An IT support agreement is the contract that sets out what your technology provider will manage, how quickly they must respond when something fails, what you pay, who owns the data, and how either side can end the relationship. Get the document right and most future disagreements never happen. Leave it vague and you will argue about whether a server migration was “included” while your email is down. The sections below walk through the provisions that belong in every agreement, and the places where the fine print quietly shifts risk onto you.
Scope of Services
Scope is the backbone of the contract. It names every service the provider will deliver on a recurring basis and, just as importantly, what falls outside the contract. Recurring services typically include remote help desk support, on-site troubleshooting, network monitoring across routers and firewalls, cybersecurity threat detection, cloud environment administration, and hardware maintenance for servers and workstations. Each category should be specific enough that neither party can later claim a gray area. “Network management” means nothing useful unless the contract lists the actual equipment and systems the provider is responsible for.
Exclusions deserve equal attention. Legacy systems the provider did not build, software not listed in the contract’s asset schedule, and employee-owned personal devices are common carve-outs. If a device or application is not on the list, the provider has no obligation to touch it and no liability if it fails. That is why the asset schedule you prepare before signing matters so much: anything missing from it drops out of coverage.
Project Work vs. Recurring Maintenance
Most agreements draw a hard line between day-to-day maintenance and one-time projects like office buildouts, server migrations, or major system upgrades. Projects have a defined start, a defined end, and a separate price. They are almost never included in a flat monthly fee. The contract should state explicitly that project work requires a separate statement of work with its own scope, timeline, and cost estimate. Without that language, you will eventually find yourself arguing over whether moving your file server to the cloud was “maintenance” or a “project.”
Service Level Agreements
The Service Level Agreement, usually called the SLA, is where the contract gets teeth. It sets measurable performance benchmarks the provider must hit and defines the financial consequences when they miss. Without an SLA, you have no objective way to tell whether your provider is performing or coasting.
Uptime is the most common metric. A 99.9% availability target sounds impressive until you realize it still allows roughly eight hours and 46 minutes of downtime per year. That figure is a widely used baseline for network and server reliability, but the contract should specify how uptime is calculated. Providers typically exclude scheduled maintenance windows from the formula. If they take systems offline for planned updates at 2 a.m. on a Sunday, that downtime does not count against their percentage. The agreement should define when maintenance windows are allowed, how much advance notice the provider must give, and a cap on total maintenance hours per month.
Response and resolution times are usually tiered by severity. A total system outage that shuts down the business belongs in a different urgency bucket than a single employee who cannot connect to a printer. A well-structured SLA might require the provider to acknowledge a critical outage within 15 minutes and restore service within four hours, while a low-priority ticket gets a next-business-day response. These tiers push the provider to allocate resources based on actual business impact rather than first-come, first-served.
When the provider misses an SLA target, the standard remedy is a service credit, which is a percentage discount applied to the next billing cycle. Credits are not refunds; they reduce what you owe going forward. Most agreements cap total credits at somewhere between 10% and 25% of that period’s fees and position credits as your sole financial remedy for downtime. That cap is worth negotiating. If your provider consistently misses targets, a 10% credit on a monthly bill does not come close to covering the revenue you lost during the outage.
Force Majeure
Every SLA should address events outside anyone’s control: natural disasters, widespread power grid failures, cyberattacks on upstream internet providers, and similar disruptions. A force majeure clause suspends SLA obligations for the duration of the event. The provider should be required to notify you promptly when a force majeure event occurs and to resume normal service with the least possible delay once the event ends. Many agreements also give you the right to terminate the affected service if the disruption lasts beyond a set number of consecutive days, commonly 30.
Pricing and Payment
How you pay shapes both your budget predictability and the provider’s incentives. The common structures are:
- Flat-rate managed services. A fixed monthly fee covers all included labor regardless of how many tickets your team submits. The most predictable model, and the one most commonly associated with managed service providers.
- Per-user pricing. Your invoice scales with headcount. Each employee who accesses the help desk costs a set monthly amount, so the total fluctuates as you hire or downsize.
- Block hours. You prepay for a bank of hours, say 20 per month, and any work beyond that bank is billed at an agreed hourly rate. Unused hours may or may not roll over, depending on the contract.
- Time and materials. A purely reactive model where you pay for each hour of labor plus the cost of any replacement parts. No monthly commitment, but costs are unpredictable.
