What’s in a Good IT Service Agreement? SLAs, Response Times, Exclusions, and Gotchas

Bottom line up front

A good IT service agreement does two things at the same time:

1. It protects your business with clear coverage and accountability.

2. It prevents surprises by spelling out what is included, what is not, and how fast help shows up.

If you cannot quickly answer “What do we get, how fast, and what will cost extra?” you are taking on avoidable risk.

Why this matters

Most businesses sign an IT agreement because they want stability, security, and predictable costs. But the agreement itself is where the relationship either works smoothly or turns into constant frustration.

We see the same pattern when companies switch providers: the prior agreement looked fine on the surface, but it left gaps in places that only show up during a real incident.

This guide walks through what a solid agreement should include and where the most common traps hide.

---

The core parts of a good IT service agreement

1. Clear scope: what is included

This should be written in plain language. A strong agreement specifies coverage for things like:

• End-user support (help desk for staff)

• Device management (laptops and desktops)

• Server and infrastructure support (if applicable)

• Microsoft 365 or Google Workspace administration

• Patch management and updates

• Backup monitoring and remediation

• Security basics such as MFA, endpoint protection, and email security

• Vendor management with ISPs and line-of-business vendors

• Onboarding standards and documentation

If the agreement uses vague phrases like “as needed” or “best effort” without specifics, push for clarity.

---

2. SLAs: service level agreements that actually mean something

SLAs define how quickly your provider responds and resolves issues.

A good SLA includes:

• Response time – when they acknowledge and begin working

• Resolution targets – how long until it’s fixed or escalated

• Severity levels – what counts as critical versus normal

• Business hours vs after-hours coverage

Example severity levels (what “good” often looks like)

• Critical outage (company-wide down): response in 15–60 minutes

• High impact (multiple users blocked): response in 1–2 hours

• Standard (single user issue): response same day or next business day

• Low priority (how-to requests): scheduled or handled in queue

The exact numbers may vary. What matters is that the logic and commitments are clearly stated.

---

3. Response times vs resolution times (don’t confuse them)

Many providers advertise fast response times because it sounds reassuring. But response without progress does not solve your problem.

A strong agreement defines:

• response time (acknowledgement and start)

• escalation path (who takes over if it isn’t solved)

• resolution targets or expected timelines

If your agreement only promises response times, treat it as incomplete.

---

The most important “gotcha” sections

4. Exclusions: what is not covered

Every agreement has exclusions. That is normal. The problem is when exclusions are so broad that the agreement barely covers anything.

Common exclusions include:

• Projects and major upgrades

• After-hours support

• High-volume onboarding or offboarding

• Hardware replacement and procurement

• Network redesign or cabling

• Cloud migrations

• Vendor-specific application support

• Cyber incident recovery outside defined scope

A good agreement does not hide these. It lists them clearly and explains how they are handled.

---

5. Projects vs included work (where budgets blow up)

This is one of the biggest sources of friction.

A strong agreement clearly defines:

• what counts as included support

• what counts as a project

• the approval process for project work

• how projects are priced (fixed fee, hourly, packaged)

If the word “project” is undefined, routine improvements can suddenly become surprise charges.

---

6. After-hours support and emergency coverage

If your business operates outside 9–5, this section matters.

Your agreement should specify:

• what qualifies as an after-hours emergency

• how to contact support after hours

• response expectations

• after-hours pricing if it is not included

Many companies assume support is 24/7. Many agreements assume business hours only. That mismatch becomes painful during an outage.

---

Security expectations: what should be written down

7. Minimum security baseline

A strong IT provider enforces baseline security controls across all clients.

Your agreement should document controls such as:

• MFA for email and remote access

• Endpoint protection or EDR

• Patch management cadence

• Administrative access policies

• Backup standards and testing frequency

• Logging and monitoring expectations

If these are not written down, security becomes optional. Optional security usually fails.

---

8. Incident response: what happens during a cyber event

Most providers will help during a security incident. The question is what is included.

Look for clarity on:

• who coordinates response

• what work is included

• what triggers additional billable work

• communication expectations

• documentation provided afterward

For leadership and insurance purposes, documentation matters almost as much as the technical fix.

---

Practical contract terms that matter more than people think

9. Onboarding and documentation requirements

A good provider documents your environment and keeps that documentation current.

Your agreement should cover:

• onboarding timeline and deliverables

• network diagrams and asset inventory

• password vault and credential handling

• ongoing documentation updates

This documentation becomes critical during troubleshooting, audits, or provider transitions.

---

10. Ownership: who owns what

It should be clear who owns:

• licenses

• configurations

• admin accounts

• documentation

• backups

If ownership is unclear, switching providers can become unnecessarily difficult.

---

11. Reporting: what you should expect to see

A strong agreement includes regular reporting leadership can understand, such as:

• ticket volume and trends

• response and resolution performance

• patch compliance

• security event summaries

• backup success and failures

• strategic recommendations

This reporting is how you confirm you are getting value, not just reactive tech support.

---

Red flags that should make you pause

Be cautious if an agreement includes:

• No clear SLA or severity definitions

• Vague scope with broad exclusions

• “Unlimited support” language without limits

• No mention of security baseline controls

• No defined process for projects and change approvals

• No clarity on offboarding and data return

• No reporting commitments

These gaps often lead to frustration later.

---

What to ask before you sign

Before committing to an IT service agreement, ask these questions:

1. What is included versus excluded, in plain English?

2. What are your response and resolution targets by severity?

3. How do you define a project and how is it priced?

4. What security baseline do you enforce for all clients?

5. What happens during a cyber incident, and what is included?

6. What reporting do we receive each month or quarter?

7. If we leave, how do we retrieve our documentation, admin access, and backups?

If your provider can answer these clearly, you are likely working with a mature IT partner.

---

Next step

If you want a quick gut check, review your current IT agreement and look for:

• SLA clarity

• Project definitions

• Exclusions

• Security baseline requirements

• Incident response coverage

• Offboarding and data return terms

If any of those areas are vague, tightening them before renewal can prevent major surprises later.