Managed IT services: what to put in the contract with your IT provider in Malta

Under a break-fix arrangement you call someone when something fails and pay for the time. It is cheap in a quiet year and expensive in a bad one, and nobody is watching for problems before they happen. A managed service charges a monthly fee, usually per user or per device, and in return the provider monitors, patches and supports your systems and answers your helpdesk calls.

The monthly figure only means something once you know what sits inside it. Ask for a written scope covering which users, devices, sites and cloud services are included, and what is billed on top. Projects such as office moves, migrations or new hardware are often excluded and quoted separately.

• helpdesk: hours, channels and whether on-site visits are included
• patching and monitoring of laptops, servers and network equipment
• Microsoft 365 or Google Workspace administration
• starters and leavers: setting up and removing accounts and devices
• backup, and how often restores are tested
• security tools such as endpoint protection and multi-factor authentication
• managing your other suppliers, such as broadband and printer companies

A service level agreement should separate response time, which is when someone starts working on the problem, from resolution time, which is when it is fixed. Both should depend on severity: a whole office unable to work is not the same as one slow printer. Check the hours covered, since many providers work office hours only and charge extra outside them.

Ask what reporting you will get each month, such as tickets raised and closed, patch status and backup results. Service credits for missed targets are common in larger contracts; for a small business the more useful protection is often a short notice period if the service is poor.

Your provider will typically hold administrator rights across your systems, and attackers know it. The government's own factsheet on managed service providers describes attacks that went through a provider to reach its clients. Ask how the provider protects its remote management tools, whether its staff use multi-factor authentication, and who in its team can access your systems.

Cyber Essentials is a sensible baseline for both sides. It is the government-backed scheme, delivered for the NCSC by IASME, that covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus adds independent testing of those controls. Ask whether the provider is certified itself and whether it will take your business through certification.

A backup nobody has tried to restore is a hope, not a plan. Ask where your data is backed up, whether at least one copy is kept separately from your main systems so ransomware cannot encrypt it too, and how often a test restore is done. Agree two numbers in plain words: how much recent work you could afford to lose, and how long you could manage without your systems. Those answers decide what kind of backup you need and what it costs.

Cloud services such as Microsoft 365 keep your data available, but that is not the same as protecting you against accidental deletion, a malicious insider or a compromised account. Ask the provider what it recommends for your cloud data specifically.

Most providers include a data processing agreement; read what it says about sub-processors and where data is stored.

Plan the exit on day one. The contract should oblige the provider to hand over administrator credentials, documentation of your network and licences, and your data in a usable form, and to cooperate with the next provider. Keep the global administrator account of your Microsoft or Google tenant in your own hands, with the provider using its own named accounts.

The GDPR applies to your IT projects; in Malta the Information and Data Protection Commissioner (IDPC) is the supervisory authority. If a supplier processes personal data on your behalf, you need a data processing agreement.

Maltese companies are registered with the Malta Business Registry. Ask suppliers for their company and VAT numbers, and whether they work in English, Maltese or both.

Source: idpc.org.mt · eur-lex.europa.eu · mbr.mt

You confirm your mobile number with a text code and your email address with a link. We then show the request to businesses in your area, without your name or contact details. Only one business can take it on; it pays Offrano for the request, and it costs you nothing.

Before that business sees your details, we email you its name, address and phone number. We check only that it is a registered business, for example through its Malta Business Registry entry or VAT number, not the quality of its work. We cannot promise that a business will respond; if nobody takes the request within 21 days, we withdraw it. Offrano is not a party to any contract for the work.