Governance & ProvidersMarch 20, 20263 minBy Kevin Lefebvre

Managed IT contracts: what to check before signing

Before signing a managed IT contract, establish what is covered, who acts when something fails and what evidence confirms that the service has recovered. An attractive monthly fee cannot answer those questions.

Seven points to put in writing

PointQuestion to resolveUseful evidence
ScopeWhich users, sites, devices and applications are included?Inventory and explicit exclusions
SupportWhich hours, contact channels and on-site interventions are covered?Support schedule and charging rules
IncidentsWhat triggers each priority and which delay is promised?Measurable commitment and escalation route
BackupsWho monitors jobs and tests restoration?Scope, retention and restore-test record
Administrator accessCan the company regain control independently?Named accounts and tested recovery procedure
BudgetWhich licences, travel and projects cost extra?Recurring and one-off cost schedule
ExitWhat is transferred, when, in which format and at what cost?Handover procedure and acceptance criteria

A service excluded from the contract still needs an owner. If the business software is maintained by its vendor, specify who opens and follows the vendor ticket when the cause is uncertain.

Acknowledged is not restored

Acknowledgement, intervention and service restoration are separate milestones. The contract must identify the milestone being measured.
Concept diagram.
Read the diagram as text

INITIAL INFRA / SERVICE COMMITMENTS Acknowledged does not mean restored. Define the event and the delay being measured. 01 · Incident A service becomes unavailable. Define when the clock starts. 02 · Acknowledgement The request is recorded. Identify who investigates. 03 · Intervention Technical work begins. Define escalation and third parties. 04 · Restoration The service can be used. Validate the actual workflow. Make support hours, severity criteria and exclusions explicit.

A ticket acknowledgement confirms receipt. Intervention means work has started. Restoration means the agreed service is usable again, possibly through a documented workaround. A commitment to one does not automatically promise the others.

Ask the provider to apply its terms to a concrete scenario: the accounting service stops shortly before support closes. Who can declare a critical incident? Does the clock continue outside contracted hours? What happens while a third-party vendor is involved? The written answer exposes ambiguities before an actual outage.

Avoid inventing a universal recovery deadline. The required commitment depends on the business impact, architecture, available spares and service purchased.

Backups need an operational commitment

Identify the protected data, recovery-point frequency, retention and responsible person. Ask whether restoration work and periodic tests are included or separately charged. A green backup dashboard cannot establish how quickly the application will be usable.

For a test method, see setting up a reliable business backup. Keep the agreed recovery evidence with the contract's service review.

Data processing and access

Where a provider processes personal data on your behalf, determine the parties' actual roles and the applicable contractual obligations. For organisations subject to the GDPR, the CNIL's processor guidance explains the points to address; its sample clauses need adaptation to the real service.

List subcontractors and relevant hosting or support arrangements. Record who authorises access, how access ends and how incidents are communicated. Do not put passwords into the contract or an ordinary handover spreadsheet.

Use this worksheet

Questions to resolve before signing

Record the written answer and its reference in the quote or appendix. This is a technical scoping worksheet, not a contract ready for signature.

Complete the worksheet
1. Scope

Covered inventory, exclusions and treatment of new equipment.

2. Support

Hours, contact channel, travel, on-call cover and package limits.

3. Delays

Measured event, start and end, severity, exclusions and escalation.

4. Backup

Protected data, retention, monitoring and expected restoration evidence.

5. Access and data

Owners, permissions, confidentiality and incident handling.

6. Price

Takeover, options, extras, inventory changes and price review.

7. Exit

Notice, fees, formats, assistance and handover acceptance.

7 item(s) to verify; 0 gap(s) to address. The owner reviews the evidence and decides.

Nothing is sent or saved automatically. Download your answers before leaving the page.

A spoken answer or ticked box does not replace a written commitment suited to your situation.

Before choosing between proposals, use the managed IT cost comparison. Prepare the provider handover checklist at the same time: exit conditions are easier to agree before dependency builds.

View sources (3)