Payment terms commonly follow a Net 30 schedule, giving you 30 days from the invoice date to pay. Many providers require ACH transfers to keep cash flow steady and reduce billing overhead. If you pay by credit card, expect a processing surcharge between 1.5% and 3.5% of the transaction amount.
After-Hours and Emergency Rates
Standard support hours are typically Monday through Friday during business hours. Work outside that window almost always carries a premium. The most common structures are time-and-a-half or double the normal hourly rate, often with a minimum charge of one to two hours regardless of how quickly the issue is resolved. Some providers add a flat emergency dispatch fee on top of the hourly rate. If your business operates outside normal hours or cannot tolerate overnight outages, negotiate 24/7 coverage into the base agreement rather than paying emergency rates repeatedly.
Early Termination Fees
Most agreements include a penalty for canceling before the contract term expires. A common structure is 50% of the fees remaining in the term, though this is negotiable. The early termination fee gives the provider confidence in the revenue commitment that justified their upfront investment in onboarding your account. On a multi-year agreement, this number decides how expensive it will be to leave if the relationship does not work out.
Data Privacy and Regulatory Compliance
Your provider will inevitably access sensitive information: employee records, customer data, financial systems, and in some cases health records. The agreement needs to address how that data is handled, because if something goes wrong the legal exposure lands on you, not just the provider.
HIPAA and Healthcare Data
If your organization is a healthcare provider, health plan, or healthcare clearinghouse, or if you handle protected health information for any reason, federal law requires a Business Associate Agreement before your IT provider touches any of that data. You must obtain written assurance that the provider will safeguard protected health information, and the contract must spell out exactly what uses and disclosures are permitted.1eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information The agreement must also require the provider to report any unauthorized disclosure, use appropriate security safeguards, and ensure that any subcontractors who access the data agree to the same restrictions.2eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements Skipping this step is a regulatory violation, not just a risk.
Data Processing Addendums
Even outside healthcare, a growing number of state and federal privacy frameworks require specific contract language when a third party processes personal information on your behalf. These provisions, often packaged as a Data Processing Addendum, define the provider’s role as a data processor, restrict how they can use the personal information they access, and require them to notify you of any data breach. The addendum should also address subprocessor management if your provider relies on other vendors, such as cloud storage platforms, to deliver their services. If your business collects personal information from consumers, check whether the privacy laws that apply impose specific contract requirements for your service providers. Many do.
Liability, Indemnification, and Insurance
This is the section most businesses skim and most providers draft aggressively. It determines who pays when something goes catastrophically wrong: a data breach, a botched migration that destroys files, or a misconfigured firewall that lets ransomware in.
Liability Caps
Nearly every agreement caps the provider’s total financial exposure. The most common cap is a multiple of fees paid, often the total amount you paid over the preceding 12 months. If you pay $5,000 a month, the provider’s maximum liability for any claim tops out at $60,000, regardless of your actual losses. This is where negotiation matters most. A provider managing critical infrastructure for a business that generates millions in revenue should carry a cap that reflects the actual risk, not just the contract price.
Consequential Damages Waivers
Alongside the cap, most agreements include a mutual waiver of consequential damages. Neither side can sue the other for lost profits, lost business opportunities, or other indirect losses. The waiver typically applies regardless of whether the claim is based on contract breach, negligence, or any other legal theory. The practical impact is significant: if the provider’s negligence causes a week-long outage and you lose $200,000 in revenue, the waiver may prevent you from recovering any of it. Negotiate carve-outs for situations that justify full exposure, including breaches of confidentiality, gross negligence, and willful misconduct.
Insurance Requirements
The contract should require the provider to maintain cyber liability and errors-and-omissions insurance at coverage levels proportionate to the services they deliver. This gives you a backstop if the provider causes a breach or makes a professional mistake that damages your business. Ask for a certificate of insurance naming your organization as an additional insured, and require the provider to notify you if coverage lapses.
Confidentiality and Data Ownership
An IT provider gets deep access to your business: network diagrams, administrative passwords, financial system configurations, employee data, and customer records. The agreement should include a mutual confidentiality obligation covering all non-public information exchanged during the engagement. Both sides agree not to disclose or use the other party’s confidential information for any purpose beyond delivering or receiving the contracted services.
