proves which checkpoints were passed and at what time. A missed round becomes a fact, not a discussion.
- Control room log: records the exact time of the alert, the dispatch and the arrival. This gives you the actual response time.
- Access control logs: show whether the security officer was actually present, and when.
- Incident register: the logbook recording how incidents were handled and reported back.
The lesson is simple: do not agree a KPI for which no objective source exists. Otherwise you measure a feeling, and in a dispute the party with the best defence wins, not the party with the facts.
From deviation to pounds: penalty, bonus and the invoice
This is where most organisations leave money on the table. You pay a fixed monthly amount, even when the service was not delivered in full. A supplier SLA only becomes a steering tool when a deviation feeds back into what you pay.
Work the numbers. Suppose you pay 24,000 euro per month for night patrols. Four rounds per night were agreed, so 120 rounds across 30 nights. The patrol control system shows 113 were walked. That is 94 per cent. You pay 100 per cent for 94 per cent of the performance delivered. Without a measurement system, nobody recovers that difference.
With a penalty clause of 0.5 per cent credit per missed round above a threshold of three, you arrive at four rounds to credit. That is 2 per cent of 24,000 euro: 480 euro over a single month. Over a year, on a contract with annual indexation, that adds up fast. A bonus works the same way: deliver 100 per cent three months in a row and you earn an uplift. That way you manage performance rather than mere presence.
The core point for the contract manager and the finance lead: a measured deviation that does not feed through to the invoice is a missed saving. Every round you recover, every exceeded response time you credit, is money that would otherwise disappear into the fixed monthly amount.
The same approach works for cleaning, maintenance and IT
Security is a good example, but the method applies across contracts. The principle stays the same: agree a measurable standard, link an objective data source, and let deviations feed through to the invoice.
- Cleaning: DKS and VSR measurements against an agreed quality score. An objective measurement rather than a gut-feeling spot check makes the difference solid.
- Technical maintenance: faults resolved within the SLA time, measurable from the reporting system in your FMIS.
- IT and hosting: uptime and incident response time, read from monitoring and ticketing systems.
Whether it is a patrol round or a fault resolution, you manage on the same mechanism. That makes the approach reusable across your entire contract portfolio, not just one service.
Deviations visible on the contract dashboard, not only at the annual review
The biggest leak is in the rhythm. If deviations only surface at the annual review, correction or crediting comes too late. In the contract dashboard you link the measurement directly to the contract obligation and to the invoice.
A missed round or exceeded response time becomes visible straight away, not months later. Through performance measurements you record the source and the standard for each KPI. Hold a monthly operational review for the hard figures and a quarterly review for direction. That way you shift from reacting operationally to directing your suppliers.
Managing with proof is also compliance
For many organisations, security is a critical outsourced service. The Dutch Cybersecurity Act, the national implementation of NIS2, came into force on 15 August 2026 (Staatsblad 2026, 189). That law requires you to demonstrably manage risks from your supplier chain: knowing which suppliers you have, which continuity and security requirements the contracts contain, and which agreements remain open.
The same measurement system you use to substantiate a penalty provides the evidence that your duty of care is being met. GRIP is itself ISO 27001 and ISO 9001 certified and processes your contract data within Europe. In this way, managing your security SLA not only frees up money, it also helps you demonstrate compliance.
Frequently asked questions
Which KPIs belong in an SLA with a security supplier?
The KPIs that drive performance are the alarm response time, the number of patrol rounds completed, incident handling within the agreed time, and control room availability. Each can be read objectively from a system.
How do you prove that patrol rounds were actually walked?
Through a patrol control system or GPS that records which checkpoints were passed and at what time. A missed round then becomes a fact rather than a discussion based on trust.
How do you link a missed performance to the invoice?
With a penalty clause that ties a credit percentage to the number of deviations above a threshold. The measured deviation then feeds through automatically to the invoice amount, so you do not pay 100 per cent for less than 100 per cent of the performance.
Does this approach work for other contract types too?
Yes. The same method of measurable standard, objective data source and invoice link works for cleaning (DKS/VSR), technical maintenance (fault handling) and IT (uptime and response time).
What does NIS2 have to do with a security SLA?
The Cybersecurity Act requires organisations to demonstrably manage risks from the supplier chain. A security service is often critical, so managing that SLA with proof supports your duty of care under this law.
How often should you review a security SLA?
Hold a monthly operational review for the hard figures and crediting, and a quarterly review for the wider collaboration and direction. That way you correct in time rather than only at the annual review.
Does GRIP make my organisation NIS2-compliant?
No. GRIP is not a cybersecurity or compliance tool and makes no one NIS2-compliant. GRIP gives you a grip on the contract side of your duty of care: which requirements the contracts contain and which agreements remain open.
See how you monitor response times, patrol rounds and credits in a single overview. Book a demo of GRIP and see how you link deviations to your invoice.