What does a managed IT services contract include, and what should you check before signing?
A managed IT services contract hands the day-to-day running of your IT to a provider for a fixed monthly fee: user support, computers and servers, the network, Microsoft 365, backup and security. Two contracts mostly differ in what is written down: what is excluded, the service hours, the term and notice period, and what you get back the day you leave. Ask for these points in writing before you sign.
Managed IT or on-demand support: what is the difference?
With on-demand support, you call a technician when something breaks and pay for the time spent. Between two breakdowns, nobody looks at your computers, updates or backups.
With managed IT services, you pay a monthly fee and the provider becomes responsible for looking after your IT: it monitors it, keeps it up to date and steps in before a breakdown stops work. This is what we call managed IT services. The contract sets out what that fee covers, and that is the document to read.
What a managed IT contract usually includes
Contracts vary, but the same building blocks come up almost every time. For each one, here is what it covers and what our own contract says about it.
User support
A stuck employee calls, emails or opens a request, and a technician takes control of their computer remotely. The contract should say how you ask for help and during which hours. At DeepIT, that is Monday to Friday, 9 am to 5:30 pm, through an app installed on every computer, by email or by phone.
Computers
The provider installs updates, monitors the machines, diagnoses and fixes faults, whether they come from software or hardware. Good practice: the list of covered devices is attached to the contract. Ours has an ‘Equipment’ section filled in after the initial audit.
Servers
The server often holds the shared files and the business software. The provider keeps it running, manages accounts and access rights, and adjusts its setup as the business changes.
Network and internet connection
The office network, Wi-Fi, router and internet connection are monitored. When the internet goes down, the provider contacts the internet service provider, not you.
Microsoft 365
Email, Teams, OneDrive: new users and leavers, security settings, everyday help. Note that managing Microsoft 365 is often included in the fee, but the licences are almost always billed separately.
Backup
Installing a backup is not enough: someone has to check every day that it ran, and regularly test that it can be restored. Check that the contract mentions backup management and data restoration, not just ‘backup’. With us, this is included in the Standard and Premium plans, not in the Essential plan.
Security
Security updates, antivirus, firewall, email filtering, password management, training the team to spot fake emails. Our contract makes it a full part of the service, with simulated phishing emails and monitoring of stolen login details circulating online.
Advice
A good contract does not just fix things: it sets time aside to review your needs. Ours includes quarterly planning, and 5 hours a month for small projects in the Standard plan.
What is often not included in the fee
A monthly fee covers looking after what already exists. Anything new, exceptional or caused by someone else is usually billed separately. Here is what our contract excludes, using its own wording. When it is written down, it is not a trap: it is what lets you compare two offers.
- Projects beyond the hours included in the fee: a new installation, an office move, migrating a server or software. These are quoted separately.
- Setting up new devices.
- Hardware and licences: computers, Microsoft 365, antivirus, backup storage.
- A security incident that takes more than 4 hours of work.
- Problems caused by a third party: a software vendor, the internet provider, an installer.
- Devices more than 5 years old, or whose operating system is no longer updated by the vendor.
- Travel to your site, depending on the plan: some only include remote help.
Our plans differ precisely on these points: the Essential plan does not include on-site visits, while the Premium plan adds extended opening hours and a preventive visit every month.
What must always stay yours, whoever your provider is
A provider manages your IT, it does not become its owner. Some things must be in your name and accessible to you, without going through the provider. That is what lets you switch providers, or keep working if they disappear.
| What must stay yours | Why | What to check |
|---|---|---|
| Your domain name (yourcompany.be) | Without it, no website and no email | It is registered in your company's name, and you have access to the account at the registrar |
| The main Microsoft 365 administrator account | It opens everything: email, files, users | You have an administrator access of your own, alongside the provider's |
| Passwords | Without them, nobody can take over | They are kept in a password vault you can open and export yourself |
| Documentation | It says what you have and how it is set up | Device list, network diagram, key settings: handed over on request |
| Licences | They keep your software running | They are in your company's name, not the provider's |
| Your data | It is yours, and sometimes your patients' | The contract states that the provider only processes it on your instructions |
On that last point, the European data protection regulation (GDPR) says that a provider processing data for you acts as a processor (Article 28): it only processes the data on your instructions, and a written contract must say so. Our contract states this explicitly, including for patients' health data.
How do you leave without being held hostage?
A badly written contract often only shows on the day you want to change providers. Three things must be in it.
- Handover: all access, passwords and documents are returned to you at the end of the contract, on simple request.
- Deadline and format: within how many days, and in what form (export of the password vault, a document describing the setup). Without a written deadline, ‘on request’ can take a long time.
- Term and notice period: how long you are committed, how the contract renews, and how much notice you have to give.
Our contract states that documents, settings and access codes are returned in full to the client at the end of the contract, on simple request, and that the result of the work remains the client's property. It runs for one year, renews each year, and can be ended on its anniversary date with three months' notice, by simple email.
Is your current provider slow to hand over access? Get in touch and we will tell you in which order to take back control.
7 questions to ask before you sign
- Which devices and which services are covered? Ask for the list, attached to the contract.
- What is excluded, and how is it billed? By the hour, on quote, at a fixed price?
- When can I ask for help, and how? A phone number, an email address, an app.
- What response time is written down for an emergency? Remote and on site, in hours or business days. A response time only promised verbally is worth nothing.
- Is the backup just installed, or also monitored and tested? And who receives the test result?
- In whose name are the domain name, the Microsoft 365 administrator account and the licences? The answer should be: yours.
- How long am I committed, and what do I get back if I leave? Term, notice period, deadline and format of the handover.
Does managed IT include cybersecurity and backup?
Partly, and it depends on the plan. Most contracts include updates, antivirus and backup monitoring. What varies: staff training, restore tests, handling a serious incident. The tools (antivirus, backup storage) are usually billed separately from the work of managing them.
For an SME, a well-maintained security baseline is often enough. We set it out in does a 10-person SME need a cybersecurity company?
What DeepIT's managed IT contract contains
DeepIT is a managed IT provider based in Brussels, working mostly for SMEs and medical and dental practices. Our contract rests on three parts: maintenance (computers, servers, network, internet, Microsoft 365, documentation of your IT, liaison with medical software vendors), advice (a quarterly review of your needs) and cybersecurity. The Standard plan includes everything except extended opening hours and the monthly preventive on-site visit, which come with the Premium plan.
For an emergency, our contract sets out a response commitment: 1 business day for remote work, 2 business days for an on-site visit, during our opening hours. That is the figure to compare from one contract to another, when it is written down.
Two examples from our files, without names:
- A medical centre with 11 workstations and a server signed a one-year Standard contract in September 2026, renewing each year, with three months' notice. The 12 covered devices are listed in the contract, one by one.
- A 5-workstation medical practice had to replace its router, the box that connects the practice to the internet. The question came up: who pays for what? What we applied: installing and configuring it is part of the managed IT contract, only the box itself is billed. The technician who came on site was not billed by the hour.
The second case shows what a contract should make possible: knowing in advance where the line is between what is included and what is billed, without negotiating at every visit.