The IT Contract Terms That Actually Matter

A managed services agreement is mostly standard terms that will never be read again. A small number of clauses determine what happens in the situations that actually arise: a bad outage, a dispute about scope, a price rise, or wanting to leave.

These are the eight worth your lawyer's time, and the questions to ask about each. This is a commercial checklist, not legal advice.

1. What "included" actually means

The commonest source of dispute. The agreement says "unlimited support" and the schedule defines a scope that excludes most of what you expected.

Ask for:

• an explicit list of what is not included
• the trigger that converts work from the monthly fee to a project rate — hours, complexity, or the provider's discretion
• how new users, devices and locations are priced
• whether after-hours and emergency work is included, and the rate if not
• who supports your line-of-business applications, and who coordinates with the vendor

"We handle everything" in a sales conversation and a four-page exclusions schedule in the contract are not in conflict — the schedule wins.

2. Service levels with consequences

A target with no consequence is an aspiration. Check:

• Response versus resolution. Response time is easy to meet and means little. Is there a resolution commitment?
• Who sets priority? If the provider classifies severity, they control whether the clock is demanding.
• Business hours or elapsed hours? A four-hour response on a Friday evening may mean Monday.
• What happens on a miss? Service credits are standard and usually small. The more valuable remedy is a right to terminate after repeated failures.
• Who measures, and can you see the raw data? A provider reporting on its own performance should be able to show the underlying tickets.

3. Price escalation

Look for the annual increase mechanism. Common forms:

• a fixed percentage
• an inflation index
• "at the provider's discretion with notice"

The third is not a mechanism. If it is there, negotiate a cap. Over a three-year term, uncapped increases can change the economics substantially from what you compared.

Also check whether the rate applies per user — in which case growth compounds with the escalation.

4. Term, renewal and notice

• Initial term, and whether it auto-renews
• Notice period to prevent renewal. 90 days is common; some are longer
• When notice can be given — some agreements only permit it in a narrow window before renewal

The auto-renewal with a long notice period is the clause that most often traps organisations. Put the notice date in a calendar the day you sign, with a reminder a month before.

5. Exit and transition

The most important clause and the one least often negotiated, because it feels pessimistic at signing.

• What do you get back? Documentation, configurations, credentials, data — in what format, and by when?
• Who owns the documentation of your environment? If the provider owns it, you are buying it back or rebuilding it.
• Who owns the tooling? RMM agents, endpoint protection, backup. If licences are the provider's, you need replacements on day one. If they are yours, you keep them.
• Is there a transition service, and at what rate?
• Where is your backup data, and how do you get it?

Negotiate this before signing. Afterwards you have no leverage, and the cost of a difficult exit is what keeps organisations with providers they have outgrown.

6. Liability and insurance

Standard agreements cap liability at some multiple of fees paid — often a few months' worth. That is normal and usually not worth fighting, but understand it: if a provider's error causes a significant loss, your recovery is limited.

More useful than arguing the cap:

• confirm they carry cyber liability and professional indemnity insurance, and ask for certificates
• check whether the cap is carved out for breaches of confidentiality or gross negligence
• confirm who bears the cost of incident response if an incident originates with them

7. Security obligations, theirs

Your provider holds administrative access to your environment. That makes their security posture part of yours.

• Will they commit contractually to MFA and privileged access management on systems that reach yours?
• Do they notify you of security incidents affecting their own environment, and within what time?
• Will they sign your BAA, DPA or client security requirements?
• Do they subcontract, and to whom? Are those parties bound by the same terms?

If a provider will not commit in writing to controls they describe in a sales meeting, that is the answer to a different question.

8. Data handling and location

• Where is your data stored and processed, including backups?
• Who can access it, and from where? Offshore access is often a dealbreaker for regulated clients
• How long is it retained after termination, and how is it destroyed?
• What happens to it if the provider is acquired or becomes insolvent?

Two practical habits

Put the key dates in a calendar on signing day. Renewal date, notice deadline, price review. The most expensive contract mistakes are missed dates, not bad terms.

Keep the exclusions schedule where your team can find it. Most scope disputes start with someone asking for something reasonable that is out of scope, and nobody knowing until the invoice arrives.

The framing that helps

You are not negotiating against a provider's good intentions. Good providers behave well regardless of the contract, and the contract rarely gets read.

You are negotiating for the situations where good intentions are not enough: a serious outage, a dispute, an acquisition, a relationship that has gone wrong. Those are exactly the moments when the document is all you have.