What a Managed IT Contract Should Actually Say

Most managed IT proposals in Malaysia are two pages of inclusions and one line about support. The inclusions are rarely the problem. The support line is where the money and the argument both live, and it is usually the vaguest sentence in the document.

Here is what to read for, in the order it will matter to you.

“Best effort” is not a response time

A response window says how quickly someone acknowledges the problem and starts work. It is not a promise to fix anything by then — that is a resolution time, and very few suppliers will commit to one, for the honest reason that they cannot know what is wrong until they look.

So the response window is what you are actually buying. If the contract says best effort, promptly, or as soon as reasonably practicable, you have bought nothing enforceable. Ask for a number.

Then ask the three questions that make the number mean something:

• When does the clock start? At the time you send the email, or when a technician opens the ticket during business hours? A four-hour response that only counts from 9am Monday is not a four-hour response on Friday evening.
• When does it stop? On first human contact, or on someone actually working the problem? An auto-acknowledgement is not a response, and some contracts quietly say it is.
• What counts as business hours? Malaysian public holidays vary by state. If your office is in Johor and the supplier is in KL, you have different holiday calendars. Get the calendar attached, not referenced.

Severity levels have to be defined by you, not them

Any decent contract tiers response by severity. The trap is that severity is almost always defined by the supplier, and their definition of critical is narrower than yours.

Write the definitions around your operations. “The whole office cannot work” is critical. “One person cannot print” is not. But if that one person is the only one who can release payroll and today is the 25th, you might want a middle tier that says so. A severity table takes ten minutes to write and removes the single most common argument in this relationship.

After-hours is a separate purchase

Assume weekday-hours cover unless the contract says otherwise, and assume after-hours is billed at a multiplier. That is normal and not unreasonable — someone has to be awake.

What is unreasonable is finding out during the incident. Ask for the after-hours rate, the minimum billable block, and the escalation path outside office hours. If there is a duty phone, ask who answers it at 2am. Sometimes the answer is nobody, and it is better to know that in the meeting than in the outage.

The clause almost nobody reads: who owns the admin account

This is the one that costs the most to fix later.

When a supplier sets up your Microsoft 365 or Google Workspace, the tenant can be created under your organisation’s ownership or under theirs as a reseller. Same for your domain registration, your firewall’s management account, your backup console, and your antivirus portal. If those sit under the supplier’s account, leaving them is not a negotiation — it is a migration.

Ask, in writing, for:

• Ownership of the tenant and the domain in your company’s name, with a global administrator account you control.
• A credential handover schedule — what you receive on day one, and what you receive on termination.
• An asset and licence inventory you keep a copy of, updated at least annually.

A supplier who is comfortable with all three is telling you something. So is one who is not.

The exit clause is part of the service

Every managed IT relationship ends eventually, and the ending is where the damage happens. The contract should say what the supplier does when you leave: how long they support the transition, what documentation they hand over, in what format, and at what cost.

“Reasonable assistance” is the best effort of exit clauses. Ask for a number of hours and a list of deliverables — network diagram, asset inventory, credential list, licence records, backup configuration and recovery procedure.

What good looks like

A managed IT contract you can hold someone to has: a named response window per severity tier, severity tiers written around your operations, a defined business-hours calendar, an after-hours rate, your name on the tenant and domain, a credential handover schedule, and an exit clause with hours attached.

None of that is exotic, and none of it is expensive to agree at the start. All of it is expensive to argue about later.