Choosing a managed service provider is one of the larger vendor decisions a contractor makes, and the contract often gets less attention than the proposal deck. The sales presentation talks about partnership. The contract describes what you can actually count on when a superintendent cannot log in at six in the morning or a ransomware note appears on a file server.
This guide is for owners and finance leaders who sign these agreements. It covers what to look for, what to ask and what should make you pause.
Start with scope
A vague scope causes more disputes than any other clause. The agreement should clearly list:
- Which users, devices, servers, sites and cloud services are covered
- Whether jobsite trailers, field tablets, routers and personal phones are included
- What counts as a project, billed separately, versus routine support
- Which line-of-business applications get support, such as your estimating, accounting and project management platforms
- Hours of coverage, including early starts and weekends if your crews work them
Response and resolution times
Look for defined response targets by priority. A server outage affecting payroll should not sit in the same queue as a printer request. Ask:
- How is priority assigned, and by whom?
- Is the target a response time, a resolution time or both?
- What happens when targets are missed?
- Is there after-hours support, and how is it reached?
A promise of "fast response" without numbers is not a commitment.
Security duties in writing
Many providers say they are security-focused. Make them define it. Confirm in the agreement or its service description:
- Who manages multifactor authentication, patching and endpoint protection
- Whether monitoring and response are included, and who responds at night
- Email security and phishing protection
- Security awareness training for your staff
- Backup monitoring and restore testing
- Incident response, including whether it is covered in the monthly fee or billed hourly
If you handle CUI or serve a regulated energy business, ask whether the provider will support your compliance requirements and sign any needed flow-downs.
Data ownership and access
Your data, your administrator credentials and your documentation belong to you. The contract should say that you hold global administrator rights or have a documented way to recover them, and that the provider must hand over documentation if you leave.
Pricing structure
Common models are per user, per device or a flat fee. Read the fine print about what falls outside the fee: onboarding, hardware, licensing pass-throughs, travel to remote sites, project work and after-hours support. Ask for a sample invoice from a similar client, with names removed.
Term, renewal and exit
Watch the following:
- Length of term. Multi-year terms can be fine if the service is good and you have an exit for repeated failure.
- Auto-renewal. Note the notice window and put it on your calendar.
- Termination for cause. You should be able to leave if service levels are repeatedly missed.
- Transition help. A reasonable offboarding process protects you if you switch.
Liability and insurance
Ask the provider to show proof of professional liability and cyber coverage. Liability caps are common, but understand how low yours is compared with what a serious incident could cost, and talk to your insurance broker.
Questions to ask before signing
- Who will be my primary contact, and what is their backup?
- How do you handle a jobsite with poor connectivity?
- Can I speak with a reference in construction or energy?
- How do you report to us, and how often?
- What happens to our data and credentials if we part ways?
Red flags
- Refusal to share a sample agreement before the final proposal
- No clear owner of security tasks
- Vague language such as "reasonable efforts" on every service
- The provider holds the only administrator credentials
- Unwillingness to explain what is excluded
How Ironfield Cyber helps
Ironfield Cyber provides managed IT and security for contractors and energy companies in Texas and nearby states, with plain-language agreements. If you are comparing providers, we are happy to review a competing proposal with you and point out what it leaves out.