Managed Services Agreement: What Goes In It, Clause By Clause

A managed services agreement is the contract under which an MSP provides ongoing IT services to a client for a recurring fee. It defines the services and their limits, service levels, fees and payment, each side's security and data duties, liability, and how the agreement renews or ends.

This guide takes each clause in turn, shows how the agreement fits with an SOW and an SLA, and gives you an outline to download for your lawyer. It comes from the team behind SherpaDesk, a helpdesk and professional services automation (PSA) tool a small IT team can run alone.

What Is A Managed Services Agreement?

An MSP is a third-party company that remotely manages a customer's IT infrastructure and end-user systems. MSPs that sell a subscription usually bill customers monthly. The agreement is the document that monthly invoice rests on: it says what the client pays for and what you owe in return.

You'll also see it called a managed service agreement, an MSP contract, or "the MSA." It answers six questions: what you'll do, for whom, how fast, for how much, who carries which risk, and how the relationship ends. If you're new to the model, What Is An MSP? covers the basics.

Managed Services Agreement Or Master Services Agreement

The acronym collides. A master service agreement is a contract that outlines the relationship between two parties, with terms for current and future activities. Once it's signed, later projects can be negotiated faster, often with only a statement of work.

An MSP can use that structure. The master terms are signed once, and a service schedule or order describes the managed services on top. Others put everything in one document. What matters is that the legal terms, the service description, and the price each have a clear home.

Managed Services Agreement vs SOW And SLA

Some MSPs use all four documents, others combine them; the change clause decides what goes where.

A service-level agreement documents what a provider will furnish and the standards it must meet. The SLA is often incorporated by reference in the provider's master agreement, which is the pattern above. NIST describes an SLA as a commitment that covers responsibilities, expected performance such as response times, and requirements for reporting, resolution, and termination.

Separate documents don't make any of them easier to change on your own. The change or amendment clause both sides signed decides which document a change goes into and who must approve it. Under one clause a new service is a short new schedule; under another it is a full amendment.

Ending a master agreement gets tricky when an SOW under it still has work in progress. Say what happens to open projects at termination, and add an order-of-precedence line that says which document wins when two disagree. Your lawyer decides the order.

Why Your MSP Needs One In Writing

The risk you carry is larger than one client's network. A joint CISA, NSA, and FBI advisory warns that "threat actors can use a vulnerable MSP as an initial access vector to multiple victim networks." It tells MSP customers to "ensure MSP-customer contracts transparently identify ownership of ICT security roles and responsibilities." A client who reads that advisory will look for those roles in your draft.

Clients also bring their own legal duties, such as HIPAA's business associate terms or the FTC Safeguards Rule's contract requirements. See Regulated Clients.

Then there's scope. One r/msp member's client wanted data analysis and business automation, such as Power Apps, both excluded in writing. Asked how to handle requests like that, the top reply was three words: "With a quote." That answer only holds if the agreement says what's in and what's out.

Types Of Agreements By Pricing Model

The pricing model shapes the schedule more than the master terms.

Each model you sell needs its own line in the schedule. Managed Services Pricing covers how to set the numbers.

Managed Services Agreement Template Outline

Here is the whole agreement at a glance: 21 clauses and three schedules, each with the questions it has to answer. The sections below take the clauses in this order, and a filled-in example and the download follow them.

OUTLINE FOR DISCUSSION WITH YOUR LAWYER, NOT A CONTRACT
Client agreement for managed IT services
Parties: [MSP legal name] and [client legal name]

