The questions that decide what an MSP contract really costs

The proposal sets the headline. The master services agreement sets the price. Those are two documents, they arrive weeks apart, and the second one is usually presented as a formality by someone who genuinely believes it is. Six clauses account for nearly all of the distance between them, and each has a name you can search the PDF for.

After-hours billing

Ask what the hourly rate is outside the coverage window, what the minimum billing increment is, and which dates count as holidays. Then ask the question that actually matters: if an incident opens at 16:40 and closes at 18:20, is the whole call billed at the after-hours rate or only the portion after the window closes. Providers answer that differently and almost none of them write it down unprompted.

A pure hourly arrangement with no ceiling is a structure federal contracting treats as a last resort, because a time-and-materials contract provides no positive profit incentive to the contractor for cost control or labor efficiency and therefore has to carry a ceiling price the contractor exceeds at its own risk. Your after-hours line is a time-and-materials contract living inside a fixed-fee one. Ask for an annual cap on it, or a bank of included hours, and treat a flat refusal as information about how much after-hours work the provider expects.

Onboarding fees

Onboarding fees in the same market for the same size of firm range from nothing to several months of recurring fee, and the range is not mostly explained by the work involved. It is explained by whether the fee is a real cost recovery, a commitment device, or a discount lever the salesperson intends to give back in the last meeting.

Three questions separate them. What specifically does the fee cover, itemised — documentation, agent deployment, credential handover, the first security audit. How long does onboarding take, in weeks, and what is the remedy if it overruns. And is the fee refundable if you terminate inside the first ninety days. A provider that will itemise it is recovering costs. One that will not is pricing your switching friction, which it is entitled to do and you are entitled to know about.

Termination and data egress

Read the termination clause before the pricing schedule. Most managed IT agreements permit termination for cause and are silent on termination for convenience, which means there is no exit before the end of the term unless the provider has breached something you can prove. Where a convenience right exists it usually carries an early termination charge expressed as a percentage of the remaining term, and that percentage is negotiable at signature and not afterwards.

Then find the auto-renewal. Evergreen clauses roll a 36-month agreement into another 36 months unless notice lands inside a window that is often 60 or 90 days before expiry, and the window closes quietly. Put the date in a calendar the day you sign.

Tooling ownership

Four tenancies decide how hard a transition is, and providers differ on all four. The remote monitoring platform and its agents. The endpoint detection licence, which may be resold under the provider's own agreement and therefore not transferable. The documentation system, where your network diagrams and passwords live. And the Microsoft partner relationship, where the delegated administration grants and the partner-of-record designation determine whether you can move your own tenant without the provider's cooperation.

Two direct questions cover it: on the day this ends, which of those four do we still have, and does the successor provider have to rebuild anything from scratch. The joint advisory approaches the same ground from the security side and notes something worth carrying into the exit plan — that disabling MSP accounts can be overlooked when a contract terminates. Whoever leaves owes you a list of every account it holds in your environment, and that list belongs in the agreement rather than in the goodwill of the offboarding engineer.

Regulated environments have a harder version of this. Under the security rule's organisational requirements a business associate contract must require the associate to ensure any subcontractors that create, receive, maintain, or transmit electronic protected health information agree to the same requirements, and to report security incidents to you. That obligation follows the tooling: if the documentation platform is a third party's, that third party is inside your compliance perimeter.

Service levels with teeth

A service level without a consequence is a description of intent. Look for four things. The measurement definition: response time to first human contact, or to a technician actually working the ticket. The measurement period, because a monthly average absorbs a bad week that a weekly measure would surface. The remedy, usually a service credit expressed as a percentage of one month's fee. And the phrase "sole and exclusive remedy", which appears immediately after the credit and means the credit is all you get, whatever the outage cost you.

Nearby sits the limitation of liability, commonly capped at the fees paid in the preceding twelve months, sometimes at three months. For a provider holding administrative credentials across your whole estate, that cap is worth reading twice, and it is the clause most worth spending negotiating capital on if you only get one. CISA's buyer guidance asks providers to supply detailed incident management guidelines including warranty information, compensation for service outages, and plan to provide continuous support during a service outage, which is a reasonable thing to ask for and an unusual thing to be offered.

We should be honest about the limits of our own advice here. We do not know how often service credits are actually claimed, or whether a contract with credits performs better than one without. There is no public dataset on small-business managed IT disputes, the agreements are private, and the arbitration outcomes are not published. Our position is that a defined remedy at least forces a conversation about measurement, and that is an argument from structure rather than from evidence.

Change of control

Managed IT has been consolidating for years, and the provider you interview is not necessarily the provider you have in year three. The assignment clause usually permits the provider to assign the agreement to a successor in a merger without your consent, while requiring your written consent to assign your side. That asymmetry is standard and it is negotiable.

At minimum ask for notice. CISA's buyer guidance lists, among the things to obtain before award, a requirement to notify the customer of any change of MSP ownership or leadership, alongside documentation of the provider's financial health and performance record. A short right to terminate on a change of control, without the early termination charge, costs the provider nothing if it has no intention of selling.

How to ask these

Ask in writing, before the selection, and ask all three bidders the same list. Answers given during a competition are answers; answers given after are explanations. Send the questions with the scope so the responses arrive attached to a price rather than in a separate thread three weeks later.

Expect good providers to enjoy most of this. A firm that has thought about its own offboarding process has usually thought about its onboarding process too, and the correlation is strong enough to be useful as a signal on its own. The reaction to the questions tells you nearly as much as the answers, and it costs one email to find out.