What Is Included in a Managed IT Agreement?

A managed IT agreement should spell out six things in writing: exactly which people, devices, and systems are covered, how fast support responds, which security controls the provider implements, how backups and data ownership work, what is excluded from the monthly rate, and how the relationship ends. Most agreements gesture at these instead of stating them, and every vague clause favors the provider who wrote it.

Most businesses sign a managed IT agreement after reading the price and skimming the rest. Then the first dispute arrives, a slow response, a surprise invoice, a departing provider holding the passwords, and everyone discovers together what the document actually says, which is usually very little. Here is what a good agreement puts in writing, and what its absence tells you.

Does it define who and what is covered?

The scope section should read like an inventory, not a slogan. Look for:

The people covered, including remote staff and part-timers
The devices covered, by count: workstations, laptops, servers
Network equipment, firewalls, and Wi-Fi
Email tenants and mailboxes
Cloud services and line-of-business applications, and in what sense they’re covered

That last item deserves a straight answer. No provider operates your industry software the way your own staff does. What an honest agreement commits to is the environment the application depends on, the server or hosting it runs on, the workstations, the backups behind it, plus direct coordination with the software vendor when a problem sits inside the application. If a proposal claims deep expertise in every application you run, ask them to put the specifics in writing and watch what happens.

Two proposals with the same monthly price can cover very different inventories. Compare the lists, not the totals. Our managed IT services page shows what a full inclusion list looks like.

What happens when something breaks?

“Fast, friendly support” appears in every proposal and binds no one. The agreement should state:

Support hours, and the emergency path outside them
How your people reach a human being, not just a ticket portal
How issues are prioritized, and who decides
A response expectation for each priority level
What happens when the first response doesn’t fix it

Be wary of guaranteed fix times. Nobody can promise when a dead server comes back, and providers who guarantee resolution are usually measuring something else, like the time until an automated reply hits your inbox. What you want are honest, measured response numbers. Braintek’s typicals are about 60 seconds to answer the phone and roughly 2 hours to respond to an emailed ticket. Yours can come from any provider, but they have to be in the contract to count. For what good response actually looks like severity by severity, see how fast an IT company should respond.

Which security controls does the provider commit to?

Cyber insurance applications and customer security questionnaires have turned “our IT company handles security” into an answer nobody accepts. The agreement should name the controls the provider implements and maintains, at minimum:

Multi-factor authentication
Endpoint protection and email security
Patching, with a cadence
Monitoring and alerting
Encryption on laptops and mobile devices

Just as important, it should commit the provider to producing evidence: the reports and documentation showing each control exists and works. That paperwork is what fills out the insurance renewal and the customer questionnaire. If producing it isn’t a written deliverable, it’s a future invoice.

What do the backup and data ownership clauses say?

“Backups are included” is not a clause, it’s a hope. The agreement should specify what is backed up, how often, how long copies are kept, where they live outside your office, whether restores are actually tested, and who gets alerted when a backup job fails.

Then the part that matters most on your worst day: the agreement should state that your business owns all of its data, that administrative credentials and documentation belong to you, and that on termination everything comes back in a stated format, on a stated timeline, at a stated cost, with the provider deleting its copies afterward. Providers who resist writing down exit terms are telling you exactly how the exit will go.

What is excluded, and what does excluded cost?

Every managed agreement excludes something, and the common exclusions are reasonable: major projects, hardware, software licensing, cabling, sometimes after-hours work. The problem is never the exclusion. It’s meeting the exclusion for the first time on an invoice.

Ask for the exclusion list in writing, then ask what each excluded item costs when you inevitably need it. A provider with a clean answer has done this before. A provider who says “we’ll work that out when it comes up” is quoting you a number that will grow.

The red flags that end the conversation

Scope, response expectations, or exclusions that the provider won’t put in writing
No data ownership or data return language
Silence on breach notification
They won’t show you their standard terms until late in the sales process

That last one is an easy early test. We publish our client terms at braintek.com/legal so you can read them before anyone gets on a call. Terms shown up front are harder to quietly change later.

What should the price structure look like?

However a provider prices, the structure should be visible: what unit drives the bill, what’s in the unit rate, and what’s billed separately. Braintek prices by device and mailbox, about $150 to $250 per device per month plus $15 to $35 per mailbox, shared mailboxes free, Microsoft licensing billed separately so it can’t hide inside the support fee. The full structure is on our pricing page, and if you’re working out what your total IT spend should look like around that number, see what a 25, 50, or 100 employee company should budget for IT.

Reading an agreement right now?

Braintek has supported Houston and DFW businesses since 2002. Fully managed support fits companies of roughly 10 to 50 people, and larger organizations usually do better co-managed, with internal IT handling the day to day while we cover security, projects, and escalations. If you’re comparing proposals, or suspect your current agreement wouldn’t survive the checklist above, book a discovery call or just send the document over. We’ll tell you plainly what’s covered, what’s missing, and what to demand in writing. And if the review convinces you to change providers, switching is less disruptive than you think.

Comparing IT proposals right now?

Send us the agreement or proposal you're looking at. We'll point out what's vague, what's missing, and what to ask for in writing before you sign, whether you ever work with us or not.

FAQs

What should the scope section of a managed IT agreement list?

The specific people, devices, servers, network equipment, and cloud services the monthly rate covers, by count and by name where it matters. "Support for your network" is not a scope. If you can't tell from the document whether a new laptop or a remote employee is covered, neither can the provider, and that ambiguity gets resolved on an invoice.

What response commitments belong in the agreement?

Numbers, not adjectives. Support hours, how your staff reaches a person, how priorities are assigned, and a stated response expectation per priority level. As a reference point, Braintek typically answers phone calls in about 60 seconds and responds to emailed tickets in roughly 2 hours. Those are measured typicals, not guarantees, and other providers will differ. What matters is that their numbers are in the document.

Who owns our data if we leave?

You do, and the agreement should say so plainly. It should also state how data comes back on exit, in what format, on what timeline, at what cost, and that administrative passwords and documentation belong to you throughout the relationship, not just at the end.

What is normally excluded from the monthly rate?

Major projects like server migrations and office moves, hardware purchases, software licensing, cabling, and often after-hours project work. Exclusions are normal. Exclusions you discover on an invoice are not, so get the list in writing and compare inclusion lists before you compare prices.

Is Microsoft 365 licensing part of a managed IT agreement?

Usually billed separately, and it should be. Separating licensing from support keeps the support fee honest and stops licensing price changes from hiding inside your monthly bill. Braintek bills Microsoft licensing separately from the per device and per mailbox support rate for exactly this reason.

What does managed IT cost under an agreement like this?

As context, Braintek's managed IT runs about $150 to $250 per device per month plus $15 to $35 per mailbox, with shared mailboxes free and Microsoft licensing billed separately. Any rate only means something next to a written list of what it includes.