A managed IT services agreement covers the systems your entire business depends on. In 2022, the Cybersecurity and Infrastructure Security Agency (CISA) and its international partners published a joint advisory on attacks against managed service providers.
One of their recommendations had nothing to do with software. It told managed IT services providers to state plainly which services a customer is purchasing, which the customer is not purchasing, and all contingency plans for incident response and recovery.
In This Article:
|
The Core Services Included in Most Managed IT Agreements
Two providers can quote the same monthly rate per user and yet differ on the services they offer. Most managed IT services contracts rest on five pillars:
- Proactive monitoring and management puts agents on servers, workstations, and network hardware that report continuously, so failing drives and dropped circuits surface before anyone notices a slowdown. Confirm with your provider what happens when an alert fires at 2 a.m.
- Because after-hours coverage is priced differently, help desk and end-user support needs defined intake channels and a clear split between remote work and on-site visits.
- Security management starts with endpoint protection, anti-malware, mail filtering, and patch management. Managed detection and response, log aggregation, and penetration testing usually sit in a higher tier, so you’ll want to verify which tier your monthly fee buys.
- Data backup and recovery require looking beyond “daily backups” to the retention window, where the second copy lives, and to how often restores are tested. National Institute of Standards and Technology (NIST) guidance treats recovery testing as a scheduled exercise, making it essential to identify who runs it, such as by role or job title.
- Routine maintenance and updates need to cover firmware and operating system patching, application updates, and hardware lifecycle tracking. This will help keep an environment from drifting into an unsupported state.
How Service Level Agreements Define Response and Accountability
A managed IT service level agreement (SLA) makes intent measurable. Without this agreement, a promise to respond quickly cannot be enforced.
A workable SLA sorts incidents into severity tiers because a site-wide outage and a single user with a printer problem do not warrant the same response time. The SLA also separates response from resolution. This means it uses different metrics for when the provider needs to acknowledge an issue and when they’ve resolved it.
Providers who publish a single number tend to publish the shorter response figure, which says nothing about how long a server stays down, for example. The SLA should also state coverage hours, the after-hours escalation path and contacts, uptime targets, and how often you receive reporting.
The 2022 CISA advisory adds a provision many businesses forget to request. Your contract should detail how and when the provider notifies you of a security incident affecting your environment, including a compromise that begins inside the provider’s own systems.
Common Add-Ons and Optional Services
Several services sit outside most base plans and are priced separately. This typically includes cloud migration, telephony, structured cabling, surveillance systems, project rollouts, and hardware procurement.
Strategic consulting, often sold as a virtual CIO engagement, is also typically a separate line. Advanced security work follows the same pattern, including managed detection and response, awareness training, and compliance support for the Health Insurance Portability and Accountability Act (HIPAA), the Cybersecurity Maturity Model Certification (CMMC), and the Payment Card Industry Data Security Standard (PCI DSS).
What Usually Falls Outside a Standard Agreement
Third-party licensing, hardware purchases, and warranty replacements typically sit outside the monthly fee. This is also true for support for systems past their vendor end-of-life date, since providers can’t patch what a manufacturer no longer maintains.
If your own staff makes changes, such as editing a firewall rule or installing software that breaks something, the repair usually sits outside the flat fee. It is billed hourly, so consider bringing your provider in before you touch infrastructure. Nearly every agreement also sets user, device, and site counts, so adding staff or a location changes the scope of managed IT services and the rate.
What To Ask a Provider Before You Sign an Agreement
Before you sign an agreement, ask the provider these questions:
- What is covered by the flat monthly fee, and what is billed hourly?
- What are the guaranteed response times at each severity level?
- Who owns our data, documentation, and administrative credentials?
- What is the contract term, how does renewal work, and what does termination require?
- How does pricing change as we add or remove users, devices, or locations?
- What does onboarding include, and what happens at transition-out?
The third question is particularly important. Documentation and credentials that live only in a provider’s tooling make leaving expensive, so managed services contract terms should confirm both belong to you and are exportable on request.
A provider that stores or transmits protected health information is a business associate under HIPAA even when that data is encrypted. The provider cannot read it, and the business associate agreement is a separate document. For defense contractors, an external service provider’s services fall within the scope of the contractor’s own CMMC assessment.
Why a Clear Agreement Protects Both Sides
A clear agreement gives you predictable costs, response commitments you can hold your provider to, and a defined escalation path when a system fails. The provider gets defined scope, which helps them plan and staff properly.
The value of managed IT services comes from knowing where responsibility sits before an incident happens. Advantage Tech has specialized in IT solutions and services since the early 2000s, serving 25 different verticals. We build agreements around named deliverables, including 24/7 remote monitoring and management, IT help desk support, antivirus and spam filtering, data backup and recovery, and ongoing maintenance.
Contact Advantage Tech to review your environment and receive a clearly defined managed IT services agreement with response commitments in writing.