Most business owners sign a managed IT contract without fully understanding what they're agreeing to. Not because they're careless — because managed IT agreements are designed to be read quickly and signed, not studied. The monthly fee looks clear. The rest of the document assumes you'll figure things out as issues arise.
After more than two decades running managed IT services in Ohio, the questions I hear most often from businesses evaluating their options or coming off a bad experience all come back to the same thing: "We didn't realize that wasn't included." Here's what a contract should cover, what's commonly excluded, and what to insist on before you sign.
What should always be included
A legitimate managed IT agreement — sometimes called a Managed Services Agreement or MSA — should cover the following without additional billing:
Monitoring and alerting
Every device on your network — servers, workstations, network equipment — should be monitored continuously. When something goes wrong (a server runs out of disk space, a workstation drops off the network, a service stops responding), the provider should know about it before you do. This is the foundational service that justifies the word "managed." If your provider is learning about problems from your employees rather than their monitoring tools, they're not managing anything.
Helpdesk support
When your employees have IT problems, they need someone to call. The contract should specify hours of coverage, how to reach support, what response time to expect, and how tickets are prioritized. If the contract says "business hours" without defining what those are, get clarification in writing. "Business hours" at some providers means 9–5 with no holidays; at others, it means 7am–7pm with weekend coverage for emergencies.
Patch management
Keeping operating systems, security software, and core applications current is not optional — unpatched systems are responsible for the majority of successful cyberattacks. Your agreement should specify that patching is managed proactively, on a defined schedule, not reactively after something breaks. Ask specifically: how often are critical patches deployed, and what's the process for testing patches before they're pushed to production?
Endpoint protection
Antivirus is a minimum. Modern endpoint protection means an EDR (Endpoint Detection and Response) tool that can detect behavioral threats, not just signature-based ones. If your provider is still running traditional antivirus-only protection in 2026, that's a gap worth addressing directly. Most agreements now include some form of EDR — confirm it's included in your flat rate, not an add-on line item.
Backup monitoring
The backup running is not the same as the backup working. Your provider should be monitoring backup job completion daily and alerting on failures. This is different from backup storage — most agreements separate the monitoring of backups from the cost of the backup infrastructure itself. Make sure you understand which one is included.
A note on cybersecurity: Many managed IT agreements treat security as a separate product tier, not a core service. This matters — a provider managing your IT without managing your security is covering half the picture. Ask specifically whether endpoint detection, email security filtering, and security awareness training are included or add-ons.
What is commonly excluded — and frequently surprises businesses
| Service | Typically included? | Notes |
|---|---|---|
| Remote helpdesk support | Yes | Almost always covered in the monthly rate |
| On-site visits | Sometimes | Many agreements cap on-site at X hours/month and bill hourly above that |
| After-hours emergency response | Sometimes | Varies widely — get a specific definition of "emergency" and response time commitments |
| Hardware replacement | Rarely | Labor to swap hardware may be covered; hardware cost itself usually isn't |
| Software licensing | No | Microsoft 365, security tools, line-of-business apps are billed separately |
| Major projects (migrations, rollouts) | No | Server migrations, cloud moves, new office setups — almost always project-billed |
| Compliance audit preparation | No | HIPAA, CMMC, SOC 2 prep work is usually a separate engagement |
| End-user training | Rarely | Security awareness training is increasingly included; other training typically isn't |
The exclusions that surprise businesses most are on-site visits and after-hours response. A provider may advertise 24/7 support — but read the fine print. "24/7 monitoring" is not the same as "24/7 live human response." Make sure you understand what happens at 9pm on a Thursday when your file server goes down.
The Service Level Agreement — where the contract becomes real
The Service Level Agreement (SLA) is the section most businesses skip because it reads like legalese. Don't skip it. The SLA defines your response time guarantees, and response time is the single most important variable in whether your agreement actually works for you.
A strong SLA defines at minimum:
- Priority levels. What qualifies as a P1 emergency vs. a routine P3 request? "Server down" and "password reset" shouldn't sit in the same queue.
- Response time per priority. Specific numbers: "P1 emergencies receive a live response within 30 minutes." Not "as quickly as possible" or "same-day."
- When the clock starts. Does response time begin when you call, when you submit a ticket, or when a technician acknowledges the ticket? This matters — some providers start the clock when someone replies to the ticket, which could be after an automated acknowledgment.
- Remedies for SLA misses. What happens if the provider fails to meet their commitments? Service credits, escalation procedures, and termination rights are all fair to include.
If a provider won't put specific response time numbers in the contract, treat that as a direct predictor of your support experience. Vague commitments at the contract stage become vague service in practice.
Contract length and termination terms
The industry has shifted away from multi-year contracts as a requirement, and for good reason: a provider confident in their service quality doesn't need to lock you in for three years. Month-to-month agreements are increasingly common and signal a provider who expects to keep earning your business every month, not just for the first 90 days before the honeymoon period ends.
If a provider requires a long-term contract, at minimum negotiate these points:
- An escape clause for material service failures (defined in the SLA)
- A cap on early termination fees (30–60 days of remaining value, not the full contract value)
- Data portability rights — you should be able to get all documentation, credentials, and access back upon termination, with no holdback
Providers who resist data portability clauses are telling you something about how they plan to manage the end of the relationship. Any documentation, credentials, and account ownership tied to your business should be yours — not held as leverage.
The credential question: Before signing, ask directly: "At the end of our agreement, what documentation will you provide us, and in what format?" A trustworthy provider will hand over a complete IT asset inventory, all credentials held in your name, vendor account logins, and network diagrams. The answer to this question tells you a lot about how they run the relationship while you're in it, too.
What to ask for that most businesses don't
Most businesses spend their negotiation energy on price. The variables that actually determine whether the relationship works are these:
- A complete exclusions list. Ask for every service not included in the flat monthly rate, in writing, as a contract exhibit. If they won't provide one, assume everything unlisted is billable.
- A definition of "emergency." Get in writing what qualifies for immediate escalation vs. next-business-day response.
- An onboarding timeline. What happens in the first 30 days? What does the provider deliver as outputs of onboarding?
- References from businesses your size in your industry. Ask for three. If they can't produce them, consider why.
- A clear transition-out plan. What happens at the end of the agreement? Who owns what, and how long does handover take?
For Columbus businesses evaluating managed IT providers, the contract terms matter as much as the monthly rate. A low rate with vague SLAs, unlimited exclusions, and a three-year lock-in can cost far more than a fair-rate agreement that delivers consistent, accountable service.
If you're currently evaluating providers or thinking about switching, our switching guide walks through what a smooth transition looks like and the questions to ask at every stage.
Frequently asked questions
Want to see what our agreement actually covers?
We'll walk you through our service terms line by line — no surprises, no pressure. A 45-minute call gives you enough to make an informed comparison.
Schedule a Call