What should I look for in a managed service provider contract?
A good managed service provider contract clearly defines scope and exclusions, service levels by priority, security responsibilities on both sides, incident notification and handling, who holds administrator access, your ownership of data and documentation, pricing and change rules, and exit terms including handover. If any of these are vague, clarify them in writing before you sign.
Scope and exclusions
The scope section decides what you are actually buying. Look for a clear list of covered users, devices, locations, applications and services, and an equally clear list of exclusions.
Pay particular attention to what is treated as a project. Migrations, new office setups, major upgrades and compliance work are often billed separately, and that is where budgets drift.
Clauses that matter most
- Service levels: response and resolution targets by priority, support hours, and what happens when targets are missed
- Security responsibilities: MFA on all provider access, how the provider protects its own tools, patching commitments
- Incident handling: how fast the provider notifies you, who leads, and access to logs
- Administrative access: you retain top-level admin ownership of your tenant and systems; provider access is named and logged
- Data and documentation: you own your data, configurations, passwords and documentation
- Subcontractors: whether any work is outsourced and to whom
- Pricing: per user, per device or fixed fee, how changes in headcount are billed, and annual increase terms
- Term and exit: notice period, renewal terms, termination assistance and handover obligations
Use CISA's guidance as your checklist
CISA's Risk Considerations for Managed Service Provider Customers is written for exactly this decision. It stresses that outsourcing does not absolve your organization of its risk management responsibilities, and recommends contract terms that address service levels, security responsibilities, incident management and logging, along with requiring multi-factor authentication for provider access.
If a provider resists putting its security commitments in writing, treat that as information about how it will behave during an incident.
Plan the exit before you sign
The end of a contract is when weak terms hurt. Make sure the agreement obliges the provider to return all credentials, documentation, configurations and data in usable form, to cooperate with an incoming provider for a defined period, and to remove its tools and access on a set schedule.
Check auto-renewal clauses and early termination fees. A long auto-renewing term with steep exit costs reduces your leverage for the life of the relationship.
Questions to ask before signing
Get the answers in the contract or an attached statement of work, not only in the sales proposal.
- Which services are fixed-fee and which are billed hourly or as projects?
- How are new users, devices and locations priced mid-term?
- What is the notification commitment if the provider itself is breached?
- Who are the named account lead and primary technicians?
- What reporting will we receive each month?
- What exactly is handed over, and how quickly, if we leave?
Common follow-up questions
Should an MSP contract include financial penalties for missed SLAs?
Service credits are common and can help, but they rarely compensate for a real outage. More important are clear targets, transparent reporting and the right to terminate if service consistently falls short. Ask how the provider has handled missed targets with other clients.
Who should own our Microsoft 365 global administrator account?
Your company should. Keep at least one emergency administrator account under your own control and give the provider named, least-privilege admin accounts protected by MFA, with activity logged. That way you can always regain control of your tenant.
How long should an MSP contract be?
Terms vary. Longer terms can bring lower pricing but reduce flexibility. Whatever the length, insist on reasonable termination rights for poor performance, clear renewal notice periods and documented handover obligations so you are never locked in by your own data.
LAN Service Group provides managed IT for small and mid-size businesses under agreements that define scope, service levels, security responsibilities and handover terms up front.
Talk to LAN Service Group (888) 281-7243