The best time to clarify ownership and exit is before the relationship starts. Operational ambiguity eventually becomes a service or cost dispute.
Scope and exclusions
List covered users, devices, sites, systems, applications, vendors, support hours, security services, and account-management activities. Put common exclusions and approval rules for billable work next to the scope.
Term, renewal, and pricing
Review the initial term, automatic renewal, notice window, annual increase, minimum quantities, license commitments, project rates, travel, after-hours charges, and rights to adjust scope.
Ownership and access
The business should retain ownership of domains, cloud tenants, data, documentation, configurations, administrator access, and transferable licenses. Define how emergency access is maintained.
Transition and termination
Specify documentation delivery, credential transfer, tool removal, data export, final billing, transition assistance, and the period in which the outgoing provider must cooperate.
Review documents together, not in isolation
The order form, master agreement, service schedule, security addendum, and third-party license terms can describe different obligations. Ask which document controls when they conflict. Keep a final set with dates and versions. This checklist identifies operational questions; a qualified adviser should assess enforceability and legal risk for your specific agreement.
Define security decisions and notification paths
Record who may disable an account, isolate a device, contact a vendor, or start billable incident work. State how the customer is notified and what information will be supplied. Ask which subcontractors have privileged access and how responsibility is allocated. Avoid treating a statement that a provider follows best practices as a substitute for a service schedule.
Negotiate the exit before it is urgent
Ask for export formats, delivery timing, transition rates, minimum assistance, and a list of customer-owned materials. Identify licenses or tools that cannot transfer. Make sure account ownership and emergency access are documented during onboarding. Keep renewal and notice dates on a business-owned calendar so a staff change does not cause an unwanted renewal.
Working checklist
✓Service schedule and exclusions
✓Pricing and annual increases
✓Security responsibilities
✓Data and account ownership
✓Insurance and liability terms
✓Termination and transition assistance
Sources and further reading
Primary references for the topics identified below. Examples, checklists, and purchasing recommendations are editorial guidance.
- CISA: Risk considerations for MSP customers ↗
Primary guidance on assessing the security implications of outsourcing IT.
Published by Bay Area Managed IT. Examples are illustrative; they are not provider quotes, audited results, or local market survey findings. Read our editorial approach →
Bring these questions to your next provider conversation.
Use a common scope and keep the evidence beside each answer.
Prepare your RFP →