Managed IT Services
An MSP proposal can promise unlimited support and still bill the after-hours call, the migration project and the move to your next provider separately. We source the provider, settle where its work stops before you sign, and manage the agreement for as long as it runs.
Book a conversationWhat Managed IT Covers, and When It Fits
A managed service provider runs part or all of your IT remotely, under a contract that should say what it does, what your team does and what you share. CISA is clear that handing the work to an MSP does not hand over your responsibility for the risk. In a fully managed model the provider runs the function. In co-managed IT, as the market commonly describes it, the provider works beside your team on defined areas such as after-hours coverage, overflow or specialist work. In ITIL terms, the service desk is the single point of contact for incidents and requests. A NOC can watch and report on your systems, or also act on what it finds, and only the contract says which.
When it makes sense
- Your IT team spends its days on password resets, patches and printer tickets while the projects the business asked for wait.
- Your team is strong but thin after hours or short on a skill, and wants to keep ownership of business applications and priorities.
- Your engineers will fix what a NOC finds, or you want a provider to act on alerts under procedures you approve.
- You handle regulated data, such as health records or customer financial records, that limits where provider staff may work and how closely you must oversee them.
When it does not
In our judgment, outsourcing may not be the next step when:
- Your own team already runs the desk well and the pain is cost. Renegotiating tools and licenses may do more than handing the desk to someone else.
- Nobody has written down the assets, accounts and procedures. Document them first; any model works better, and onboarding goes faster.
- The need is short and defined, and you want to direct the work yourself. Contract staff may fit better, with your team directing the work. Ask your counsel how long and how closely you can direct them.
If your current MSP is the right fit, the work may be renegotiating what its fee covers.
Where MSP Onboarding and Delivery Go Wrong
Several of these surface during onboarding, while the provider is still learning how your systems run.
Monitored is not managed
One public NOC solicitation separates monitoring and alerting from response, which the NOC takes only as directed and under approved procedures. Unless the contract says who fixes what, an alert can become a ticket handed back to your team.
Problems found during onboarding
Onboarding uncovers old problems, and someone pays to fix them. One provider's terms treat remediation found during onboarding as a separate project billed by the hour. Agree before signing how those findings are priced.
Knowledge transfer left to goodwill
One state's master services agreement for managed services makes the incoming provider gather procedures, system information, supplier contacts and open faults from the people doing the work before go-live. Write the same task into yours, with a named owner on each side.
Provider accounts with too much reach
CISA advises keeping MSP accounts out of administrator groups, limiting them to the systems the MSP manages and disabling them when not in use, and notes they can be overlooked when a contract ends. Define the access before award, so the provider can confirm it can work within it.
Standing admin rights in your cloud tenants
One major cloud platform now gives partners time-bound, least-privilege access that you grant explicitly, in place of broad standing rights. Check what access your provider holds in each tenant today.
Backups and logs only the provider holds
CISA advises keeping your own offsite backups and logs of MSP activity, apart from the provider's storage, so you can recover from an incident at the provider and check what it did.
Remote management tools as a way in
CISA, the NSA and MS-ISAC warn that attackers abuse legitimate remote monitoring and management software, which often draws no antivirus alert, and that an MSP's trust relationships can carry one compromise to many customers. Keep an inventory of approved tools and allow only those.
Your history in the provider's tools
When the MSP's own ticketing and monitoring tools are used, your ticket history, monitoring setup and knowledge base live in its systems. One provider's terms charge a share of the monthly fee after termination until its monitoring tools are removed. Decide what comes back to you, and in what form, before you sign.
The engineers you met at the proposal
The same state agreement names key provider staff, limits how often they can change and requires notice, an approved replacement and a knowledge-transfer plan. Without terms like these, the team that won the deal may not be the team that runs it.
Offshore staff and subcontractors
Some data may not be accessed offshore at all: the IRS requires contractors handling federal tax information for government agencies to keep staff and systems in the US or its territories. The same state agreement bars support from outside the contiguous United States. Ask where every person and subcontractor with access will sit.
What IT and Finance Get From a Clear MSP Contract
For IT and operations leaders: a clear line between your team and the provider
- A written split of who does what, agreed before onboarding starts.
- Provider access limited to the systems it manages, and switched off when the contract ends.
- Your IT managers meet the engineers who will run the desk; TREU fields the MSP pitches and the renewal talks.
For finance: a fee that covers what you thought it did
- Exclusions, hourly work and onboarding remediation priced before signature.
- Bids compared on one pricing basis, whether per device, per user or bundled.
- Exit help, data return and tool removal priced into the contract at signing.
What to Watch For in an MSP Contract
These clauses play out in specific ways when you buy managed IT. The general treatment of liability, audit rights and exit sits with contract negotiation.
-
What to ask for before award.
CISA's list for MSP customers covers service levels that separate IT operations from security, incident terms including outage compensation, how your data is kept apart, staff and subcontractor vetting, a transition plan, the provider's financial health and record, and notice of any change of ownership.
-
The pricing model.
Per-device pricing moves with every device added or removed, per-user pricing can stop matching the work as devices per person change, and a tiered bundle can under-cover. One provider's terms raise the monthly fee as endpoints, users or services are added. Compare bids on the same basis.
-
Where "unlimited" ends.
One provider's unlimited phone support stops at business hours unless you add an emergency option. One public contract leaves projects, migrations, major changes and after-hours response out of the managed fee and lets prepaid hours expire monthly. Read the exclusions as closely as the inclusions.