1. PARTIES, TERM AND START DATE
   Legal entities? Who signs, with what authority?
   Start date? Initial term? What happens after it?
2. SERVICES AND SCOPE (Schedule A)
   Which services are included, in plain words?
   Which are excluded? Where is the line for new
   users, new devices, and projects?
3. COVERED USERS, DEVICES AND SITES
   What does the fee count? How and when is the
   count updated?
4. ONBOARDING AND STARTING ENVIRONMENT
   What do you document and fix first? Onboarding
   fee? Path for problems found? Full-service date?
5. SERVICE LEVELS (Schedule B)
   Response, restoration, and resolution targets
   by priority? Who assigns priority? Coverage
   hours, time zone, holidays? After-hours P1
   channel? What stops or pauses each clock?
   Escalation route? What happens on a miss?
   Service credits: calculation, claim window,
   cap, relation to other remedies?
6. REPORTING AND REVIEWS
   Which report, how often? Who meets, how often?
7. CLIENT RESPONSIBILITIES
   Who holds admin rights? Who approves changes?
   What must the client keep current?
8. FEES, INVOICING AND PAYMENT
   Fee basis? Invoice date, due date, method?
   Late fee? Notice before any suspension?
9. PRICE ADJUSTMENTS
   Fixed percent or exact index series? Base and
   comparison months? Formula? Decrease or floor?
   Cap? Notice? Effective date? Index revisions?
10. OUT-OF-SCOPE WORK AND CHANGES
   Quote, SOW, or hourly rate? Who approves?
   Which document does a change go in? Who signs?
11. SECURITY DUTIES
   MFA on MSP accounts? Unique admin credentials?
   Backups and monitoring: who does what?
12. DATA, BACKUPS AND INCIDENT NOTICE
   Who owns client data? Backup scope, retention,
   restore tests? Incident notice: how and when?
13. CONFIDENTIALITY
   What is confidential? For how long after end?
14. REGULATED-CLIENT ADDENDA
   HIPAA business associate terms? FTC Safeguards
   terms? Other rules the client must meet?
15. SUBCONTRACTORS AND THIRD-PARTY PRODUCTS
   Who else works on client systems? Whose
   license terms apply? Who owns each license?
16. WARRANTIES, LIABILITY AND INDEMNITY
   Wording by counsel: warranties, cap,
   exclusions, indemnity.
17. INSURANCE
   Which policies and limits does each side keep?
18. RENEWAL AND TERMINATION
   Renewal term and notice? Termination for
   cause and for convenience? Open SOWs?
19. OFFBOARDING AND HANDOVER
   Steps, owners, and days? Export formats?
   Receipt confirmed how? Credentials and admin
   rights? Date MSP access is removed? Deletion
   and retention exceptions? Paid help period?
20. NON-SOLICITATION
   Wording by counsel: period, finder's fee.
21. GENERAL TERMS
   Force majeure, governing law, disputes,
   notices, order of precedence, signatures.

SCHEDULE A  Service schedule
SCHEDULE B  Service levels
SCHEDULE C  Subcontractors and third-party products
ADDENDA     As the client's rules require

What To Put In It, Clause By Clause

The 21 clauses follow the outline's order. Each section says what the clause can contain and what to ask counsel.

Parties, Term And Start Date

Name the legal entities, not the brand names. If the client's office manager signs, ask your lawyer how the agreement should confirm that person's authority.

Give the start date, the initial term, and what happens after it. A longer first term protects the hours you spend onboarding. A shorter one is easier to sell to a client who has never used an MSP.

Services And Scope

Clients tend to read this clause first. List each service in plain words: helpdesk support, patching, backup monitoring, Microsoft 365 administration, endpoint security. Then list what you don't cover.

The exclusions matter as much as the inclusions. One r/msp member's advice for a new agreement was to put in "what you don't support and not just what you do." Candidates for exclusion: custom software, line-of-business applications the vendor supports, warranty repairs, training, and projects.

Decide the gray areas now. New-user setup is the classic one. An r/msp member who bills new-employee setup separately said clients still assume it's included. Replies drew the line in different places. One: "onboarding 5 users or replacing 5 computers this week is a project." Another liked this rule of thumb: "if it's under 1hr, it's included." Pick a line and write it in the schedule.

Covered Users, Devices And Sites

Say what the monthly fee counts: named users, devices, servers, sites, or a mix. Then say how the count changes. Write who reports changes and by what date, and how personal devices and remote staff count.

Onboarding And Starting Environment

CISA tells MSP customers to ask for a transition plan that supports a smooth integration of the MSP's services. Any required downtime should ideally fall at a time the client chooses.

Write what onboarding covers: documenting the network, admin accounts, licenses, and backups; installing your tools; and fixing what blocks support. Say whether onboarding has its own fee. Problems you find in month one, such as unsupported hardware or a backup that never ran, need a path. That can be a quoted fix or a documented decision by the client; what such a decision changes about responsibility is a question for counsel.

Name the date full service and the SLA clocks start, which can be the day onboarding ends: agree it with the client.

Service Levels

Keep the numbers in the SLA and point to it from the master terms. An SLA usually covers a description of services, exclusions, performance targets, what happens when they're missed, tracking and reporting, and periodic review. Our SLA template has target tables you can adapt.

NIST lists both response times and resolution among what an SLA addresses. Many incidents need three clocks, each with its own stop point:

• Response. A technician acknowledges the ticket and starts work. Define what stops it: a technician's reply or call, and whether an automatic acknowledgment counts.
• Restoration. The service works again, possibly through a workaround. Define what stops it, such as the client confirming the fix.
• Resolution. The cause is fixed or the request is done. It stops when the fix is complete, with the cause recorded on the ticket.

