---
title: "SLA"
description: "How many days a finding of each severity may take to be verified, assigned and resolved, and how a missed deadline shows."
url: https://whitespots.io/docs/appsec-portal/track-risk/sla
slug: appsec-portal/track-risk/sla
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# SLA

An SLA sets how many days a finding may stay in each triage step. When a finding takes longer, it
is **SLA violated**. There are three deadlines for each severity:

| Deadline | Counts from | Ends when the finding is |
| --- | --- | --- |
| **Days to verify** | the day the finding was created | verified or rejected |
| **Days to assign** | the day it was verified | assigned |
| **Days to resolve** | the day it was assigned | resolved or its risk is accepted |

The first is for the security team, the other two for the product teams.

Findings become Assigned only through a [task tracker](https://whitespots.io/docs/appsec-portal/integrations/task-trackers) whose
assignees move findings to Assigned. While **Assignment SLA** is on (the default), a verified
finding in a product without such a tracker has no deadline at all: it is never assigned, so
neither the deadline to assign nor the one to resolve starts.

## Set the deadlines

Open the settings, then **SLA Config** under **Metrics Configuration**, and enter the days for
each severity and step.

Turn off **Assignment SLA** unless your teams assign findings in a task tracker. The deadline to
assign is then not counted, and the deadline to resolve counts from verification. Findings still
move to Assigned.

The [Auto Validator](https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage/auto-validator) verifies findings as
they arrive, which keeps the security team inside its deadline to verify.

## Where it shows

- **SLA days remaining** on each [finding](https://whitespots.io/docs/appsec-portal/triage-findings/finding): the days left before
  the current deadline.
- **SLA violated** on each [product](https://whitespots.io/docs/appsec-portal/products-and-assets/products) card: how many of its
  findings missed a deadline.
- The SLA filter in [Findings](https://whitespots.io/docs/appsec-portal/triage-findings/findings), to list the findings that missed
  their deadline.
- The SLA charts on the dashboard and in [reports](https://whitespots.io/docs/appsec-portal/track-risk/reports).

A [task tracker](https://whitespots.io/docs/appsec-portal/integrations/task-trackers) integration can set the due date of each task
from these deadlines.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Track risk](https://whitespots.io/docs/appsec-portal/track-risk)
- Previous: [WRT](https://whitespots.io/docs/appsec-portal/track-risk/wrt)
- Next: [Reports](https://whitespots.io/docs/appsec-portal/track-risk/reports)