Overview
IT support services operate on an entirely different model from project-based services—they're ongoing, recurring, reactive services where the scope is essentially undefined: "we'll support whatever issues arise." This creates inherent tension: IT support providers want predictable hours and costs; clients expect 24/7 access and rapid responses. Support agreements must establish response time commitments (critical for this service), define what issues are covered versus out-of-scope (is data recovery from user error included?), specify escalation procedures, address hardware versus software support boundaries, and manage the perpetual conflict around priority and resource allocation. Unlike bounded projects, IT support agreements must address managed service levels, incident tracking, change management, and long-term recurring costs.
Essential Clauses for Service Agreement for IT Support
When creating a Service Agreement for IT Support, include these critical clauses tailored to the specific risks and dynamics of this context:
- Covered Services vs. Out-of-Scope Items: Define what's included: remote troubleshooting, password resets, driver updates, antivirus management, patches, updates? What's excluded: data recovery from user deletion (unless at fault of IT provider), hardware repair or replacement, software licensing and compliance, setup of new third-party applications? Being specific prevents calls about expected services.
- Service Level Agreements (SLAs) and Response Times: Commit to specific response times based on severity: Critical (servers down) - 1 hour response, 4-hour resolution target; High (significant functionality lost) - 4-hour response; Medium (workarounds exist) - 8-hour response; Low (informational) - next business day. Define what "response" means (acknowledged, initial diagnosis) versus "resolution." Match SLAs to client needs and your resources.
- Hours of Coverage and Escalation: Specify available support hours (standard business hours, extended hours, 24/7?), and how issues are escalated if not resolved within SLA. Define on-call arrangements: are there additional fees for after-hours support? What constitutes an emergency justifying 3am contact?
- Hardware Support Boundaries: Clarify that hardware failures (failed drives, bad RAM) are typically the hardware vendor's or client's responsibility, not the IT provider's. Support focuses on software, remote troubleshooting, and coordinating repairs. If the provider offers onsite hardware support, specify costs (hourly rates plus equipment markup).
- Change Management and Downtime Authorization: Address how IT makes changes: security patches deployed automatically? OS updates? Major software upgrades? Define whether client authorization is required for system changes that might cause downtime, and scheduled maintenance windows (e.g., Sunday 2-4am). Include procedures for rolling back failed updates.
- Remote Access and Security Protocols: The IT provider needs remote access to client systems for support. Specify tools used (TeamViewer, RDP, etc.), logging requirements (provider maintains logs of access for security), and client approval procedures. Include restrictions on what the provider can access and limitations on sharing remote access credentials.
Real-World Example
MediCare Clinic contracted with TechSupport Solutions for managed IT services covering 50 employees, networks, and medical practice software. The agreement vaguely promised "professional IT support" with no SLA timeframes. One Tuesday morning, the clinic's electronic health record system crashed—zero uptime for patient records, appointments, prescriptions. TechSupport received the call at 9:15am but had another client emergency; they arrived at 2pm. By 4pm, they'd restored systems from backup, but patient records for 8 new appointments were lost. The clinic lost revenue, frustrated patients, and potential HIPAA violations. A support agreement with defined SLAs ("Critical issues with 1-hour response time commitment") and escalation procedures would have ensured appropriate prioritization and faster response.
Frequently Asked Questions
Best practice is automatic critical security patches (they prevent breaches and must be rapid). Optional/recommended updates and major OS upgrades typically require client approval with scheduled downtime windows to minimize disruption. Your agreement should specify which categories are automatic versus require approval, and what windows you maintain for maintenance (e.g., Sundays 2-4am).
Not typically. If the user deleted files themselves, recovery is their responsibility (though IT can assist for an additional fee). If IT caused the loss (failed backup, accidental deletion), that's IT's responsibility. Your agreement should clarify: IT provider maintains backups, but recovery from user error is a billable service. Better yet, implement automatic backups with version history so users can self-recover deleted files without IT involvement.