Then write the rules that decide whether a target was met:

• Priority. Define each priority by impact and urgency, with examples. Say who assigns it at triage and how the client asks to change it.
• Coverage hours. Business hours, time zone, holidays, and which priorities get after-hours response.
• After-hours channel. How the client reports a priority 1 outside business hours, such as a phone line, since nobody may read email at night.
• Start. When each clock starts, such as when the ticket is logged or the after-hours call is received.
• Pauses. Whether a clock pauses while a required answer or action from the client is outstanding, or while you wait on a vendor or scheduled access.
• Escalation. Who a ticket goes to when a target is at risk, with a named contact at each level on both sides.
• Measurement. Which report shows results, and whether targets are measured per ticket or as a monthly percentage.
• Misses. What happens after a miss: a review, a fix plan, service credits, or a combination.

Service credits are fields to agree, if the parties agree credits at all. Credits are typically taken from fees put at risk when the provider misses its targets. Some agreements add an earn-back, which lets the provider regain credits after a period at or above the standard. The fields are: which targets carry a credit, how it's calculated, the window for claiming it, any cap, and how credits relate to other remedies. That last field is a question for counsel.

Reporting And Reviews

Say what you report and how often: tickets opened and closed, SLA results by priority, patch and backup status, and open risks. Service tracking and reporting, and a periodic review and change process, are standard parts of an SLA.

Client Responsibilities

Managed services split the work. CISA's guidance for MSP customers says outsourcing "does not absolve an organization from risk management responsibilities." It suggests a shared responsibility model naming the vendor's duties, the customer's duties, and shared ones, such as who applies patches, maintains hardware, or trains employees.

Put that split in the agreement. Typical client duties: keep supported hardware and licenses, give you admin access, and name a contact who can approve changes. The client also tells you about new staff and leavers, and responds to your security recommendations. Ask counsel how a declined recommendation should be recorded and what that record does.

Fees, Invoicing And Payment

State the monthly fee, what it's based on (per user, per device, or flat), the invoice date, the due date, and the payment method. Put the actual prices in the service schedule. Then a new user count or a new service updates one page.

Late payment needs a process, not a threat. One r/msp member described their rhythm: "Invoices go out on the fifth, they're due on the fifteenth." The same member warned that "Suspending service for 300 people because the A/P department was a little slow is a good way to get dropped or sued or both." Write a notice step before any suspension, and decide whether security monitoring keeps running while the account is overdue.

Price Adjustments

If you index prices to inflation, the Bureau of Labor Statistics publishes guidance on writing a CPI escalation clause. It recommends the U.S. City Average CPI for escalator clauses, and it says "the use of seasonally adjusted data in escalation agreements is inappropriate."

The mechanism has these fields to agree:

• Index or fixed rate. A fixed percentage, or an index named exactly, such as the CPI-U, U.S. city average, all items, not seasonally adjusted.
• Base and comparison months. BLS says to specify a reference period from which CPI changes are measured. Each month's index comes out about two weeks after the month ends, so pick months published before your notice date.
• Formula. BLS shows the percent change as the new index minus the old, divided by the old, times 100.
• Decreases and floor. Whether the price can fall when the index falls. BLS mentions a "floor" that promises a minimum increase regardless of the change in the CPI.
• Cap. The most the price can rise in one adjustment, if the parties agree one.
• Notice and effective date. How many days ahead you tell the client, how, and the first invoice at the new price.
• Revisions. BLS advises a built-in method for major CPI revisions or a change in the index base period.

A new user changes the quantity, not the price.

Out-Of-Scope Work And Changes

Say how work outside the schedule gets approved and billed. Projects go by quote or SOW, small requests at your hourly rate, and only after the client's named contact approves.

Security Duties

CISA's MSP advisory tells customers to put specific security terms in their contracts:

• MFA enforced on all MSP accounts used to access customer environments
• no reuse of admin credentials across multiple customers
• how and when the MSP notifies the customer of an incident affecting its environment
• backup services that meet the customer's resilience and disaster recovery requirements

Write the controls you actually run, in terms a client can check. A promise you can't show evidence for is worse than no promise.

Data, Backups And Incident Notice

Say that client data belongs to the client. Say what you back up, how often, how long you keep it, and how often you test a restore. If a server or application isn't in the backup scope, list it.

Set a notice timeline for security incidents you detect, and who you notify. CISA advises that "contracts should detail how and when MSPs notify the customer of an incident affecting the customer's environment."

