What your managed IT quote doesn't say

Does it say whether help desk support is genuinely unlimited, or capped by hours, tickets or users?

Why it matters

"Unlimited support" is very often capped further down in the schedule, with everything past the cap billed by the hour. The cap, not the headline monthly figure, is what decides the cost of a bad month.

Does it define what "24/7" means — an engineer who can fix things, or a service that takes a message?

Why it matters

Almost every proposal claims round-the-clock cover. The difference between an engineer who can log in at 2am and an answering service that raises a ticket for the morning is the difference between a long night and a lost week.

Are response and resolution targets stated by priority level, with something attached if they're missed?

Why it matters

A target with no priority definitions and no consequence is a statement of intent. Without them you have no way to tell whether a two-day wait for a down server was a failure or simply normal.

Are on-site visits included, and does it say how many and how quickly somebody turns up?

Why it matters

Remote support handles most things until it doesn't. If on-site attendance is billable and undefined, the day your switch dies becomes an unbudgeted invoice plus an argument about travel time.

Is it explicit about what is being priced — every user, endpoint, server, site and network device — and what is excluded?

Why it matters

This is the single most common source of a bill that doesn't match the quote. If the count is loose, so is the price, and anything not on the list becomes chargeable exactly when you need it supported.

Does it say whether dealing with your other vendors — internet, phone system, line-of-business software — is included?

Why it matters

Most real outages end up being somebody else's fault. If nobody owns the call to that vendor, the job quietly falls to whoever in your office is least busy, which is the opposite of what you're paying for.

Does it say who actually performs the work — in-house staff, subcontractors, or an offshore service desk?

Why it matters

Subcontracted and offshore delivery isn't automatically worse, but it changes who has access to your systems, which timezone answers, and who you can escalate to. Being told after signing is the problem.

Does it name multi-factor authentication as included — deployed and enforced, not merely available?

Why it matters

"MFA available" and "MFA enforced on every account" are different products with the same name. Optional MFA means the accounts most worth attacking are the ones that turned it off.

Does it name the endpoint security product, and say whether the licence sits inside the monthly fee?

Why it matters

An unnamed "endpoint protection" line can mean managed detection and response with a human watching, or the antivirus already built into Windows. The gap between those two is most of your ransomware exposure — and often a separate licence bill.

Does it commit to patching on a stated schedule, and say whether third-party applications are included?

Why it matters

Operating system patching is table stakes; browsers, PDF readers and line-of-business apps are where the unpatched holes usually sit. Without a compliance report you're trusting that it happened.

Does it include email authentication — SPF, DKIM and DMARC configured and moved to an enforcing policy?

Why it matters

Publishing a DMARC record and enforcing one are different jobs, and only the second stops somebody invoicing your customers from your domain. A record left on p=none looks like compliance and blocks nothing.

Does it say who watches security alerts outside business hours, and what they're allowed to do about one?

Why it matters

Attacks are timed for when nobody is looking. An alert that fires into an unattended queue at 3am on a long weekend has bought you nothing, and authority matters as much as attention — noticing without permission to act just means watching.

Does it say whether responding to a security incident is covered, or billed separately as project work?

Why it matters

This is the clause you'll care about most on the worst day, and it's routinely absent. Discovering that incident response is hourly, at premium rates, while you're mid-incident is a bad time to find out.

Is security awareness training or phishing simulation named as included, or is it an add-on?

Why it matters

Phishing remains one of the most common ways in, and it targets judgement rather than systems. It's also one of the cheapest add-ons to quietly leave out of a competitive quote.

Does it state exactly what's backed up — servers, endpoints, and the data in Microsoft 365 or Google Workspace?

Why it matters

Microsoft and Google guarantee their service is available, not that your data is recoverable, and a great many proposals quietly assume the platform handles it. A deleted mailbox or an encrypted SharePoint library is where that assumption fails.

Does it commit to test restores — how often they run, and whether you're shown the result?

Why it matters

A backup nobody has restored from is a hypothesis. The gap between "backups are running" and "we restored the server in four hours" only ever reveals itself on the day it matters, and by then it's your problem, not theirs.

Does it put numbers on recovery — how much data you could lose, and how long you'd be down?

Why it matters

Recovery objectives turn "we'll get you back up" into something you can hold somebody to, and let you judge whether the backup design actually matches how long your business can survive offline.

Does it say where your data and backups are physically stored, and in which country?

Why it matters

Under PIPEDA you stay accountable for personal information even once a provider is holding it, and you are expected to tell your own customers if it is processed outside Canada. Alberta and Quebec go further — Alberta requires notice, and Quebec an assessment, before personal information leaves the province. Plenty of clients, insurers and public-sector contracts require Canadian residency outright.

Does it say who owns your Microsoft 365 or Google Workspace tenant and your domain, and who holds the top-level administrator credentials — you or the provider?

Why it matters

If the provider owns the tenant, leaving stops being a commercial decision and becomes a negotiation. This is the line that most often turns leaving into a negotiation rather than a decision.

Does it say you receive the documentation — network diagram, asset inventory, licence records — and how administrative access is handed back, if you leave?

Why it matters

Documentation is the thing that makes you portable. Without a written commitment, the next provider spends the first month and a lot of your money rediscovering a network the last one already mapped.

Does it say who holds your backup data, and how you get it back if the relationship ends?

Why it matters

Backups usually sit in the provider's tenant on the provider's storage. If the mechanism and the cost of getting years of it back aren't agreed up front, they get decided at the worst possible moment.

Does it set out the term, the notice period, whether it auto-renews, and any early-termination charge?

Why it matters

An auto-renewing term with a long notice window can silently commit you to another year, and early-termination charges are usually the number nobody reads until they want to leave.

Is the line drawn between covered work and project work — migrations, new sites, hardware, licences?

Why it matters

This boundary is where the monthly fee meets reality. A quote that leaves it vague can look competitive and still produce a stream of project invoices for work you assumed was included.

Does it state the provider's insurance and the limit of their liability if something goes wrong?

Why it matters

Liability in managed IT contracts is very often capped at a few months' fees, which is nowhere near the cost of the incident it would follow. It's also the clause most likely to matter and least likely to be read.

Does it say how and when the monthly price can change?

Why it matters

Vendor licence costs move every year and get passed on. Without a stated mechanism and notice period, your budget is a guess and your leverage is nil.

Does it state the onboarding fee, how long onboarding takes, and what it covers?

Why it matters

Onboarding is where the remediation gets found. If the fee and its boundary aren't agreed, the first few months arrive with a run of "this needed fixing before we could support it" invoices.