How to Read a Managed IT Service Agreement and SLA: 14 Clauses to Check
Learn what to look for in a managed service agreement and SLA, including scope, response times, credits, ownership, liability, auto-renewal and exit terms.
A managed IT agreement is usually a master services agreement (MSA) plus a service level agreement (SLA) and a scope or order form. Read them for fourteen things: exactly what is covered, how response and resolution are defined, what remedy you get when targets are missed, who owns your data and credentials, how price can change, how long you are committed, how you can leave, and what the provider's liability is capped at. If any of these are vague or absent, ask for changes before you sign.
The documents you may receive
- Master services agreement: general legal terms such as payment, confidentiality, liability and termination.
- Service level agreement: targets for response and resolution, hours of coverage, availability and remedies.
- Order form or statement of work: the specific services, users, devices and prices.
- Business associate agreement or data processing addendum: if regulated or personal data is involved.
- Acceptable use or security policies: rules the provider expects you to follow.
Read them as one package. A promise in the sales presentation that does not appear in the documents does not exist.
14 clauses to check
1. Scope of services
Look for an itemized list of what is included and what is excluded: help desk, monitoring, patching, backup, security tools, vendor management, on-site visits and projects. If the document says "all IT support" without detail, ask for specifics.
2. Covered users, devices and locations
Does the price cover a stated number? How are additions and removals handled, and is there a minimum?
3. Hours of coverage
Business hours, extended hours and 24/7 emergencies are different. Check time zones, holidays and what counts as an emergency.
4. Response versus resolution
Response means acknowledgement; resolution means the problem is fixed. Many SLAs commit only to response. Look for severity levels, for example critical (business down), high, normal, low, with targets for each.
5. Measurement and reporting
How is performance measured, and will you receive reports? A target nobody measures has no value.
6. Remedies and service credits
What happens if the provider misses targets repeatedly? Credits against your invoice, a right to terminate, or nothing? Credits are often small, so the termination right for chronic failure is more meaningful.
7. Fees, billing and increases
Check payment terms, late fees, the annual escalator and what is billed separately. Look for language such as "prices may change on 30 days notice," which is not a cap.
8. Term and renewal
Common terms are 12, 24 or 36 months, frequently with automatic renewal for another term unless you give notice 60 to 120 days ahead. Calendar the notice date.
9. Termination rights
Check termination for convenience, termination for cause, the cure period and any early termination fee. Illustrative example: a fee equal to 100 percent of remaining payments on a 36-month agreement ended at month 12 would be 24 x the monthly fee, which can be very large.
10. Ownership of data, licenses and credentials
The agreement should state that you own your data, domain names, software licenses, administrator credentials and system documentation. Be wary of language that makes the provider the registrant or account owner.
11. Transition assistance
On exit, what does the provider deliver, in what format and by what date, and at what price? A transition clause protects you from being held hostage.
12. Security responsibilities
Who is responsible for securing which systems? Does the provider commit to controls such as multi-factor authentication for its staff, logging, and breach notification within a stated number of days? See cybersecurity and compliance.
13. Liability and indemnification
Most MSPs cap liability at the fees paid over a recent period, such as 12 months, and exclude consequential damages. Compare the cap with the potential loss from a major incident and ask whether the provider carries cyber liability and professional liability insurance that matches. Illustrative example: with a $3,000 monthly fee, a 12-month cap is $36,000, which may be far below the cost of a serious breach.
14. Subcontractors and tools
Ask whether the provider uses third parties, such as a remote security operations center or an offshore help desk, and whether your data may leave the country. Require notice of changes.
Quick reference table
| Clause | Green flag | Red flag |
|---|---|---|
| Scope | Itemized inclusions and exclusions | "All IT needs" |
| SLA | Severity levels with response and resolution targets | Response only, no severity levels |
| Remedies | Credits and termination right for repeated misses | No remedy |
| Price changes | Capped annual increase | Changes at provider's discretion |
| Ownership | Customer owns assets and credentials | Provider holds registrations |
| Exit | Documented transition assistance | No exit support or large unexplained fees |
| Liability | Cap tied to a meaningful amount, insurance disclosed | Zero liability for security failures |
What to ask for if the draft is one-sided
- A termination right if the provider misses SLA targets in three of six months.
- A cap on annual increases.
- Written confirmation of asset ownership.
- A transition clause with a defined timeline.
- A breach notification commitment, for example within 72 hours of discovery.
- Mutual rather than one-sided indemnification.
Providers often accept reasonable edits, especially from a client who has done homework. How to get the best deal lists other negotiable terms.
When to consult a professional
Contracts are legal documents. For a long or high-value agreement, or any agreement involving regulated data, have a business attorney review it. This guide is general information and not legal advice.
Frequently asked questions
What is a typical SLA response time?
It varies by provider and plan. Critical issues may have a target of an hour or less during coverage hours, and routine requests may have a same-day or next-business-day target. Compare the definition more than the number.
Are service credits meaningful?
Rarely, as a financial matter. They are useful mainly as a measurement and as evidence if you need to exercise a termination right.
Can I get out of auto-renewal?
Usually only by giving notice before the deadline. Set a reminder at least 120 days before the term ends.
What if the provider will not change the contract?
Weigh the risk. For a minor clause, you may accept it; for ownership, exit and security terms, consider another provider.
Sources and further reading
- Federal Trade Commission — guidance on contract terms and data security responsibilities.
- Small Business Administration — resources for reviewing vendor contracts.
- U.S. Department of Health and Human Services — business associate agreement information for HIPAA.
- Cybersecurity and Infrastructure Security Agency — managed service provider security guidance.
