What should be in a managed IT service agreement (SLA)?

A managed services agreement worth signing covers five things concretely. One: response-time commitments by severity tier (see the response-time question) — not a single vague 'we respond promptly.' Two: scope — an explicit list of what the monthly fee covers and what's billable, including on-site visits, after-hours work, and projects. Three: data and credential ownership — your accounts, your licenses, your data, with an offboarding clause describing the handback.

Four: security responsibilities — who patches what, who responds to incidents, what happens (and what it costs) if you're breached. Five: term and exit — how long you're committed, what notice is required, and any early-termination cost. Month-to-month or annual terms are both common; multi-year lock-ins deserve extra scrutiny of everything else in the agreement.

Red flags: 'best effort' language on response times, auto-renewing multi-year terms with long notice windows, and any resistance to the offboarding conversation. A provider confident in their service doesn't need contractual handcuffs.