What should a managed IT services contract include?

A managed IT services contract is the formal agreement that defines how an organisation and its IT provider will work together. It should translate the proposed service into precise, measurable terms, so both parties understand what is included, what is excluded, how decisions are made and what happens if circumstances change.

1. A clear description of the service

The agreement should include a service schedule that describes the environment covered by the contract. This may identify users, sites, devices, servers, cloud services, networks and other technology included within the managed service. It should also state whether the service applies to company-owned equipment only or includes approved personal devices and third-party systems.

Definitions are important. Terms such as “incident”, “service request”, “critical system”, “user” and “supported device” should have an agreed meaning. Without these definitions, the same event could be treated as an included service by one party and chargeable project work by the other.

2. A distinction between recurring services and additional work

Many managed IT agreements cover routine management but not every technology-related activity. The contract should separate the recurring service from chargeable projects, consultancy and out-of-scope work. Examples might include a new office setup, major infrastructure changes, extensive data recovery, specialist software support or work caused by unauthorised changes.

It should explain how additional work is requested, estimated, approved and invoiced. A suitable change process normally records the requested outcome, expected effort, dependencies, price and approval from an authorised contact before work begins.

3. Practical service management arrangements

The contract should explain how the organisation raises issues and requests, which people may contact the provider and what information should be supplied. It should also identify the agreed communication channels and escalation route for unresolved or high-impact matters.

Where service levels are included, they should be specific rather than described with broad phrases such as “prompt support”. A useful schedule may define priority categories, the method used to record the start of an incident, target acknowledgement or restoration points, exclusions and the circumstances in which a target is paused. It should distinguish between restoring access to a service and permanently resolving the underlying cause.

4. Security and access controls

The agreement should allocate responsibility for security activities in practical terms. It may cover account administration, privileged access, patch management, vulnerability handling, endpoint controls, backup oversight, security monitoring and incident coordination, depending on the service purchased.

It should also set out how the provider receives access to systems. This includes approval requirements, named or role-based accounts, multi-factor authentication where applicable, password handling, logging and the removal of access when it is no longer needed. The customer remains responsible for areas that only it can control, such as approving users, reporting suspected incidents and following agreed security procedures.

5. Data protection and information handling

Where the provider processes personal data on the organisation’s behalf, the contract should be supported by the appropriate data processing terms. These should address the purpose and duration of processing, the categories of data involved, confidentiality, security measures, sub-processors, assistance with data protection obligations and arrangements at the end of the agreement.

The parties should identify where data may be stored or accessed and how information is returned, transferred or securely deleted. Confidentiality provisions should cover business information, credentials, technical documentation and any other sensitive material exchanged during the relationship.

6. Customer responsibilities and dependencies

A managed service depends on the customer providing accurate information, suitable access, decision-makers and timely approvals. The contract should record these obligations rather than leaving them as assumptions. It may also specify requirements for electrical power, connectivity, supported hardware, software licensing, physical access and the maintenance of manufacturer or supplier relationships.

This section should explain the effect of customer-controlled dependencies. For example, a provider may be unable to manage a system properly if an account is withheld, a licence has expired or an unsupported device remains connected to the network. Making these dependencies explicit helps prevent disagreements about responsibility.

7. Charges, invoicing and price changes

The financial schedule should show how recurring charges are calculated and what they include. It should clarify whether pricing is based on users, devices, sites, service components or another agreed measure. It should also identify one-off charges, expenses, taxes where applicable, payment dates and the treatment of work outside the contracted scope.

The agreement should state how changes to the supported environment affect the price. It should cover the process for adding or removing users, devices, locations and services, as well as any review or indexation mechanism that the parties have agreed. Any minimum commitment, notice requirement or early termination charge should be stated plainly.

8. Resilience, backups and continuity

If backup, recovery or continuity services form part of the agreement, the contract should describe the systems covered, the information retained, the testing approach and the responsibilities of each party. It should not assume that a backup is the same as a tested recovery capability.

The document should identify who decides when a recovery process is invoked, how recovery priorities are agreed and which activities remain the customer’s responsibility. If continuity work is excluded, that should be stated so the organisation can address the gap separately.

9. Governance and service review

A contract should establish how the relationship is reviewed. This may include service reports, risk discussions, asset reviews, outstanding actions, recurring incidents, planned changes and recommendations for improvement. It should identify the representatives who can make operational decisions and the route for resolving disputes.

Review provisions are particularly useful when the organisation grows, opens another site, adopts new cloud services or changes its risk requirements. They allow the service schedule and commercial terms to be updated through documented agreement rather than informal discussions.

10. Ownership, liability and use of information

The contract should confirm who owns hardware, software licences, documentation, configurations, data and materials created during the engagement. It should address intellectual property, confidentiality, liability limits, insurance requirements and the handling of losses or claims. These provisions need careful review because they determine how risk is allocated when something goes wrong.

11. Term, renewal and exit arrangements

The agreement should state its start date, initial term, renewal method and notice requirements. It should explain the consequences of non-payment, serious breach, insolvency or other events that may justify termination.

Exit terms are just as important as the service description. They should cover the return or transfer of data, credentials and documentation, cooperation with a replacement provider, removal of access, equipment ownership, outstanding charges and secure deletion. A defined transition process reduces the risk of disruption when the relationship ends.

Before signing, a small business should compare the contract with the provider’s proposal, service schedule, security documentation and pricing assumptions. Any statement that influenced the decision should appear in the agreement or an incorporated schedule. S2 Technology Group can help organisations around Stourbridge, Kinver, Wordsley, Kingswinford, Kidderminster, Halesowen, Dudley and neighbouring areas assess whether the proposed terms reflect their operational and technology requirements.