What's actually in a managed IT contract? A 25-point checklist for comparing MSPs
By Jim Knotts, Managing Partner, Headway Strategy · Published · Last updated · 10 min read
A managed IT contract should spell out 24x7 help desk hours, written response SLAs, endpoint detection and response (EDR), a 24x7 security operations center (SOC), security information and event management (SIEM) log retention, backups with tested restores, patch management, and whether project work is included. If it isn't written down, it isn't included.
Most companies only read their MSP contract after something goes wrong. That's when they find out the ransomware recovery, or the migration they badly needed, was "out of scope."
So before you sign, get a straight answer to the question most proposals leave open. What do managed IT services include, in writing? Below is a 25-point checklist you can hold up against any proposal on your desk.
That includes ours. We mean that.
What do managed IT services typically include?
Managed IT services means an outside provider runs your IT for a recurring fee. What's "included" varies widely. Some contracts cover only help desk and monitoring. Complete ones cover three areas, day-to-day operations, cybersecurity, and continuity, so your business keeps running when something breaks.
| Operations | Cybersecurity | Continuity |
|---|---|---|
| 24x7 help desk for every user | Endpoint detection and response (EDR) on every device | Nightly server backups |
| Remote monitoring and management (RMM) of devices, servers, and network | 24x7 security operations center (SOC) | Microsoft 365 / Google Workspace backups |
| Operating system and third-party patching | SIEM with a written log retention period | Tested restores |
| Mobile device management (iOS/Android) | Remediation as well as alerts | Recovery targets in writing |
A slice
- Help desk, covered
- Monitoring, covered
- Security, not covered
- Backups, not covered
- Projects, not covered
Other areas are add-ons or separate quotes
A system
- Help desk, covered
- Monitoring, covered
- Security, covered
- Backups, covered
- Projects, covered
Every area sits in one written agreement
Managed services vs. break/fix
With break/fix, you call someone when something breaks and pay by the hour. With a managed service provider (MSP), you pay a recurring fee for them to keep things from breaking in the first place.
You buy a slice, not a system
That difference only helps if the scope is complete. Many MSPs sell a slice. Help desk here, monitoring there, security as an add-on tier.
The managed services agreement (MSA) and statement of work (SOW) look complete, right up until something happens outside the slice. That's when the change orders and surprise project quotes show up. A complete operations, security, and continuity scope closes those gaps before they cost you.
The managed IT contract checklist. What should be in writing?
This managed IT contract checklist covers 25 items across five areas. Support, operations, security, continuity, and commercial terms. Every item should appear in the written agreement, and a sales deck alone doesn't count. If a provider promises it in a meeting but won't put it in the contract, treat it as not included.
| # | Area | Checklist item | What "good" looks like |
|---|---|---|---|
| 1 | Support | Help desk hours | 24x7x365 phone and email for every user |
| 2 | Support | Response SLAs by priority | Written, e.g. Critical (such as a server outage) 15-30 min, Executive 1 hr, Urgent 4 business hrs, Normal 1 business day |
| 3 | Support | Response vs. resolution defined | First response time and time to resolution defined separately |
| 4 | Support | Who is covered | Every person, not a capped number of tickets |
| 5 | Support | After-hours work | Included, not billed as an exception |
| 6 | Operations | Patching (OS + third-party) | Tested before deployment, on a set monthly schedule |
| 7 | Operations | Monitoring | 24x7 coverage of devices, servers, network, and services |
| 8 | Operations | Mobile device management | iOS/Android included |
| 9 | Security | Security in the base agreement | Included, not an optional tier |
| 10 | Security | EDR on every device | Named product, full fleet coverage |
| 11 | Security | 24x7 SOC | Staffed, with a remediation commitment |
| 12 | Security | SIEM + log retention | Retention period written down (365 days is the bar) |
| 13 | Continuity | Server backups | Nightly |
| 14 | Continuity | Microsoft 365 / Google Workspace backups | SaaS data included |
| 15 | Continuity | Restore testing | Tested restores, not only job logs |
| 16 | Continuity | Recovery targets | RPO and RTO stated in writing |
| 17 | Commercial | Pricing model | Clear on what makes the price go up |
| 18 | Commercial | Exclusions | Written list of what's not covered |
| 19 | Commercial | Projects | Included, or a clear rate card |
| 20 | Commercial | Change orders | Written process, approved before work starts |
| 21 | Commercial | Onboarding/offboarding | Included, same-day access removal |
| 22 | Commercial | QBRs and reporting | Quarterly, with leadership |
| 23 | Commercial | Term and renewal | Stated length, no silent auto-renewal |
| 24 | Commercial | Exit, notice and data handoff | Notice period and data handoff in writing |
| 25 | Commercial | Documentation ownership | You own it, and you get it when you leave |
The checklist groups below explain what to look for in each area.
Support
Support is where you'll feel the contract every day. Response SLAs (service level agreements) should be written by priority, and "response" and "resolution" should be defined separately. Answering the phone isn't the same as fixing the problem.
Red flag. "Best effort" response times.
Operations
Patching and monitoring are the routine work that prevents most outages. Make sure third-party apps (browsers, PDF readers, utilities) are patched as well as the operating system. See what complete IT operations coverage looks like.
Red flag. "Patching" with no schedule and no testing.
Security
EDR, a 24x7 SOC, and a SIEM work as a system. EDR spots threats on devices, the SOC investigates and responds, and the SIEM keeps the logs you need to figure out what happened. Our guide to EDR vs. SOC vs. SIEM explains how the pieces fit together.