Data ownership deserves its own clause. The contract should state unambiguously that your data remains your property throughout the engagement and after it ends. This includes customer records, email archives, file server contents, and any databases the provider manages on your behalf. The provider should have no ownership claim and no right to retain any of it once the contract terminates. Custom scripts, configurations, and documentation the provider creates specifically for your environment occupy a gray area; address ownership of those deliverables explicitly rather than discovering the dispute during an ugly exit.
Termination and Transition
How a contract ends matters as much as how it begins. Without clear termination provisions, you can find yourself locked into a bad relationship or scrambling to recover administrative access to your own systems.
Termination for Convenience
Either party can end the agreement by providing written notice within a specified window, commonly 60 or 90 days. The terminating party does not need to justify the decision, but the notice period gives both sides time to prepare for the transition. Termination for convenience usually triggers the early termination fee if the contract term has not expired.
Termination for Cause
When one party breaches the agreement, the other can terminate for cause. Most contracts require the breaching party to receive written notice and a cure period, typically 30 days, to fix the problem before termination takes effect. Certain breaches are considered incurable and allow immediate termination without a cure opportunity: insolvency, bankruptcy, fraud, willful misconduct, and breaches of confidentiality involving trade secrets. Termination for cause due to the provider’s failure generally waives any early termination fee.
Transition Obligations
The agreement should spell out exactly what the provider must hand over when the relationship ends. At minimum, that includes all administrative passwords, network documentation, configuration backups, and any data the provider stores on your behalf. Set a specific deadline for the handover; 10 or 15 business days after termination is common. Some providers charge an hourly rate for transition assistance, so the agreement should either cap those fees or include a set number of transition hours at no additional cost. Avoid any arrangement where the exiting provider and the incoming provider are expected to share administrative access simultaneously. That creates accountability gaps and finger-pointing if something breaks during the handover.
Dispute Resolution
In a multi-year technology relationship, disagreements will arise. A structured resolution process prevents small disputes from escalating into expensive litigation. Most agreements use a tiered approach: the parties first attempt to resolve the issue through direct negotiation between designated contacts, then escalate to formal mediation if negotiation fails, and finally proceed to binding arbitration if mediation is unsuccessful. Arbitration is faster and less expensive than courtroom litigation, and the award is enforceable in court. The agreement should specify which arbitration rules govern, where the proceedings take place, and how costs are split.
What to Do Before You Sign
The quality of the contract depends heavily on the information you give the provider before it is drafted. The provider uses your environment data to price the engagement accurately and to populate the technical schedules and asset lists. Errors at this stage create billing disputes and coverage gaps later. Expect to assemble:
- A hardware inventory covering every desktop, laptop, server, printer, and network device, with serial numbers and warranty expiration dates. This determines what falls under maintenance.
- A software and subscription registry listing all active licenses and cloud subscriptions, so you avoid paying the provider to manage tools you have already decommissioned.
- A current user count, since per-user pricing ties directly to it and flat-rate agreements use it to set staffing levels.
- Office locations where on-site support may be needed, including local network details.
- Administrative credentials for firewalls, domain controllers, cloud admin consoles, and any other systems the provider will manage, handed over through a secure, documented process.
- A network topology diagram showing VPNs, subnets, wireless access points, and internet circuits.
Many providers supply a client intake form or site audit checklist to standardize this collection. Take it seriously. A sloppy inventory leads to devices falling outside the contract’s coverage, which means you pay out-of-scope rates when those devices eventually need attention.
Once terms are finalized, have legal counsel review the complete agreement before anyone signs. The review should focus on liability limitations, termination rights, data ownership provisions, and any automatic renewal language. Skipping legal review to save a few hundred dollars on an agreement that governs years of critical infrastructure is a false economy.
Signing can happen electronically. Federal law provides that a contract cannot be denied legal effect solely because it was formed using an electronic signature.3Office of the Law Revision Counsel. 15 USC Ch. 96 – Electronic Signatures in Global and National Commerce Platforms like DocuSign and Adobe Sign satisfy this requirement. Physical mailing of signed copies remains valid if digital options are not available.
Watch the Auto-Renewal Window
Many agreements renew automatically for successive terms, often one year, unless one party delivers written notice of termination within a narrow window before the current term expires. That window is commonly 30 to 60 days. Miss it and you are locked in for another full term and subject to the early termination fee if you want out. Calendar a reminder well ahead of every renewal deadline so the decision to continue is deliberate rather than an oversight.