Some clients have their own deadlines. A financial institution under the Safeguards Rule must notify the FTC as soon as possible, and no later than 30 days after discovery, of a "notification event." That's a breach involving unauthorized acquisition of at least 500 consumers' unencrypted information. Your notice to that client has to arrive well before its deadline.

Confidentiality

Both sides see things they shouldn't share. You see the client's data and finances; they see your tools, pricing, and documentation. Terms to agree: whether the duty is mutual, what counts as confidential, and how long it lasts after the agreement ends. Counsel words the clause.

Regulated Clients: HIPAA And FTC Addenda

Regulated clients' terms can sit in an addendum so the master terms stay the same for every client. Counsel decides the form.

HIPAA. The definition of business associate in 45 CFR 160.103 has several branches. Its first branch, paragraph (1)(i), covers a person who, with respect to a covered entity:

On behalf of such covered entity or of an organized health care arrangement (as defined in this section) in which the covered entity participates, but other than in the capacity of a member of the workforce of such covered entity or arrangement, creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter, including claims processing or administration, data analysis, processing or administration, utilization review, quality assurance, patient safety activities listed at 42 CFR 3.20, billing, benefit management, practice management, and repricing; or

Other branches cover certain service providers whose services involve disclosure of protected health information, and subcontractors of business associates. Paragraph (4) lists exclusions. Ask your lawyer whether the definition covers your work for a clinic or practice.

If it does, the regulation lists what the business associate contract must say. Among its terms, the business associate agrees to:

• not use or further disclose the information other than as the contract permits or the law requires
• use appropriate safeguards
• report uses or disclosures the contract doesn't provide for, including breaches of unsecured protected health information
• ensure its subcontractors agree to the same restrictions and conditions
• at termination, as paragraph (J) puts it in full:

  At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

FTC Safeguards Rule. The FTC lists mortgage brokers, collection agencies, credit counselors and other financial advisors, and tax preparation firms among the businesses it covers. The FTC says their contracts "must spell out your security expectations" and "build in ways to monitor your service provider's work." They must also "provide for periodic reassessments of their suitability for the job." Whether the Rule applies to a given client is for that client's counsel to confirm.

Subcontractors And Third-Party Products

Say whether you use subcontractors and for what. Who answers for their work is a term to agree, worded by counsel. CISA asks MSP customers to require notice of subcontractors who could expose their data, and documentation of the MSP's responsibility for those subcontractors' actions.

Then cover the products you resell or install. They come with their vendors' license terms, so don't promise more than the vendor does. Say who owns each license at the end.

Warranties, Liability And Indemnity

Leave the wording of this clause to your lawyer. Warranties say what you promise, such as work done with reasonable skill and care. Disclaimers say what you don't, such as uninterrupted service or zero breaches.

The limitation of liability caps what either side can owe. How the cap is set, what it excludes, and whether it holds are questions of state law. Bring your insurance limits to that conversation.

Ask your lawyer about consequential damages too. These are losses that follow naturally from a wrongful act rather than from the act directly, such as a client's lost revenue during an outage. Indemnity is a promise to cover the other side's losses from defined events, such as third-party claims. Ask whether yours should be mutual.

Insurance

Name the policies you carry and the limits, and ask the client to carry its own. The SBA describes professional liability insurance as protection against financial loss from "malpractice, errors, and negligence." General liability covers bodily injury, property damage, and defending lawsuits.

Ask your broker whether your policies cover a cyber incident at a client, and at what limit.

Renewal And Termination

Say whether the agreement renews automatically, for how long, and the window for giving notice of non-renewal. Then check the law where your clients are.

New York is one example. Its General Obligations Law covers contracts for service, maintenance, or repair to or for real or personal property. An automatic renewal clause in such a contract can't be enforced against the client unless the provider gives written notice of it. That notice goes in person or by certified mail, 15 to 30 days before the client's deadline for giving notice.

The section doesn't apply to contracts whose automatic renewal period is one month or less. Whether it reaches your services is a question for your lawyer.

Cover termination for cause, such as a material breach not cured within a notice period, and for convenience, with notice and any early-termination fee. Give yourself an exit too. One r/msp member's advice: "Always give yourself an out. You never know what you will find 2 months in."

Offboarding And Handover

The end of an agreement is when goodwill runs short, so write the handover in advance: each step, its owner, and its day. The order matters. Export and confirmation come before your access is removed, so nothing depends on access you no longer have.

Two sources shape the later steps. CISA tells customers to "disable MSP accounts that are no longer managing infrastructure." For storage media you sanitize, NIST's guidelines recommend a certificate of sanitization recording the method, tool, and verification. For protected health information, the business associate contract's terms on return, destruction, or continued protection apply.

