Managed IT services: what to put in the contract with your IT provider

Under a break-fix arrangement you call someone when something fails and pay for the time. It is cheap in a quiet year and expensive in a bad one, and nobody is watching for problems before they happen. A managed service charges a monthly fee, usually per user or per device, and in return the provider monitors, patches and supports your systems and answers your helpdesk calls.

The monthly figure only means something once you know what sits inside it. Ask for a written scope covering which users, devices, sites and cloud services are included, and what is billed on top. Projects such as office moves, migrations or new hardware are often excluded and quoted separately.

• helpdesk: hours, channels and whether on-site visits are included
• patching and monitoring of laptops, servers and network equipment
• Microsoft 365 or Google Workspace administration
• starters and leavers: setting up and removing accounts and devices
• backup, and how often restores are tested
• security tools such as endpoint protection and multi-factor authentication
• managing your other suppliers, such as broadband and printer companies

A service level agreement should separate response time, which is when someone starts working on the problem, from resolution time, which is when it is fixed. Both should depend on severity: a whole office unable to work is not the same as one slow printer. Check the hours covered, since many providers work office hours only and charge extra outside them.

Ask what reporting you will get each month, such as tickets raised and closed, patch status and backup results. Service credits for missed targets are common in larger contracts; for a small business the more useful protection is often a short notice period if the service is poor.

Your provider will typically hold administrator rights across your systems, and attackers know it. The government's own factsheet on managed service providers describes attacks that went through a provider to reach its clients. Ask how the provider protects its remote management tools, whether its staff use multi-factor authentication, and who in its team can access your systems.

Cyber Essentials is a sensible baseline for both sides. It is the government-backed scheme, delivered for the NCSC by IASME, that covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent testing of those controls. Certification has to be renewed regularly, and certain central government and NHS contracts require suppliers to hold one of the two. Ask whether the provider is certified itself and whether it will take your business through certification.

The Cyber Security and Resilience Bill, now before Parliament, would bring medium-sized and large managed service providers under the Network and Information Systems Regulations, with the UK data protection regulator overseeing them. It had not become law when this page was last updated, so treat it as a direction of travel rather than a current duty.

A backup nobody has tried to restore is a hope, not a plan. Ask where your data is backed up, whether at least one copy is kept separately from your main systems so ransomware cannot encrypt it too, and how often a test restore is done. Agree two numbers in plain words: how much recent work you could afford to lose, and how long you could manage without your systems. Those answers decide what kind of backup you need and what it costs.

Cloud services such as Microsoft 365 keep your data available, but that is not the same as protecting you against accidental deletion, a malicious insider or a compromised account. Ask the provider what it recommends for your cloud data specifically.

The old analogue telephone network is being switched off. According to the government's connectivity timeline, all users of the Openreach PSTN need to be migrated to new services by 31 January 2027. That affects more than desk phones: alarm systems, lift emergency lines, door entry systems, franking machines and some card terminals may rely on analogue lines.

If you are moving to a VoIP phone system, ask the provider to audit every line you pay for and what is connected to it. Also ask how the system behaves in a power cut, since digital lines depend on powered equipment, and how your location is passed to the emergency services when someone dials 999.

Source: gov.uk

Because the provider can access personal data on your systems, it acts as a processor under UK GDPR, and you need a written contract with the terms the law requires. Most providers include a data processing agreement; read what it says about sub-processors and where data is stored.

Plan the exit on day one. The contract should oblige the provider to hand over administrator credentials, documentation of your network and licences, and your data in a usable form, and to cooperate with the next provider. Keep the global administrator account of your Microsoft or Google tenant in your own hands, with the provider using its own named accounts.

Your request describes your company size, the number of workstations and sites, what you need and whether you already have a provider. We confirm your phone number and email address, then offer the request anonymously to IT companies near you. One provider can buy it; after that it is gone from our marketplace. Before the provider sees your details, we email you its name, address and phone number.

It costs you nothing, and you are not obliged to accept any proposal. We cannot guarantee that a provider will take up your request; if none does within 21 days, it is withdrawn. Offrano only checks that the buyer is a registered business, so ask to speak to one or two of its current clients of a similar size before you sign.