Engagement / Service Levels
Published. Contractual.
Audited quarterly.
OwlEye runs to a documented severity matrix, a published RACI, and a fixed engagement lifecycle. No surprises. No negotiation in the middle of an incident.
SLA
15-min ack
✓
Response guaranteed
Four tiers. Four clocks. Always running.
Tier
Definition
Response
Target
Critical
Production outage, active breach, data exposure, or security event in progress.
≤ 30 Minutes, 24/7/365
Containment Within 1 Hour
High
Major functionality degraded; +7 CVE disclosed against an in-stack component; auth or payment paths impaired.
≤ 2 Hours, 24/7
Resolution in 6 Hours / +7 CVE Patchd Within 3 Business Days
Medium
Minor functionality issue, UX defect,-7 CVE disclosed against an in-stack component non-blocking regression, or low-severity advisory.
Within 48 Hours
Scheduled Into Next Release Window / -7 CVE Patchd Within 3 Business Days
New Scope Requests
Net-new requirement, missed requirement, or feature not behaving as expected.
Within 48 Hours
Mutually Agreed Delivery Date
Tight controls? We'll write the matrix to fit.
Regulated industries, government mandates, and enterprise risk frameworks often demand stricter response windows, named escalation paths, and reporting cadences beyond our published tiers. OwlEye builds customized SLAs that align with your organization’s controls — codified in the MSA, audited every month.
Who owns what. In writing.
R = Responsible · A = Accountable · C = Consulted · I = Informed. Every engagement ships with a RACI ratified by both signatories.
Event / Activity
OwlEye
Client
Manage / monitor / maintain server-side and application-side stack
R / A
I
Implement security patches and hot-fixes across the stack
R / A
I
Vulnerability version control (core, themes, plugins, libraries)
R / A
I
Break-fix / bug remediation in CMS and front-end
R
C
Browser compatibility regression (Chrome, Firefox, Edge, Safari)
R
C
User acceptance testing in dev / staging environments
C
R / A
Approval to promote releases to production
C
A
Net-new development & enhancements (8 hr/mo bucket)
R
A / C
Third-party vendor coordination & change windows
C
R / A
From signature to attestation. One continuous loop.
Onboarding & Baseline Patch
One-time stack uplift: server-side runtime, WordPress core, theme(s), every plugin/extension, and bundled libraries are brought to current secure version levels. Asset inventory is published.
24/7 Managed Operations
Continuous version-level monitoring. CVE feeds (NVD, Patchstack, WPScan, vendor advisories) cross-referenced against your live bill-of-materials. Alerts generate tickets automatically.
Regression-Tested Patching
Patches deploy first to a staging mirror. Functional, visual, and accessibility regression suites run before promotion. Production updates ship inside a controlled change window with one-click rollback.
Break-Fix & Browser Assurance
Bug and break-fix support across the CMS and front-end. Compatibility maintained across the latest two major versions of Chrome, Firefox, Edge, and Safari.
Net-New Development
Bucketed monthly hours (typically 8 hr/site) for design enhancements, new features, integrations, and programming work. Net-new is scoped, estimated, and tracked separately from managed maintenance.
Reporting & Attestation
Monthly version reports, SLA attainment, ticket throughput, and audit-ready evidence packs aligned to SOC 2 / ISO 27001 / HIPAA / PCI DSS.
Want the full SLA & RACI in your inbox?
We’ll send the un-redacted Master Service Agreement template, severity matrix, and RACI workbook for your legal and risk teams to review.