What a managed services agreement should include: a checklist

A managed services provider looks after your applications and platforms day to day: monitoring, support, fixes and improvements. The quality of that relationship depends heavily on what is written down at the start. Use this checklist when you are comparing providers or reviewing an agreement.

This is general information, not legal advice. Have your own adviser look over the final contract.

1. Scope: what is covered, and what is not

• A clear list of the systems and environments covered.
• What counts as routine support, and what counts as a change or a project.
• What is explicitly excluded. Surprises usually come from the exclusions.

2. Service levels you can measure

• Response times and resolution targets by severity, for example critical, high, medium and low, with plain definitions of each.
• Hours of coverage: business hours, extended hours or around the clock, and what happens outside them.
• How the provider measures and reports performance against these targets.
• What happens when a target is missed: a conversation, a credit, or something else.

3. Monitoring and incident handling

• What is monitored, and how issues are detected.
• How incidents are raised, communicated and escalated.
• A written process for major incidents, including who tells you what, and how quickly.
• A short post-incident review for serious issues, saying what happened and what changes.

4. Changes, fixes and improvements

• How you request changes, and how they are prioritised.
• Whether a set amount of improvement work is included each month.
• How urgent fixes are handled and who approves them.

5. Maintenance, patching and upgrades

• Who applies security patches, how often, and on what schedule.
• Planned maintenance windows and how much notice you get.
• How version upgrades and end-of-life software are handled.

6. Backup and recovery

• What is backed up, how often, and where it is stored.
• How quickly you can recover (the recovery time) and how much data you could lose (the recovery point).
• How often recovery is actually tested.

7. Security and privacy

• Who is responsible for what, written down.
• How access is controlled, and how staff accounts are managed when people join or leave.
• Where your data is stored and processed.
• How a data breach would be handled and communicated. If personal information is involved, ask how the provider supports your obligations under Australian privacy law.

8. Reporting and review

• A regular report covering incidents, response times, changes and the health of your systems.
• A scheduled review meeting, so problems and improvements are discussed before they become disputes.

9. People and contacts

• Who your main contact is, and who covers when they are away.
• Whether you will be dealing with people who understand your systems, not only a ticket queue.

10. Pricing

• What the fixed fee covers, and how extra work is charged.
• Any minimum term, and how price increases are handled.
• Whether you can scale up or down.

11. Ownership and getting out

• You should own your data, your code and your documentation.
• Handover: what the provider must hand back at the end, in what form, and how long it takes.
• Notice periods and any early-exit costs.
• How knowledge is transferred if you change provider.

Questions to ask before you sign

1. Can I see a sample monthly report?
2. Can you walk me through how your last major incident was handled?
3. What do customers usually find they needed but did not ask for?
4. What would you need from us to make this work well?

A provider who is open and specific in answering these is usually a good sign. If you would like a second opinion on an agreement you are considering, or help with ongoing support for systems you already have, we are happy to talk.