Quick answer: A good managed IT services agreement should spell out exactly what is included and excluded, state response and resolution time commitments in writing, include security controls (multifactor authentication, endpoint detection and response, monitoring, backups) in the base fee rather than as add-ons, confirm that your data, documentation, and administrative credentials belong to you, define what happens during an incident, set a fair pricing model with no surprise out-of-scope billing, and describe the exit: notice period, transition assistance, and return of everything on termination. If any of those is missing or vague, negotiate it before you sign.
Most businesses evaluate IT providers on the sales conversation and sign the agreement without reading it closely. Then the first dispute reveals that “24/7 support” meant an answering service, “all-inclusive” excluded the things that break, and the provider owns the documentation of your own network. This checklist is the one we wish every buyer brought to the table, including when they are evaluating us.
1. Scope: what is included, and what is not
The agreement should list the covered services, systems, locations, and user count explicitly. Just as important, it should list exclusions. Common items that providers treat as out of scope, and bill separately: projects and migrations, new office setups, after-hours work, on-site visits, security incident response, hardware procurement, and anything involving a system the provider did not set up. Industry analyses find out-of-scope charges can inflate a managed IT bill 30 to 50 percent beyond the quoted monthly fee, so the exclusion list is where the true price hides.
What to ask: “Show me the last three months of invoices for a client my size, including anything billed outside the monthly fee.”
2. Service levels: response and resolution, in numbers
A service-level agreement should define, by priority, how fast the provider acknowledges an issue (response time) and how fast it is fixed (resolution target), with the hours those commitments apply to and what happens if they are missed. Beware of agreements that define response time as “an automated ticket acknowledgment” or that quote only a target with no remedy.
| What to look for | Weak agreement | Strong agreement |
|---|---|---|
| Response time | “We respond promptly” | Minutes or hours by priority, measured from ticket creation, with a human, not an auto-reply |
| Resolution target | Not stated | Stated by priority, with escalation path |
| Coverage hours | “24/7 support” undefined | Standard hours plus a defined emergency process with real after-hours engineers |
| Measurement | Not shared | Monthly reporting of actual response and resolution performance |
| Remedy | None | Service credits or termination rights for repeated misses |
For reference, we publish a 10-minute average response time across all clients, standard support from 7 a.m. to 7 p.m. Pacific, and 24/7 emergency response, and we report performance to clients. Any serious provider can give you equivalent numbers.
3. Security: included, not upsold
In 2026, the FBI recorded $20.877 billion in cybercrime losses, up 26 percent in a year, with $3.05 billion from business email compromise alone. An IT agreement that treats security as optional add-ons is leaving the most likely source of loss outside the contract. The base agreement should include enforced multifactor authentication, endpoint detection and response on every device, email security against phishing and impersonation, patching on a defined cycle, backups with scheduled restore testing, security awareness training, and monitoring with a defined response. Ask whether monitoring is performed by the provider’s own staff or a subcontracted third party, and get the answer in writing. Our baseline of what cybersecurity a small business needs is a reasonable minimum to check against.
4. Incident response: who does what when something goes wrong
The agreement should define what happens during a security incident: how it is detected, who is notified and how quickly, what containment the provider performs on its own authority, how evidence is preserved, how recovery proceeds, and whether incident response work is included or billed as a project. A provider that cannot describe this on paper will not perform it well at 2 a.m.
5. Ownership: your data, your documentation, your keys
This clause prevents the most damaging form of vendor lock-in. The agreement should state that you own all data, all network and system documentation, all administrative credentials, all licenses purchased on your behalf, and your domain and DNS registrations, and that the provider will hand them over on request at any time, not only at termination. Providers that resist this clause are telling you how the relationship will end.
6. Pricing model and change control
Per-user, per-device, and flat-rate models are all legitimate. What matters is predictability: how the fee changes as you add or remove users, what the annual increase cap is, what triggers a project quote versus inclusion, and that quoted prices for licenses (Microsoft 365, security tools) are passed through transparently. Comprehensive managed IT in 2026 runs roughly $100 to $250 per user per month in the US, and quotes below about $80 almost always exclude security or after-hours coverage. If a quote looks too good, ask what is missing.
7. Compliance and documentation
If you operate under HIPAA, SEC or state financial rules, NIST 800-171 and CMMC, or cyber insurance requirements, the agreement should state that the provider will implement and document the technical controls those frameworks require and produce evidence (reports, logs, attestations) on request. Confirm the provider’s own posture too: a SOC 2 Type II report is the standard proof that the company managing your security has had its own security audited.
8. Reporting and reviews
Expect monthly or quarterly reporting on ticket volume, response and resolution performance, patch status, backup results, security events, and hardware lifecycle, plus a scheduled strategic review with a named senior contact. Reporting is how you verify the agreement is being honored without auditing it yourself.
9. Term, termination, and transition
Look for a defined initial term, a reasonable notice period (30 to 90 days is typical), termination rights for repeated service-level failures, and, critically, a transition clause obligating the provider to cooperate with your next provider, return all documentation and credentials, and revoke their own access on a defined date. Auto-renewal clauses should be flagged and calendared.
10. Insurance and liability
The provider should carry cyber liability and errors-and-omissions insurance and be willing to show certificates. Review the limitation-of-liability clause with counsel; it is standard for providers to cap liability, but the cap and the carve-outs should be reasonable for the risk they are managing on your behalf.
The one-page version
Before signing, confirm you can answer yes to all of these: I know exactly what is excluded. Response and resolution times are in numbers with hours and remedies. Security is in the base fee, with monitoring by the provider’s own staff. The incident process is written. I own my data, documentation, credentials, and domains. Pricing is predictable and increases are capped. Compliance evidence is deliverable. Reporting is scheduled. I know how to leave, and the provider must help me do it.
How this maps to CyberDuo’s agreements
We built our agreements around this checklist because we were tired of taking over environments from providers whose contracts failed it. Our managed services include the full security baseline in the base fee, define response and emergency commitments in writing, state that documentation (kept in IT Glue) and credentials belong to the client, and include transition cooperation on exit. We hold our own SOC 2 Type II attestation, run an in-house 24/7 security operations center, and serve regulated businesses of 50 to 200 users across Los Angeles, Orange County, and San Diego. What we decline to do is also in writing.
Frequently asked questions
What is a good SLA for IT support? For most businesses: a human response within 15 to 30 minutes for critical issues and within a few hours for routine ones, resolution targets stated by priority, defined coverage hours with a real emergency process, monthly performance reporting, and remedies for repeated misses. Faster is available; vague is unacceptable.
What should be included in a managed IT services agreement? Defined scope and exclusions, response and resolution commitments, security controls in the base fee, an incident response process, client ownership of data and credentials, a predictable pricing model, compliance documentation, regular reporting, and clear termination and transition terms.
What are red flags in an MSP contract? Undefined “24/7 support,” long exclusion lists or none at all, security sold as add-ons, no stated response times, provider ownership of documentation or credentials, uncapped annual increases, and no transition assistance on exit.
Should security be a separate contract from IT support? It can be, but splitting them creates a gap between two vendors where incidents fall through. If you do use two providers, define in each contract who owns detection, containment, and notification.
Can I negotiate an MSP agreement? Yes. Scope, service levels, ownership language, increase caps, and transition clauses are all routinely negotiated. A provider unwilling to put commitments in writing is giving you useful information.
Bring this checklist to every provider you evaluate, including us.
