What Should Be Included in a Managed IT Support Contract?

A solid managed IT support contract should clearly define what's covered, how quickly you'll get help, who owns your data and passwords, and what happens if either side wants to end the agreement — vague contracts cause the most painful disputes.

Many SMEs sign IT contracts without reading past the price. In our experience, that's where problems start: not because providers are acting in bad faith, but because "IT support" is a broad term, and unless the contract nails down specifics, both sides can end up with different expectations. This guide sets out the clauses worth checking, whether you're signing with a new provider or reviewing an existing one. If you haven't yet worked out what a fair price looks like, read our companion guide on how managed IT support is priced first.

1. Scope of service

This is the foundation of the contract and the single biggest source of disputes when it's vague. It should clearly state:

• Which users, devices and locations are covered
• What's included (helpdesk, patching, monitoring, backup, security tools) and what isn't
• Whether new starters, leavers and hardware changes are included or charged separately
• Whether out-of-hours or emergency support is covered, and on what terms

Common mistake

Assuming "unlimited support" means unlimited everything. Many contracts cap included hours for larger projects (like office moves or major upgrades) while unlimited helpdesk tickets cover day-to-day issues only. Ask for the exact wording.

2. Response and resolution times

A contract should set out target response times (how quickly someone acknowledges your issue) and, ideally, resolution times or at least resolution processes, usually banded by priority — for example, critical outages versus minor requests. Ask:

• Are these targets contractual commitments or aspirational guidelines?
• What happens if they're missed — is there a service credit, or just an apology?
• Are response times different for out-of-hours issues?

3. Security responsibilities

Cyber security should not be an afterthought bolted onto a support contract. The contract should be explicit about:

• Who is responsible for patching operating systems and software
• What security tools are included (antivirus, email filtering, multi-factor authentication enforcement)
• Whether the provider actively monitors for threats, or only reacts when told something's wrong
• Who is responsible for user access reviews and offboarding leavers promptly

If you're working towards a certification, check whether the provider understands the requirements — our guide on what Cyber Essentials actually requires is a useful reference point when reviewing this section. For broader security context, see our cyber security page.

4. Backup and disaster recovery

Ask the contract to specify:

• What is backed up, how often, and where it's stored
• Retention periods (how far back you can restore)
• Whether restores are tested, and how often
• Recovery time expectations if a server, laptop or the whole business needs to be restored

Don't assume Microsoft 365 itself is backed up as standard — it isn't, in the way most people expect. See our separate guide on whether Microsoft 365 backs up your data for detail.

5. Data, passwords and asset ownership

This clause matters far more than most business owners realise until they try to leave a provider. The contract should confirm, in plain terms, that:

• Your data, domain names, licences and configurations belong to you, not the provider
• You have a right to full documentation and credentials on request or on exit
• The provider will not withhold access as leverage in a dispute

This links directly to what happens at offboarding — see our guide on what your old IT provider should hand over when you leave.

6. Pricing structure and change terms

Beyond the headline price, check:

• How and when prices can change (annual reviews, RPI-linked increases, etc.)
• What triggers additional charges (new users, extra sites, out-of-scope projects)
• Whether pricing is per user, per device or tiered — see our pricing guide for how these models work

7. Contract term, notice period and exit terms

Element	What to check
Initial term	Typical SME contracts run 12–36 months; longer terms should come with clear justification (e.g. hardware financing)
Notice period	How much notice is required to end the contract, and from when it can be given
Auto-renewal	Whether the contract automatically rolls over and what notice prevents that
Exit assistance	Whether the provider is contractually obliged to help with a smooth handover
Early termination fees	Whether leaving early triggers a charge, and how it's calculated

A contract with a long lock-in and vague exit terms is a red flag regardless of price. If you're currently mid-way through leaving a provider, our guide on switching IT providers without disruption walks through the practical steps.

8. Reporting and reviews

Good contracts include a commitment to regular reporting — ticket volumes, patching status, security posture — and periodic strategic reviews, not just reactive support. This is particularly relevant if you're weighing outsourced support against building an internal team; see our comparison of internal, outsourced and co-managed IT.

Recommendations

Before signing, ask for the contract in full (not just a summary), read the scope and exit sections closely, and don't be afraid to ask for clauses to be clarified or amended — a reasonable provider will expect that conversation. In our experience, the contracts that cause the fewest problems later are the ones that are specific rather than broadly reassuring.

Related questions

• How much should managed IT support cost in the UK?
• What should your old IT provider hand over when you leave?
• How to switch IT providers without disrupting your business

If you'd like a second opinion on a contract you've been sent, or want to see how we structure ours, visit our managed IT support page or get in touch.