Managed IT Services: What a Useful SLA Should Contain

Scope

• Services included: help desk, monitoring, patching, backup, security operations, network and cloud administration.
• Assets covered, backed by an inventory that both parties can see.
• Users and sites, including branches and remote workers.
• Support hours and time zone, and what happens outside them.
• Remote and on-site support, with travel areas and charges.
• Exclusions: projects, hardware purchases and third-party applications.
• How new users, devices and sites are added, and at what price.

Priority definitions and targets

• Define "response" as a qualified engineer starting work, not an automated acknowledgement.
• Separate targets for restoring service or providing a workaround from targets for permanent fixes.
• Define when the clock pauses, for example while waiting for your staff, and when it restarts.
• Name escalation contacts at both organizations.

Proactive services

• Monitoring coverage and how alerts are handled.
• Patching schedules, maintenance windows and compliance targets.
• Backup schedules and regular restore tests with results shared.
• Vulnerability scanning and remediation timelines.
• Lifecycle and capacity reports that feed your budget planning.

Reporting and reviews

• Monthly reports: tickets by priority, targets met, trends and recurring problems.
• Patch compliance, backup success, restore tests and security events.
• Quarterly service reviews with improvement actions.
• Access to the ticketing system so you can verify the reports.

Security responsibilities

CISA and partner agencies from several countries have warned that managed service providers are attractive targets because access to one provider can lead to many customers. The agreement should require:

• MFA on all provider access to your systems.
• Named individual accounts, never shared logins.
• Least privilege and time-limited administrative access where possible.
• Logging of provider actions, with logs available to you.
• Separation between your environment and other customers' environments.
• Secure configuration and monitoring of remote management tools.
• Notification of security incidents affecting you within an agreed time.
• Disclosure and approval of subcontractors.

Data protection

• A data processing agreement setting out how the provider handles personal data on your behalf, as the Data Privacy Act's rules on outsourcing require.
• Confidentiality obligations and where data may be stored.
• Cooperation during personal data breaches, including information needed for notifications.

Remedies

• Service credits for missed targets, calculated simply.
• The right to terminate for repeated or serious failures.
• Credits should not be the only remedy for significant breaches.

Pricing and change

• A clear pricing model: per user, per device, fixed fee or a combination.
• Rates for out-of-scope work.
• How and when prices can change.

Exit and transition

• Handover of documentation: diagrams, configurations, asset lists and procedures.
• Transfer of administrator credentials, licences and vendor contracts held in the provider's name.
• Return or deletion of your data, with confirmation.
• Transition assistance for a defined period and fee.

Warning signs in a proposed agreement

• "Best efforts" in place of measurable targets.
• Response times with no definition of response.
• No reporting obligations.
• Shared administrator accounts.
• No exit or transition clause.