For a baseline on what small businesses should expect, see CISA's cyber guidance for small businesses. You can also see how we deliver cybersecurity.
Red flag. Retention not specified.
Continuity
Your Microsoft 365 data isn't fully protected just because it lives in the cloud. Under Microsoft's shared responsibility model, your data stays your responsibility, so it belongs in the backup scope.
Backups are only worth anything if they restore. Ask for your recovery point objective (RPO, how much data you could lose) and recovery time objective (RTO, how long until you're back up) in writing. See our continuity services.
Red flag. Backup "success" reports with no restore tests.
Commercial terms
Commercial terms are where gaps in a slice-based scope show up as cost, through exclusions, rate cards, and change orders. Onboarding and offboarding should be included, with same-day access removal when someone leaves.
Quarterly business reviews (QBRs) should happen with leadership, not just whoever happens to be available. Exit terms should cover notice, data handoff, and who owns the documentation.
Red flag. No written exit process.
How to compare two MSP proposals
- Put both proposals and their draft contracts side by side.
- Go down the 25 items and mark each one "in writing," "verbal only," or "missing."
- Send every "verbal only" and "missing" item back to the provider and ask them to put it in the contract.
- Compare what's left. The proposal with fewer gaps is usually the cheaper one, whatever the monthly number says.
What questions should you ask an MSP before signing?
The best questions to ask an MSP ask them to commit in writing. Ask what's excluded, how projects are billed, which security tools run on every device, how long logs are kept, when restores were last tested, and what happens to your data and documentation if you leave.
Pricing
| Question to ask | What to listen for |
|---|---|
| 1. What would you quote separately in year one? | A specific list, or "nothing except hardware and licensing." |
| 2. How are projects billed? | "Included," or a written rate card you can see today. |
| 3. What's on your exclusions list? | A short, written list. Not "we'll figure it out as we go." |
| 4. Do you make more money if we have more problems? | "No. Our price is the same whether you call us once or a hundred times." |
Security
| Question to ask | What to listen for |
|---|---|
| 5. Which EDR product runs on every device, and is it on all of them? | A named product and a full device count. |
| 6. Is your SOC staffed 24x7, and does it fix threats or only alert you? | "Staffed around the clock, and we remediate." |
| 7. How long do you keep security logs? | A specific number of days, written into the contract. |
| 8. Is security included, or is it a higher tier? | "Included for everyone, from day one." |
Support
| Question to ask | What to listen for |
|---|---|
| 9. What are your response times by priority, and are they in the contract? | Specific times per priority level, in writing. |
| 10. Is after-hours support included? | "Yes, 24x7x365, for every user." |
| 11. When did you last test a restore for a client like us? | A recent date, and what was restored. |
Exit
| Question to ask | What to listen for |
|---|---|
| 12. What happens to our data and documentation if we leave? | "It's yours. Here's the written handoff process." |
| 13. What's the notice period, and does the contract auto-renew? | A clear notice period and no silent renewals. |
Why these questions work
Each one turns a sales promise into something you can enforce. Hesitation is an answer too.
Question 4 is the one many providers don't expect. If a provider bills more when things break, its incentive runs against yours, and asking out loud brings that into the open.
What are the red flags in a managed IT contract?
The biggest red flags are vague "best effort" SLAs, security sold as an optional tier, "unlimited" support that excludes after-hours work, no stated log retention, backups with no restore testing, auto-renewing multi-year terms, and no written exit process. Any one of these means you're buying a slice.
- "Best effort" SLAs. If there's no number, there's no commitment.
- Security sold as an add-on. You don't get to choose when you'll be attacked, so security shouldn't be optional.
- "Unlimited" support with fine print. Unlimited until 5:01 p.m. isn't unlimited.
- No stated log retention. Without logs, nobody can tell you what happened during an incident.
- Backups with no restore testing. A backup you've never restored hasn't been proven.
- Auto-renewing multi-year terms. Miss the window and you're locked in for years.
- Surprise project quotes. If every improvement is a separate quote, the monthly fee isn't your real cost.
- No written exit process. Without one, changing providers gets harder and slower.
Put simply, a commitment that isn't in writing is hard to rely on at 2 a.m.
How does Headway's managed IT agreement compare?
One agreement, one price per person, every service included from day one. Help desk, device management, monitoring, patching, CrowdStrike EDR, a 24x7 SOC, SIEM with 365-day retention, backups, and project work. Scope, response commitments, and how we're measured are agreed in writing before work starts.
| Checklist item | Headway |
|---|---|
| 24x7x365 help desk for every user | ✓ |
| Written response SLAs by priority | ✓ |
| OS + third-party patching, tested monthly | ✓ |
| 24x7 monitoring of devices, servers, network, and services | ✓ |
| Mobile device management (iOS/Android) | ✓ |
| CrowdStrike Complete Defend EDR | ✓ |
| 24x7 SOC with remediation | ✓ |
| CrowdStrike Next-Gen SIEM, 365-day retention | ✓ |
| Nightly server backups + Microsoft 365 / Google Workspace backups | ✓ |
| Project work included | ✓ |
We call it written down before it starts. Scope, response commitments, and how we're measured are agreed in writing before work starts, rather than sorted out after the first invoice.
See the full list on our services page, check pricing, or read how much managed IT costs per user.
Frequently asked questions
The bottom line. If it's not in writing, it's not included
Every promise in a sales meeting should show up in the contract. If it doesn't, it isn't part of what you're buying.