Why the contract matters more than the sales pitch
Every IT support provider promises responsive, proactive service. The contract and its service level agreement (SLA) are where those promises become obligations. Use this checklist before you sign, or when reviewing an existing contract.
1. Scope
- Which users, devices, servers, sites and cloud services are covered?
- How are new starters, extra devices and new sites added, and at what cost?
- Is support for Microsoft 365, phones, printers and line-of-business software included, or only liaison with their suppliers?
2. Hours of cover
- What are the standard support hours?
- Is out-of-hours cover included, available for an extra charge, or limited to emergencies?
- How do you reach someone outside normal hours?
3. Response and resolution times
- Are priority levels defined clearly, for example "whole business down" versus "one user affected"?
- Does the SLA commit to response times, resolution times or both? A response time only means someone acknowledges the ticket.
- What happens if targets are missed: service credits, escalation, or nothing?
4. How support is delivered
- How do staff raise tickets: phone, email, portal?
- Is there a named account manager or lead engineer?
- What is the escalation path for urgent or unresolved issues?
- When will an engineer attend on site, and is there an allowance or a charge?
5. Security responsibilities
Security failures often happen in the gap between what you assume the provider does and what the contract says. Check who is responsible for:
- patching operating systems, applications and firmware;
- endpoint protection and its monitoring;
- multi-factor authentication and admin account control;
- email security and security awareness training;
- supporting Cyber Essentials or other certifications.
6. Backups and recovery
- What is backed up, including Microsoft 365, how often and where?
- How often are restores tested, and do you see the results?
- What are the recovery commitments if a server or site is lost?
7. Reporting and reviews
- What reports do you receive, and how often?
- Are there regular service reviews and an IT roadmap?
8. Data protection
- An IT provider with access to your systems is usually a data processor under UK GDPR, so the contract must include the processor terms required by Article 28.
- Does the provider use subcontractors, and are they bound by the same terms?
- How will the provider notify you of a security incident affecting your data?
9. Ownership and access
- Your domain names, Microsoft 365 tenant and software licences should be registered to your business, not the provider.
- You should have break-glass admin access and up-to-date documentation you can obtain at any time.
10. Term, price and exit
- What is the minimum term, and is there automatic renewal?
- How much notice is required, and in what form?
- How are price increases handled during the term?
- What handover help does the provider give at the end, and is it chargeable? See our guide to switching IT support provider.
11. Liability and insurance
- What is the provider's liability cap, and does it bear any relation to the risks involved?
- Does the provider hold professional indemnity and cyber insurance?
Want a contract you can actually read?
Ask Omega IT for a written proposal covering scope, exclusions and response commitments. Request a quote, or read about our managed IT support and outsourced IT support.