SLA Targets¶

Audience: All client users can view them. Owners and managers can change them · Where: Administration → General (owners and managers), or Settings → SLA Targets (/settings/sla, read-only for members and viewers).

Overview¶

SLA targets set how many days your organization allows to remediate a finding, by severity. Canima measures your open and fixed findings against these targets on the Dashboard, in Analytics and in the executive summary. Setting targets that match your own remediation policy makes those figures meaningful.

The defaults¶

Until you set your own, Canima uses the platform defaults:

Severity	Days to remediate
Critical	7
High	15
Medium	45
Low	90

Informational findings have no SLA target.

A line above the fields shows where the current targets come from:

Platform defaults: nobody has set targets yet.
Set for this organization: your organization has its own targets.
Inherited from your firm: your organization is managed by an MSSP or pentest firm that has set targets for its clients (see below).

Changing your targets¶

Go to Administration → General and find the SLA targets card.
Enter the number of days for Critical, High, Medium and Low.
Click Save targets. You'll see "SLA targets saved".

The rules are:

Whole days only, from 1 to 365.
Targets can't get shorter as severity drops. Critical must be no longer than High, High no longer than Medium, and Medium no longer than Low.

Members and viewers see the same card under Settings → SLA Targets with the fields disabled and the note "Only owners and managers can change SLA targets."

Where SLA targets are used¶

Dashboard → Risk and Compliance: counts open findings past SLA target for each severity ("Open critical findings older than your critical SLA target", and so on). The card links to Your SLA targets (Your SLA targets (Administration) for owners and managers). See Home Dashboard.
Analytics → Outcomes: the SLA compliance figure and chart, and the SLA by severity table (fixed within SLA, and open findings breaching their target now). See Outcomes & Executive Summary.
Executive summary PDF: reports SLA compliance for the period.

Tip

Changing a target applies to how findings are measured from then on, including findings that are already open. A tighter target can immediately move existing findings into "past SLA target".

MSSPs and pentest firms¶

A firm can set SLA targets at the firm level. Under the SLA targets card, firm owners and managers see "Client organizations without their own targets inherit these." A client that sets its own targets overrides the firm's. Firm-wide SLA figures also appear in the portfolio views. See For MSSPs & Pentest Firms and Portfolio & Reporting.