What Should Be Included in an MSP Agreement?
A good MSP agreement should clearly define: scope of services (what's included vs. extra), response time SLAs, pricing structure, contract term and exit clauses, security responsibilities, and what happens when things go wrong. The best agreements are transparent about both what you're getting and what you're not.
Written by Alex Dayan, Founder of King of IT | Toronto Managed IT Services
1Scope of Services: What's Included
The Most Important Section
This defines what you're paying for. A good agreement clearly lists:
Typically Included (All-Inclusive):
Remote help desk support (phone, email, chat)
On-site support visits (specify number or unlimited)
Proactive monitoring (servers, workstations, network)
Patch management (OS and application updates)
Antivirus/endpoint protection
Backup monitoring and verification
Vendor coordination (ISP, phone, software vendors)
New user setup and offboarding
Basic reporting
Often Excluded (Project or Extra Cost):
Hardware procurement
Major projects (migrations, new office setup)
After-hours emergency support
Cloud migrations
Compliance audits
Security assessments
Training sessions
Line-of-business application support
Red Flag: Vague language like "IT support services" without specifics. If it's not explicitly listed, assume it's not included.
2Service Level Agreements (SLAs)
Response Time Commitments
SLAs define how quickly the MSP must respond to issues:
Typical SLA Tiers:
Critical (System Down)
Definition: Multiple users unable to work, server down, security breach
Response: 15-30 minutes
Resolution target: 4-8 hours
High (Significant Impact)
Definition: Key application down, one user completely unable to work
Response: 1-2 hours
Resolution target: 8-24 hours
Medium (Limited Impact)
Definition: Single user issue with workaround available
Response: 4-8 hours
Resolution target: 24-48 hours
Low (Minor)
Definition: Questions, minor issues, change requests
Response: 24 hours
Resolution target: 1 week
Important Distinctions:
**Response time** = when they acknowledge and start working
**Resolution time** = when the issue is actually fixed
Make sure both are defined
Red Flag: No SLAs at all, or SLAs with no consequences for missing them.
3Pricing and Payment Terms
Understand What You're Paying
Common Pricing Models:
Per-User Pricing ($100-$250/user/month)
Most common for SMBs
Scales with your headcount
Easy to budget
Per-Device Pricing ($30-$75/device/month)
Based on number of managed devices
Can be cheaper for companies with few devices per user
More complex to track
Tiered/Bundled Pricing
Different service levels at different prices
Basic, Standard, Premium tiers
Make sure you understand what's in each tier
What to Look For:
Clear breakdown of what's included at your price point
How price changes as you add/remove users
Any minimum commitment (user count or spend)
Payment terms (monthly, quarterly, annually)
Late payment penalties
Hidden Costs to Watch For:
"Project" work billed hourly on top of monthly fee
After-hours support at premium rates
Travel charges for on-site visits
Hardware markup percentages
Software licensing management fees
"Emergency" designation that costs extra
Red Flag: Monthly fee that seems low but generates constant "out of scope" charges.
4Contract Term and Exit Clauses
Know How to Get Out
Typical Terms:
Month-to-month (most flexible, often slightly higher price)
1-year (standard, moderate discount)
2-3 year (bigger discount, more risk)
Exit Clauses to Negotiate:
Termination for Convenience
How much notice required? (30-90 days typical)
Any early termination fees?
Are fees reasonable or punitive?
Termination for Cause
What constitutes "cause"? (repeated SLA failures, security breach)
How many failures before termination allowed?
Is there a cure period?
Transition Assistance
Will they help transition to new provider?
Will they provide documentation?
Will they hand over all passwords and credentials?
How long will they assist? At what cost?
Data and IP Ownership
You own your data—make sure it says so
Right to export all data in usable format
No holding data hostage
Red Flag: Long-term contract with expensive early termination fees and no termination for cause clause.
King of IT Tip: We offer month-to-month agreements because we believe clients should stay because of good service, not because they're locked in.
5Security Responsibilities
Who's Responsible for What?
MSP Should Be Responsible For:
Deploying and managing endpoint protection
Patch management and updates
Monitoring for security threats
Responding to security alerts
Implementing security best practices
Advising on security improvements
Typically Shared Responsibility:
Security awareness training (MSP provides, you ensure attendance)
Policy compliance (MSP configures, you enforce)
Access management (MSP implements, you approve)
You're Responsible For:
Employee compliance with policies
Reporting suspicious activity
Making security decisions
Funding security improvements
Physical security
Security Commitments to Look For:
Specific security tools included (name brands)
24/7 security monitoring (or just business hours?)
Incident response procedures
Breach notification requirements
Security certifications (SOC 2, ISO 27001)
Background checks on MSP staff
Red Flag: Security is mentioned as "best practices" without specific commitments or tools listed.
6Additional Terms to Include
Other Important Clauses:
Insurance Requirements
MSP should carry cyber liability insurance
Errors & omissions (E&O) coverage
Ask for certificate of insurance
Confidentiality/NDA
MSP will have access to sensitive data
Clear confidentiality obligations
Survives termination of agreement
Compliance Support
If you have compliance requirements (PIPEDA, HIPAA, SOC 2)
What compliance support is included?
What's extra cost?
Change Management
How are changes to scope handled?
Who approves changes?
How are additional costs communicated?
Escalation Procedures
Who to contact if issues aren't resolved?
Escalation path and timeframes
Account manager assignment
Reporting Requirements
Monthly/quarterly reports included?
What metrics are reported?
How are reports delivered?
Business Continuity
What happens if the MSP goes out of business?
Source code escrow for proprietary tools?
Transition assistance guaranteed?
MSP Agreement Checklist:
[ ] Clear scope of included services
[ ] Defined SLAs with consequences
[ ] Transparent pricing structure
[ ] Reasonable contract term and exit clauses
[ ] Security responsibilities defined
[ ] Insurance and confidentiality covered
[ ] Escalation and reporting procedures
[ ] Transition assistance guaranteed