Read the IT contract before it reads you

The short answer

A managed services agreement (MSA) is the contract between your business and an IT provider. A good one states exactly what is covered, how fast the provider responds, who is responsible for each security task, that your data and documentation belong to you, and how you leave. The usual structure is a master agreement with legal terms plus a statement of work or service schedule listing scope and price. The biggest red flags are vague scope, “best effort” response times, long auto-renewals and no handover process at exit. This is general information, not legal advice: have your attorney review any contract before you sign.

How managed services agreements are structured

Most providers use two or three documents that work together.

• Master services agreement. The legal terms: liability, confidentiality, payment, term, termination and dispute resolution. It usually stays the same for the life of the relationship.
• Statement of work or service schedule. What is covered, for which users, devices and locations, and the monthly price. It changes as you grow.
• Service level agreement. Response and resolution targets by priority, and what happens when they are missed. Sometimes it is part of the schedule.

Read them together. A strong service schedule can be undercut by a master agreement that lets the provider change scope with 30 days’ notice.

Ten clauses to look for

1. Scope by name. Covered users, devices, locations and applications, listed or counted. “All IT needs” is not a scope.
2. Inclusions and exclusions. Help desk, patching, backups, security tools and vendor management on one side; projects, hardware and licenses on the other. Gray areas such as new-user setup should be stated.
3. Service levels. Response targets by priority, business hours versus after-hours, and how priority is decided.
4. Security responsibilities. CISA’s joint advisory on managed service providers tells customers to make sure contracts identify ownership of security roles, such as hardening, detection and incident response.
5. Incident notification. CISA also advises that contracts specify how and when the provider notifies you of an incident affecting your environment.
6. Backups and recovery. What is backed up, how often, where copies are stored, and how often restores are tested. CISA recommends backups that meet your resilience and disaster recovery requirements, stored where they can be retrieved, such as the cloud or a location separated from your network.
7. Access controls. Provider accounts protected with multi-factor authentication, limited to what the provider manages, and never shared across customers.
8. Data and documentation ownership. Your data, configurations, passwords and network documentation belong to you and are handed over on request.
9. Price changes. How per-user counts are trued up, how often prices can rise, and how much notice you get.
10. Term and exit. Length, renewal, notice period, termination for cause, and an offboarding plan with a fixed fee or rate.

Red flags to push back on

• Best-effort response. No written response times means no commitment.
• Automatic renewal for multiple years with a narrow cancellation window. Ask for annual renewal or month-to-month after the first term.
• Early termination fees equal to the remaining contract. Common, but negotiable, especially if the provider misses service levels.
• Everything outside the help desk is a project. If user changes, routine updates or restore tests are billable, the low monthly fee is misleading.
• Ownership of your documentation or accounts. Some agreements let the provider keep admin credentials or tool configurations. Your Microsoft 365 or Google Workspace tenant should be registered to your business, with your own global admin account.
• Liability caps with no security duties. A cap is normal. A cap combined with no stated security responsibilities leaves you carrying all the risk.
• Vague subcontracting. CISA advises understanding the provider’s supply chain, including subcontractors with access to your systems.

Service levels: what good looks like

A useful SLA separates response from resolution and ties both to priority. A typical structure:

• Critical: the business or a whole office cannot work. Fastest response, continuous work until resolved.
• High: one person or one key system is down.
• Normal: something is broken but there is a workaround.
• Request: new users, installs and changes, scheduled in advance.

Ask for monthly reporting on response times and ticket volumes. A provider confident in its service will share the numbers. For reference, JLB USA replies within 5 minutes by email or phone and starts a screen share within an hour.

Before you renegotiate or sign, it helps to know what you actually have. Our free Technology Health Assessment takes 30 minutes of data collection and gives you a plain-language report the next day on IT operations, cybersecurity, spending and business continuity. Many owners use it as the baseline for a new agreement.

Pricing terms worth reading twice

Most disputes with IT providers are about money, not service. Read the pricing language line by line.

• True-ups. How often is the user or device count checked, and does it go down as well as up when people leave?
• Minimums. Some agreements bill a minimum number of users even if you shrink. Know the floor.
• Onboarding. Is the one-time setup fee fixed, or billed by the hour with no cap?
• Licenses. Are Microsoft 365 or Google Workspace licenses resold with a markup, passed through at cost, or bought by you directly? Each is fine if it is stated.
• Out-of-scope rates. The hourly rate for projects and after-hours work should be written down, along with who approves extra work before it starts.
• Increases. Look for a cap on annual increases and at least 60 days’ notice.

Exit terms that protect you

Every relationship ends eventually. Write the ending while everyone is on good terms.

• A written offboarding plan with a time frame, such as 30 days.
• Handover of all passwords, admin accounts, network diagrams, license records and vendor contacts.
• Removal of provider tools and agents, and confirmation that provider accounts are disabled. CISA notes this step is often overlooked.
• Export of backups and tickets in a usable format.
• A fixed fee or hourly rate for offboarding work, stated in advance.

Before you sign: a checklist

1. Count your users, devices and locations so the scope matches reality.
2. Ask for a sample monthly report and a sample onboarding plan.
3. Check your cyber-insurance requirements and make sure the agreement covers them.
4. Confirm who holds the global admin account for your cloud tenant.
5. Have your attorney review liability, indemnity and termination clauses.

JLB USA provides managed IT for businesses with roughly 25 to 100 employees, priced on users, locations, systems and support needs, and our cybersecurity services include monitored backups, tested restores and a written recovery plan. For a broader look at pricing, see what managed IT costs per month.

Keep reading

• New employee IT onboarding checklist: day one ready, every time
• How often should business computers be replaced?
• Co-managed IT services: how to split the work with your in-house IT person
• Chattanooga IT support: a buyer's guide for growing businesses

Related services

• Managed IT services
• Free Technology Health Assessment
• Cybersecurity services
• What managed IT costs per month