What your MSP contract actually covers

A managed service provider (MSP) agreement describes what you bought. Whether it covers what you need is a separate question. Start with the agreement, schedules, and service descriptions, then compare them with what happens in practice. These questions clarify operational scope; they do not replace legal advice about a contract.

Distinguish monitoring from response

If an agreement says “24/7 monitoring,” ask what happens after an alert. Establish whether the service includes automated detection, human review, investigation, containment, or some combination. Check response hours and whether a response target means acknowledgment or action.

Request an example of the escalation process. A service can operate as agreed while still leaving a gap between its scope and your expectations.

Identify what patching includes

Ask for the inventory covered by patch management: operating systems, applications, servers, devices, and any exclusions. Then request a recent report showing failed updates and unresolved exceptions as well as successful work.

Decide who handles excluded systems and who accepts delays. An overall completion percentage is difficult to interpret without knowing which assets are in its denominator.

Define the recovery commitment

Ask which data and applications are backed up, who handles failed jobs, and whether recovery testing is included. Clarify the protection of backup administration and deletion permissions. Then establish who rebuilds the working service after data is restored.

Use our backup report guide to distinguish a completed backup job from evidence of usable recovery.

Establish incident responsibilities before an incident

Check whether the agreement includes emergency support, investigation, containment, recovery, or specialist forensic work. Identify the authority needed to disconnect a system and the route for engaging additional help. Confirm how your organization coordinates its other advisers and any applicable insurance requirements.

Avoid relying on a general support promise to answer those separate questions. Record what is included, what requires a separate engagement, and who makes that decision.

Create a shared record

Summarize each important activity with its owner, scope, coverage hours, expected evidence, and escalation route. Ask everyone involved to confirm their part. Where a task is shared, describe the handoff rather than assigning it to “everyone.”

A gap does not necessarily require replacing a provider. It may require a clearer agreement, an internal owner, or a separately scoped service.