Define the service-level agreement

CloudBees platform allows you to define your service-level agreement (SLA), setting the acceptable response window for fixing a vulnerability based on severity. The greater the severity, the faster the response required.

For each severity, response windows (numbered in days) default to the following values:

Very High: 15 days.
High: 35 days.
Medium: 180 days.
Low: 360 days.

You can change response windows by defining the SLA. By default, child organizations automatically inherit the SLA of their parent organization.

You must have the Admin role to define the SLA.

Figure 1. SLA configuration

To define the SLA for the root organization:

From the left sidebar on the Home screen, select SLA configuration from the Security dropdown.
Select Edit from the upper-right.
For each severity, enter the acceptable response window for fixing a vulnerability, numbered in days.
(Optional) Select Prevent override from the upper-left to prevent child organizations from deviating from the SLA configuration. For further information, refer to Overriding SLA inheritance.
Select Save SLA configuration.

Overriding SLA inheritance

By default, child organizations inherit the SLA configuration from the organization above them. A user with the Admin role can override the inherited SLA configuration, to set a different SLA for an organization and its children.

The status of an organization’s SLA inheritance is displayed in the upper-left, beneath SLA configuration:

Default: The organization (including the root) is using the default, unchanged SLA configuration.
Original: The root organization’s SLA configuration once changed from the default.
Inherited: The organization inherits the SLA from its parent organization.
Overridden: The organization has overridden its parent organization’s SLA.

Figure 2. SLA inheritance status

To override an organization’s SLA inheritance:

Ensure that Prevent override is not selected for the parent organization:
1. Navigate to the parent organization, then from the left sidebar select SLA configuration from the Security dropdown.
2. If Prevent override is selected:
  1. Select Edit or Create override from the upper-right.
  2. Deselect Prevent override.
  3. Select Save SLA configuration.
Navigate to the desired organization, then from the left sidebar select SLA configuration from the Security dropdown.
Select Create override from the upper-right.
For each severity, enter the acceptable response window for fixing a vulnerability, numbered in days. The default values are as follows:
- Very High: 15 days.
- High: 35 days.
- Medium: 180 days.
- Low: 360 days.
(Optional) Select Prevent override from the upper-left to prevent child organizations from deviating from the SLA configuration.
Select Save SLA configuration.

Where a child organization has overridden the SLA, and the parent subsequently prevents overriding, the child organization will revert to inheriting the SLA from its parent. Should the parent later permit overriding again, the child will revert to the previously stored values for its SLA.