Agree retention exceptions with counsel, such as records you must keep and backups that can't be deleted early. Settle ownership of work materials separately too. The agreement usually says client data belongs to the client; your scripts, templates, and internal documentation are a separate term to agree with counsel.

Non-Solicitation

A non-solicitation clause bars the client from hiring your technicians for a period after the agreement ends. One r/msp member put no solicitation of employees or clients first on their list for a lawyer. Next came a finder's fee for when a client wants to hire one of your staff. Whether and how such a clause can be enforced depends on state law, so leave its wording to your lawyer.

Force Majeure, Disputes, Notices And Signatures

A force majeure provision can free the parties from obligation when an extraordinary event directly prevents performance. What it covers depends on its wording. Wex notes that some jurisdictions, like New York, read these clauses narrowly and excuse only events the clause names. Questions for counsel: which events to list, whether a cyberattack on your own tools is one, and what notice a party must give.

Then the general terms: governing law and venue, arbitration or court, how notices are sent, the order of precedence between documents, and the entire-agreement clause.

On signatures, the federal ESIGN Act applies to transactions in or affecting interstate or foreign commerce. For those, a contract can't be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation.

Filled-In Example For A Small Accounting Office

Say you sign a 12-person tax and accounting office with one site in New York City. In this example, the client's counsel has confirmed that the FTC Safeguards Rule applies and which contract terms it needs. Here is how each outline question could be answered. Two values are yours: your per-user price and your hourly rate.

Schedule B for the same client separates the three clocks. Priority 1 response runs around the clock; every other target counts business hours, 8 a.m. to 6 p.m. Eastern, Monday to Friday, excluding U.S. federal holidays. A business day is those 10 hours.

The rules under the table, for the same client:

• Priority. The MSP assigns it at triage from the examples above; the office manager can ask to raise it.
• After hours. Priority 1 only, reported by phone to the after-hours line.
• Clocks. All three start when the ticket is logged, or when the after-hours call is received. Response stops at a technician's first reply or call; automatic acknowledgments don't count. Restoration stops when the office confirms the service works. Resolution stops when the fix is complete and the cause is recorded. All three pause while an answer or action the MSP needs from the office is outstanding.
• Escalation. A ticket at risk goes to the service manager at half its target, then to the MSP's owner; the office manager escalates to the client's owner.
• Misses. No service credits in this example. Results appear in the monthly report, and a missed target goes on the quarterly review with a fix plan.

Schedule C lists who else touches the client's systems and whose terms apply.

The outline, without the example answers, is ready to download for your lawyer:

How To Write And Roll Out Your Agreement

You don't need to write contract language yourself. You need to know your services well enough to brief a lawyer. If you're still setting up the business, How To Start An MSP covers the steps before this one.

1. List what you sell and what you won't do

   Write every service in one sentence, then the exclusions.

2. Draft the schedules yourself

   You prepare the operational parameters: services, exclusions, counts, targets, hours. Counsel puts them into contract language.

3. Brief a lawyer who knows MSP contracts

   Bring the outline with your answers. One r/msp member's advice: "work with a lawyer who has experience with MSPs and have them draft it from scratch," and come with a list of wants.

   Common mistake: stitching clauses from several agreements and asking for a quick read. Definitions that don't match are hard to spot in a quick read.

4. Check the liability terms with your broker

   Send the liability, security, and indemnity clauses to your broker before a client signs.

5. Send it for signature and file it

   Ask your lawyer about any signature requirement beyond ESIGN (clause 21). Keep the signed agreement, the schedules, and every later order together per client.

6. Set up billing to match the agreement

   If the agreement says 8 included hours and an overage rate, your PSA tool has to bill exactly that. Enter each client's fee, included hours, prepaid blocks, and rates the day the agreement is signed.

   Common mistake: setting up billing from memory a month later. The first invoice then disagrees with the contract, and the client notices.

7. Review it every year and after every surprise

   Review the agreement yearly and whenever a dispute shows a gap. An SLA should include periodic review and change processes.

Common Mistakes

Disclaiming data loss in one blanket line. Define your backup duties precisely instead, and let your lawyer word the liability terms.

Blocking audits. One r/msp member picked up two clients after their previous MSP added a clause barring anyone from auditing its work. In that member's words, "it spooked the customer that the MSP was hiding stuff."

When This Guide Isn't Enough

About the author

Patrick Clements Co-founder & CEO, SherpaDesk

Patrick co-founded SherpaDesk and has led it as CEO since 2013. He has worked with IT service providers since 1998, first on network projects for schools and government offices, then on the helpdesk software their technicians use every day.

All Articles