-
Response is not resolution.
Some contracts commit to response times by priority and set no resolution time at all, and a response clock may start only when a person acknowledges the ticket. Ask what each clock measures and when it stops.
-
Service credits and other remedies.
Service credits reduce the fee when service levels are missed, up to an amount at risk, and may be earned back. Many commercial terms make credits the only remedy; the same state agreement says they are not, and keeps them outside its liability cap.
-
New services and change orders.
The same state agreement requires the provider to propose any new related service at no charge, with a plan, a price breakdown and service levels, before you decide. Ask for the same, so scope does not grow by invoice.
-
Term, renewal and price.
One provider's agreement renews on its own unless notice is given and lets the customer leave only at the end of a term, with a fee. Its rates are renegotiated for each renewal term. In our experience, the work starts months before the notice date, not weeks.
-
Leaving the provider.
Negotiate termination assistance at signing: a migration plan, training for the next provider, documentation, and your data in the format you ask for, at the same service levels. One state's agreement includes these; one provider's terms instead bill you by the hour to move your data and delete backups that are not transferred within a set window.
-
Liability after an incident.
After a cyber incident, the liability cap often decides what can be recovered. One provider caps its liability at a small fixed amount and excludes lost data. One state's agreement carves fraud, gross negligence and confidentiality breaches out of its cap and counts data restoration as direct damages.
-
Security duties in writing.
A 2022 advisory from CISA, the NSA, the FBI and allied agencies tells customers to write security measures, incident notice, MFA on every MSP account, logging of MSP activity, backups and tested recovery plans into the contract. CISA's guidance for MSP customers adds direct access to logs from MSP-managed systems. Managed security services sit with cybersecurity.
-
Staff, subcontractors and assignment.
One state's agreement allows background checks before staff are assigned and bars subcontracting without written approval. One provider's terms let it assign the agreement freely. Require notice of subcontractors and of any change in who owns the provider.
-
Rules for regulated buyers.
Financial institutions covered by the FTC Safeguards Rule must require their service providers by contract to maintain safeguards. Broker-dealers, investment advisers and other firms covered by Regulation S-P must oversee their service providers, including notice of breaches. An MSP with access to protected health information needs a HIPAA business associate agreement.
-
A statement of work, in writing.
In one 2024 dispute after a ransomware attack, the claimed agreement with the MSP was oral, and commentators noted how unclear the obligations became. Put what the provider will do, will not do and needs from you in a signed statement of work.
This list is a starting point for your review. TREU is not a law firm. Your counsel gives the legal advice.
TREU's Part in Choosing and Keeping an MSP
See how we work-
Supplier identification
We settle with you whether the need is fully managed, co-managed, a service desk or NOC coverage, then take the requirements to providers that can staff your hours, your sites and your data rules.
-
Buying cycle
We compare proposals on the same basis and negotiate the commercial terms alongside your counsel: scope and exclusions, response and resolution, access, key staff, renewal and exit. Your engineers judge the technical fit.
-
Implementation oversight and accountability
We hold the provider to the onboarding and acceptance it committed to in the signed agreement, and check the first invoice against the contract.
-
Client and supplier lifecycle management
We track the terms and renewal dates, join business reviews, renegotiate at renewal and source new needs for the life of the agreement. When people change at the provider or on your team, we carry the history. Tickets and outages stay with the provider and your team.
Managed IT Services We Source
Each service will get its own page, with the technical and contract detail, as it is published.
- Managed IT services (MSP)
- Co-managed IT
- Help desk and service desk
- NOC services
Questions Buyers Ask About Managed IT
What is the difference between fully managed and co-managed IT?
In a fully managed model the provider runs the function. In co-managed IT, as the market commonly uses the term, it works beside your team on defined areas while your team keeps business applications and priorities. Either way, write down who does what before onboarding.
Does unlimited support really mean unlimited?
Read the exclusions. Some unlimited plans stop at business hours, bill out-of-scope work by the hour, charge separately for onsite visits, or leave projects and migrations out of the managed fee.
What is the difference between response time and resolution time?
Response time measures how fast someone picks up the ticket; resolution time measures how fast it is fixed. Some contracts commit only to response, and the clock may start only when a person acknowledges the request.
Will a NOC fix problems, or just tell us about them?
Under some contracts, a NOC monitors, alerts and reports on the systems you own, and acts only as directed under procedures you approve. If you want it to fix what it finds, say so in the scope.
What happens when we leave an MSP?
That depends on the termination assistance you negotiate at signing: a migration plan, documentation, your data in a usable format and help for the next provider. Plan to remove the provider's tools and disable its accounts too.
Can the MSP use offshore staff or subcontractors?
Unless the contract says otherwise, it may. Some regulated data may not be accessed offshore, and contracts can require approval of subcontractors and of any move in where the service is delivered.
Are we responsible if our MSP is breached?
Outsourcing does not move your responsibility for the risk, and an attack on an MSP can reach its customers. The contract's security terms and liability cap often decide what you can recover. TREU is not a law firm. Your counsel gives the legal advice.
Does TREU run our help desk or monitor our systems?
No. We source the provider and negotiate the terms, hold the provider to the onboarding and acceptance it committed to, check the first invoice, and manage the agreement after that. The MSP and your team run the desk, watch the systems and own the escalations. TREU oversees onboarding but does not perform it, and never has access to your systems.