Managed IT support agreement template

Managed IT Support Agreement

Parties: Provider · Customer

1. Purpose

This agreement sets out the terms on which the Provider supports and looks after the Customer’s IT systems on an ongoing basis. The Customer is a business and uses the services for its own business purposes.

2. Services covered

The Provider provides the following services for the Customer’s covered systems:

[[Describe the services and deliverables]]

The services are limited to what is listed here and in the price schedule, for example [[remote monitoring / helpdesk support for users / installing updates and security patches / managing backups / managing user accounts]]. Anything not listed, such as projects, replacing hardware or software, setting up new systems and on-site visits, is work outside the services, as the clause on work outside the services describes.

3. Covered systems and users

The services cover the systems the Customer lists: [[10]] users and [[12]] devices (computers, servers, network equipment and the software on them) at [[Addresses of the sites]], as set out in an inventory that the parties keep up to date.

The Customer tells the Provider about new, replaced or retired devices and users, and the fees follow the price schedule.

Systems that are not on the inventory, or that their maker no longer supports, are covered on a best-efforts basis only.

4. Support hours and channels

The Provider provides helpdesk support to the Customer’s named contacts by [[phone / email / ticket portal]] on [[business days]] from [[09:00]] to [[18:00]] in the time zone of [[City]]. Requests received outside these hours are handled on the next working day unless the price schedule states an out-of-hours service.

Out-of-hours service: [[none / emergency line on the number given]]

5. Response and resolution targets

The Provider classifies each request when it arrives and aims to respond as follows, counted in business hours from the moment the request reaches the support channel:

Critical (a service is down or many users cannot work): response within [[1]] hour, workaround or fix aimed for within [[8]] hours.

High (an important function is impaired): response within [[4]] hours, fix aimed for within [[2]] business days.

Normal (a single user or a minor fault): response within [[1]] business day, fix aimed for within [[5]] business days.

These times are what the Provider works towards, not a promise that a fault will be fixed in that time. They stop running while the Provider waits for information, access or a decision from the Customer.

6. Monitoring and maintenance

The Provider monitors the covered systems [[during business hours / around the clock]], installs updates and security patches in a maintenance window on [[Weekday and time]], and tells the Customer at least [[48]] hours in advance of work that will interrupt the systems, except in an emergency.

Where an update could affect the Customer’s own software, the Provider may hold it back until the Customer has tested it. The Provider does not promise that monitoring will catch every fault or attack.

7. Customer responsibilities

The Customer names contacts who can decide for it, gives the Provider the access, information and approvals it needs on time, and keeps valid licences for the software it uses. Unless backups are listed among the services, the Customer is responsible for backing up its data.

The Customer follows the Provider’s reasonable security instructions, such as using strong passwords and not switching off protection, and tells the Provider promptly about faults, security incidents and staff who join or leave. The Provider is not responsible for delay or damage that results from the Customer not doing these things.

8. Access and security

The Customer gives the Provider remote or on-site access to the covered systems, with administrator rights only as far as the services need.

The Provider uses personal accounts or an agreed secure tool for access, does not share the Customer’s credentials, limits them to staff who need them and removes its access when the agreement ends.

The Provider uses the access only to provide the services, does not look at the content of the Customer’s files or messages beyond what a task needs, and tells the Customer without undue delay if it learns that the Customer’s systems or data were accessed without authorisation.

9. Work outside the services

Projects and other work outside the services, such as setting up new systems, migrations, replacing hardware or software, training and on-site visits, are quoted in advance and done only after the Customer accepts the quote in writing or in electronic form. Where no quote is agreed, such work is charged at the hourly rates in the price schedule.

Hardware, licences and other items bought for the Customer are charged at the price shown on the quote or invoice and, where possible, registered in the Customer’s name.

10. Fees and payment

The Customer pays the monthly fee and the other charges shown in the price schedule of this contract, [[monthly]] in advance, on the payment terms stated in it. The monthly fee depends on the number of users and devices on the inventory; if the inventory changes, the fee changes from the next month.

Work outside the services, travel and items bought are invoiced once done.

The Provider may change the fees for a renewal period by notifying the Customer at least [[60]] days before it starts; the Customer may then end the agreement at the end of the current period. Where taxes apply, they are added to the fees.

11. Confidentiality and data

Each party keeps the other party’s non-public information confidential, including the Customer’s data and the Provider’s tools and pricing, uses it only for this agreement and protects it with at least reasonable care, during the agreement and for [[3]] years after it ends. Information that is public, already lawfully known, independently developed or that must be disclosed by law is excluded.

Where the Provider can reach personal data in the Customer’s systems, it handles it only as the services require and on the Customer’s instructions. Where the law that applies requires a data processing agreement, the parties sign one, and it prevails over this clause as far as personal data is concerned.

12. Term and termination

This agreement starts on the effective date and runs for [[12]] months. It renews for further periods of the same length unless either party gives notice in writing or in electronic form at least [[60]] days before the end of a period.

Either party may end it by notice with immediate effect if the other party seriously breaches it and does not remedy the breach within [[30]] days of being asked to. The Provider may do the same if a payment is still unpaid [[14]] days after a reminder.

When the agreement ends, the Provider hands over within [[14]] days the documentation, passwords and administrator access it holds for the Customer’s systems, removes its own access and tools, and deletes the Customer’s data it holds, except for copies it must keep by law, which stay confidential. Fees already paid for the time after the end are refunded only if the Provider ended the agreement without the Customer being in breach.

13. Liability

The Provider provides the services with reasonable care and skill; it does not warrant that the Customer’s systems will be free of faults, interruptions or security incidents, or that every fault can be fixed.

Except for intent, gross negligence, personal injury, breach of confidentiality or where the law does not allow a limitation, each party’s total liability under this agreement is limited to the fees paid or payable under it in the [[12]] months before the claim, and neither party is liable for lost profits, for lost data the Customer could have backed up, or for indirect damage. This does not limit the Customer’s duty to pay the fees.

14. Independent parties and notices

The Provider is an independent business and not an employee, partner or agent of the Customer. It decides how to carry out the services, may use subcontractors that it has bound to equivalent duties and remains responsible for their work.

Notices under this agreement are given in writing or by email to the addresses stated for the parties.

This contract, including its price schedule, is the entire agreement between the parties on its subject. Amendments are valid only if both parties agree to them in writing or in electronic form.

15. Governing law and disputes

This agreement is governed by the law stated under Governing law. The parties will first try to settle any dispute in good faith. Otherwise the courts stated under Jurisdiction decide, unless mandatory law provides otherwise.

Payment terms

The monthly fee in advance for each [[month]], within [[14]] days of receiving the invoice, by bank transfer to the account stated on the invoice. Work outside the services is invoiced once done.

Governing law

[[Country or state whose law applies]]

Jurisdiction

[[Courts that decide disputes, e.g. the courts of your city]]