## Vendor, consultant, and contractor agreements and controls
(p.60)
Vendor, consultant, and contractor controls are used to define the levels of performance, expectation, compensation, and consequences for entities, persons, or organizations that are external to the primary organization. Often these controls are defined in a document or policy known as a service-level agreement (SLA).

The following issues are commonly addressed in SLAs: System uptime (as a percentage of overall operating time) Maximum consecutive downtime (in seconds/minutes/and so on) Peak load Average load Responsibility for diagnostics Failover time (if redundancy is in place) SLAs also commonly include financial and other contractual remedies that kick in if the agreement is not maintained.

SLAs should include a focus on protecting and improving security in addition to ensuring quality and timely services at a reasonable price.