Two SLA Breaches Swapped Classification and Remedy Records: Reopen Both Dispositions
When two SLA breaches inherit each other's classification and remedy, reopen both records. Rebuild each evidence trail before approving credits or escalations, plus closure.
Research this article with AI
Follow Well Met on Google
Two SLA breach records have crossed. One breach now points to the other breach's classification and remedy decision. Treat both dispositions as open until the team can prove which evidence belongs to each one.
An SLA defines expected performance, how performance is measured and approved, and what happens when the target is missed. That makes a swapped record more than a filing error. It can attach the wrong credit, escalation, cure period, or closure approval to a breach. IBM, May 30, 2024
Start with the signed or approved SLA version that governed each breach. Do not begin with the current remedy field. Current fields may already contain the swap.
Which evidence belongs to each SLA breach?
Create a separate correction register for breach A and breach B. Give each row a stable breach ID. Copy source links and record IDs instead of rewriting facts from memory.
For each breach, identify the commitment, measurement window, actual result, dependencies, exclusions, classification, notice, cure, remedy, plus closure approval. Keep accepted evidence separate from observed evidence. An observed event may explain the outcome without changing the approved classification.
IBM lists service descriptions, dependencies, performance tracking, exclusions, escalation procedures, resolution time frames, and compensation among common SLA components. Use the contract language that governs the specific breach, not a generic template. IBM, May 30, 2024
- Record the applicable SLA version and exact commitment for each breach.
- Record the measurement-window start and end, clock source, plus actual result.
- Link the dependency, exclusion, notice, cure, credit, escalation, plus approval evidence to only one breach ID.
- Mark every field copied from the other disposition as untrusted until the negative-swap test passes.
What should the dual correction register contain?
The register is the decision record for the repair. It should make it possible for a reviewer to trace each remedy back to the commitment and measurement evidence that support it.
Do not merge the two breaches into one narrative. The purpose is to make an accidental swap visible, including a credit or escalation that relied on the wrong disposition.
| Field | Breach A record | Breach B record | Negative-swap test |
|---|---|---|---|
| Breach ID | Unique breach identifier and source record link | Unique breach identifier and source record link | Each ID resolves to one source record |
| Commitment and SLA version | Exact obligation and governing version | Exact obligation and governing version | Neither commitment is copied from the other breach |
| Measurement window and actual | Clock start and stop, with evidence and result | Clock start and stop, with evidence and result | Evidence timestamps fit only the assigned breach |
| Classification | Accepted classification link and observed classification link | Accepted classification link and observed classification link | Each classification is supported by its own evidence |
| Notice and cure | Notice record and cure terms, with cure evidence and decision | Notice record and cure terms, with cure evidence and decision | No cure record supports the other breach |
| Credit, escalation, and reliance | Remedy record and downstream credit/escalation reliance decision | Remedy record and downstream credit/escalation reliance decision | Every reliance points to the matching disposition |
| Closure approval | Closure approval, including approver, date, and evidence | Closure approval, including approver, date, and evidence | Approvals remain valid after the swap is removed |
How do you correct the classification and remedy without creating a second error?
Freeze automatic closure and new discretionary credits for both breaches while the correction is reviewed. Preserve the existing records with their timestamps and links. Add a correction note rather than overwriting the original disposition without a record of what changed.
Reconstruct breach A from its governing commitment and evidence. Independently reconstruct breach B. Only after both records are complete should the reviewer compare them against the existing dispositions and identify the crossed fields.
Then issue two explicit corrected decisions. Each should state the correct classification, applicable cure and remedy, affected downstream credits or escalations, plus required closure approval. A correction that says only "records swapped" does not settle the remedy.
NIST's incident-response guidance is intended to help organizations prepare for response and reduce incident impact, while improving detection, response, and recovery activities. For an SLA-disposition correction, retain a clear response record that lets the team verify what was detected, changed, and approved. NIST, April 3, 2025
- Freeze closure and discretionary remedy changes for both breach IDs.
- Preserve the original disposition and create a dated correction record.
- Rebuild breach A and breach B independently from their own source evidence.
- Obtain the required approver's decision for each corrected classification and remedy.
- Notify every owner of a credit or escalation, plus each closure that relied on the crossed record.
When should you recalculate an SLA value in Jira Service Management?
Separate a wrong business disposition from a wrong calculated SLA value. A remedy record can be wrong even if the service-management clock is correct. Conversely, a wrong SLA calculation can affect a classification or remedy decision.
For a single Jira Service Management issue with an incorrect SLA, Atlassian says an administrator can first use the Update SLAs refresh button in the issue's SLA panel. Its guidance says to use reconstruction only if that does not resolve the problem. Atlassian, June 25, 2026
Atlassian warns that destructive reconstruction deletes existing SLA data for specified tickets, recalculates against current goals, is not reversible, and can result in data loss. Do not use it as a shortcut for resolving a crossed remedy decision. Verify the current configuration and ticket state, plus the business approval path first. Atlassian, June 25, 2026
Which credits or escalations need to be reopened?
Trace forward from both old dispositions. Reopen any service credit, escalation, cure acceptance, customer notice, internal performance report, or closure record that named either breach ID or relied on its classification or remedy.
Mark each downstream record as confirmed, corrected, or still under review. A credit can remain correct after a disposition swap, but only if its governing remedy and approval still match the reconstructed breach.
NIST describes security and privacy controls as flexible and customizable within an organization-wide risk-management process. Apply the same discipline here: keep correction authority and evidence, with approvals and audit records clear enough to review later. NIST
- Credits issued or denied under either disposition.
- Escalations opened, closed, or downgraded because of either classification.
- Cure notices and cure acceptances tied to either breach.
- Closure approvals and related customer or performance records that cite either breach.
How do you close the correction?
Close the correction only when each breach has its own complete register entry and corrected disposition, with remedy decision and approval. The final reviewer should be able to swap the two records in a test and immediately identify why the result is wrong.
Keep the original decision and correction reason, with evidence links, approval, and downstream-notification record together. That gives the next reviewer a way to distinguish a legitimate revised decision from another crossed record.
An SLA defines expected service performance, measurement and approval methods, and consequences when performance levels are not met.
IBM, 2024-05-30For incorrect Jira Service Management SLA values, Atlassian recommends a non-destructive refresh first and warns that destructive reconstruction is not reversible and may result in data loss.
Atlassian, 2026-06-25NIST SP 800-61 Rev. 3 provides incident-response recommendations and considerations across cybersecurity risk-management activities.
National Institute of Standards and Technology, 2025-04-03NIST SP 800-53 Rev. 5 describes security and privacy controls as flexible and customizable within an organization-wide risk-management process.
National Institute of Standards and Technology (accessed), 2026-10-22Frequently asked questions
Do both SLA breach dispositions need to be reopened?
Yes. A crossed classification or remedy can affect both breaches. Reopen both records, preserve the originals, and rebuild each evidence trail independently before approving either disposition.
What evidence should determine the correct SLA classification?
Use the governing SLA version and exact commitment, measurement window and actual result, applicable dependencies or exclusions, plus records supporting notice and cure. Link each item to one breach ID.
Can we correct the credit without changing the classification?
Only if the rebuilt evidence confirms the classification was correct and the credit alone was misapplied. Record that conclusion and review every escalation or cure, plus each closure that relied on the old credit decision.
Should we run Jira SLA reconstruction to fix swapped remedies?
No. Jira SLA reconstruction addresses SLA calculation data. Atlassian warns that destructive reconstruction is not reversible and can result in data loss. Correct the business disposition separately, and use the least destructive calculation fix when a value itself is wrong.