Before signing an MSP agreement, make sure the documents describe the service you chose. This checklist turns operational concerns into questions to resolve with the provider. A qualified legal adviser should assess enforceability and legal risk for your actual agreement.
Reconcile the documents that define the service
Collect the proposal, order form, service schedule, master agreement, security terms, and relevant license commitments. Record versions and dates. Ask which document controls if two describe different coverage. Keep the agreed set where the business can access it.
Compare each important promise in the proposal with the agreement. If a demonstration included after-hours investigation but the schedule includes only alert forwarding, resolve that difference before approval. Record the final answer and document location rather than keeping it only in an email conversation.
Turn ambiguous scope into a question with an owner
For covered users, devices, locations, systems, applications, support hours, and projects, ask what is included and what triggers additional work. Define who can authorize that work and what happens if an estimate is exceeded.
Illustrative example: a proposal says “unlimited support,” but a later schedule excludes the line-of-business application your employees use daily. Ask whether the provider will troubleshoot that application, coordinate its vendor, or only verify the device and network. Record the agreed boundary and any cost. Do not rely on the word “unlimited” to settle it.
Use a review log for the terms that change operations
Assign each open question to an appropriate business, technical, finance, or legal reviewer. The table is an editorial checklist, not model contract language.
| Topic | Question to resolve | Where to record the answer |
|---|---|---|
| Scope and exclusions | Which work is excluded and who approves extra charges? | Service schedule and rate schedule |
| Renewal | What notice, delivery method and dates apply? | Agreement plus business-owned reminder |
| Price changes | Which fees may change and under what mechanism? | Pricing terms and finance comparison |
| Accounts and records | What can the customer access and export during service? | Ownership and access schedule |
| Incident authority | Who may isolate a device, revoke access or authorize extra work? | Approved response and notification schedule |
| Exit | What is delivered, when, in what format and at what cost? | Transition deliverables and rate schedule |
Keep renewal and spending decisions with the business
Record the initial term, renewal arrangement, notice process, quantity minimums, license commitments, and change mechanisms. Have the responsible reviewer confirm their meaning. Then put the relevant dates on a business-owned calendar with a primary and backup owner.
For budgeting, distinguish the service fee from third-party licenses and project rates. Ask what happens if staffing falls or a location closes. A lower employee count does not automatically change a minimum commitment or a separate license term.
Define authority, access, and notification
Record the customer roles that approve sensitive changes and spending, the actions already authorized by the agreed incident process, and the route for exceptions. Make notification contacts usable when the usual person is away. Ask what records the customer receives after material actions.
CISA’s guidance for MSP customers supports explicitly documenting provider and customer responsibilities. Apply that principle to your actual service boundaries. A broad security statement does not answer who investigates an alert, approves an action, or owns follow-up work.
Make the exit deliverables usable
List the inventories, configuration records, customer-owned credentials, data exports, and transition assistance you expect. Ask which licenses and tools can transfer and which cannot. Define the delivery format, timing, cooperation period, and applicable charges. Plan safe access changes and tool removal with the responsible technical teams.
Illustrative example: an agreement promises “reasonable handover.” Ask what files, sessions, and assistance that includes before the relationship becomes urgent. Use the review questions above to close the open issues, then keep the resolved schedule for onboarding and future service reviews.
Working checklist
✓Service schedule and exclusions
✓Pricing and annual increases
✓Security responsibilities
✓Data and account ownership
✓Insurance and liability terms
✓Termination and transition assistance
Sources and further reading
Primary references for the topics identified below. Examples, checklists, and purchasing recommendations are editorial guidance.
- CISA: Risk considerations for MSP customers ↗
Primary guidance on assessing the security implications of outsourcing IT.
Published by Bay Area Managed IT. Examples are illustrative; they are not provider quotes, audited results, or local market survey findings. Read our editorial approach →
Resolve the open questions before approval.
Use the review log to record the final answer, document reference, reviewer and closure date for each issue.
Read the provider transition guide