What should your IT support contract and SLA promise?

Your IT support contract should promise four things in writing: how fast someone responds, how fast the problem is actually fixed, who owns your issue until it is closed, and what happens to your data and access if you leave. If your contract is vague on any of them, you have a support relationship, not a service level.

Read the SLA before something goes wrong. When it does, the wording decides what you can expect. This article sets out what a managed IT services SLA should say, the gaps that cause the most friction, and the questions to ask before you sign or renew.

Is a fast response the same as a fast fix?

No, and it is worth reading the two separately. Response time is how quickly someone acknowledges your problem. Resolution time is how quickly it is fixed. A contract that promises a 15-minute response can still leave a partner unable to work all afternoon.

A useful SLA gives both figures for each priority level, and defines the priority levels in your terms. “Urgent” should mean something like “a fee earner cannot work” or “client email is down”, not a category the provider assigns after the fact. The NCSC’s guidance on choosing a managed service provider advises agreeing both response and resolution times, and notes that higher service levels usually cost more. That is a fair trade, as long as you know what you are buying.

Check the hours too. An SLA measured in business hours stops the clock when the provider’s working day ends. If your team works late before a filing deadline, ask what happens to a problem logged in the evening.

Who owns my problem once it is escalated?

Most providers work in tiers. A first-line engineer takes the call, and harder problems pass to more senior staff or to a specialist. That is sensible. The risk is that ownership gets lost on the way up, and your issue sits in a queue while you explain it again to someone new.

Your contract, or the provider’s service description, should answer three things:

• Who stays your point of contact while a ticket is escalated.
• Whether the resolution clock keeps running when a problem moves to another team or to a supplier such as Microsoft.
• How you escalate yourself when a ticket is stuck, and to whom by name or role.

If the answer to the second point is “the clock stops while we wait for a third party”, the headline resolution times may matter less than they appear.

What should a managed IT services SLA cover beyond the helpdesk?

The helpdesk is the part you see. The work that prevents the calls is what you are really paying for, and it belongs in the contract as well. The NCSC guidance lists several areas worth defining:

• Patching. The NCSC recommends critical and high-risk updates are applied within 14 days of release. Ask whether the contract commits to that, and how you would see the evidence.
• Backups. How often they run, where they are stored, who can access them and how often a restore is tested. Our article on whether your Microsoft 365 backup will work covers the questions in detail.
• Incident notification. How quickly the provider must tell you about a security incident, scaled to how serious it is.
• Reporting. Regular reports on patch status, backups and security alerts, so you can check the service rather than take it on trust.
• End-of-life systems. Who tracks when software and devices go out of support, and who plans their replacement.

A provider that measures itself only on tickets closed has every reason to wait for things to break. If you are unsure which kind you have, see is your IT provider preventing problems or just fixing tickets?

What happens to our data if we leave?

Exit terms are the clauses nobody reads until they need them. If your provider handles client personal data on your behalf, UK GDPR Article 28 requires a written contract. Among other things, it must oblige the provider to delete or return the data at your choice when the service ends, to help you meet your security and breach obligations, and to give you the information you need to show compliance.

Beyond the legal minimum, check the practical side. Who holds the admin accounts for your Microsoft 365 tenant? Is your network and system documentation yours to keep? How much notice is required, and does the provider commit to a handover? A firm that cannot get its own admin access back has not really chosen its provider. It is stuck with one.

What should we ask before signing or renewing?

1. What are the response and resolution times for each priority, and how is “urgent” defined? Ask for both figures, in writing.
2. Does the clock stop when a problem is escalated or passed to a supplier? The answer tells you what the headline figures are worth.
3. What do you do between tickets, and how will we see it? Patching, backups and monitoring should appear in a regular report.
4. How did you perform against the SLA last quarter? A provider that measures its own service can answer this quickly.
5. If we leave, what do we get back and how quickly? Admin accounts, documentation and data, with the notice period stated.

Clear answers to these five questions matter more than any single benchmark figure. Our managed IT services are built around SLAs with defined response and resolution times, so you can explain your cover in one sentence. If you want an independent view of what your current contract and provider actually cover, the IT Risk and Ownership Review checks who makes IT decisions, what your provider is contracted to do, and whether your firm owns its own admin accounts.

What the contract should promise also depends on what you’re buying; managed IT support and IT outsourcing aren’t the same thing.

Frequently asked questions

Can an IT provider guarantee an SLA?

A provider can commit to response and resolution targets and to what happens if it misses them, such as service credits. No provider can guarantee that nothing will go wrong, so judge the SLA on how clearly it defines priorities, times and remedies.

What is a reasonable response time for urgent IT issues?

The NCSC’s guidance gives under an hour for urgent issues as an example. What matters more is the resolution time and whether the definition of “urgent” matches what stops your firm working.

How often should we review our IT SLA?

At least once a year, and whenever the firm changes significantly, such as new offices, a large intake of staff or new regulatory demands. Review it against the provider’s actual performance reports, not just the contract wording.