10 Questions Before Signing a New IT Contract

Most IT contracts are signed on trust and read for the first time during a dispute. That is backwards. The document in front of you decides what happens on your worst day: the outage, the breach, the moment you decide to leave. The provider wrote it, their lawyer refined it, and every ambiguity in it tends to resolve in their favor.

You do not need a law degree to protect yourself. You need ten direct questions, asked before you sign, with the answers written into the agreement rather than promised in a sales call. If a provider gets cagey about any of these, that reaction is itself an answer. (One caveat before we start: this is practical guidance from people who read these contracts every week, not legal advice. For anything high stakes, have an attorney review the final draft.)

1. What exactly does the monthly fee cover?

Ask for the inclusion list in writing: help desk, on-site visits, patching, backup management, security tooling, vendor coordination, after-hours work. Then ask the sharper question: what generates a separate invoice? Many disputes trace back to the word "projects," which some providers stretch to cover anything longer than a password reset. Get examples of billable versus included work into the agreement itself.

2. What are the response and resolution SLAs, and what happens when you miss them?

A service level agreement without a consequence is a mood board. Ask for response times by severity (a down server is not a printer jam), how "response" is defined (a human working the issue, not an auto-reply), and what the remedy is for a miss, typically a service credit. A provider who resists any remedy is telling you how seriously they take their own numbers.

3. How long is the term, and what does leaving early cost?

One to three year commitments are common in this market. What matters is the exit: is there an early termination fee, how is it calculated, and does poor performance waive it? Some agreements demand every remaining month at full price, which turns a bad relationship into a prepaid sentence. We wrote a full breakdown in MSP Contract Exit Clauses, Explained.

4. Does this contract renew automatically, and how do I stop it?

Evergreen clauses quietly renew the whole term unless you give notice inside a specific window, often 60 to 90 days before the end date. Miss the window by a week and you can be locked in for another year. Ask for the renewal mechanics in plain language, then put the notice deadline in your calendar the day you sign.

5. Who owns the passwords, and where do they live?

Administrative credentials for your domain, firewall, Microsoft 365 or Google Workspace tenant, backups, and line-of-business apps should belong to your company, with the provider holding delegated access. If the contract is silent here, the practical answer becomes "whoever holds them," and that is how businesses end up negotiating for their own passwords on the way out.

6. What are your offboarding obligations when this ends?

This is the question almost nobody asks and everybody wishes they had. A good contract obligates the provider to hand over credentials, documentation, license details, and configurations within a defined number of days, and to cooperate with the incoming provider for a defined transition period. Ask whether offboarding assistance is included or billed hourly, and at what rate. The time to negotiate your exit is the moment you have the most leverage: before you sign.

7. How and when is my data returned?

If the provider hosts your backups, email archives, or files, ask three things: in what format the data comes back, how quickly, and at what cost. Then ask how long they retain copies after termination and when those copies are destroyed. "We would work something out" is not an answer; a data return clause is.

8. What security is actually included?

"Security included" can mean a serious managed stack or a free antivirus and good intentions. Ask specifically: multi-factor authentication enforcement, patch cadence, endpoint detection and response, backup testing, and whether they will help complete your cyber insurance questionnaire. If security items appear as optional add-ons, price the package you actually need before comparing this quote to anyone else's.

9. Who will actually support us?

Ask how many engineers are on staff, who covers nights and weekends, and what happens when your primary technician leaves or goes on vacation. Ask whether help desk calls go to employees or a subcontracted call center. You are not buying a logo; you are buying the specific humans who answer at 7 a.m. when nobody can log in.

10. Can I talk to a client who left?

References who love their provider are easy to produce. The revealing conversation is with a client who departed: was the offboarding clean, did the credentials arrive, did the last invoice hold surprises? A provider who handles exits gracefully has nothing to hide here. And if you are asking these questions because your current provider failed them, our list of nine signs you should fire your IT provider will feel familiar.

Get the answers in writing, then hold the pen

None of these questions is hostile. Good providers answer all ten happily, because clear terms protect them too. Once you have signed with the right one, the work shifts to execution; our companion piece on your first 90 days with a new IT provider covers what a strong start looks like. And if you want help comparing candidates before you get to contract stage, start with how to compare IT providers apples to apples.

If you would rather not run this gauntlet alone, that is literally what we do. We review what you are being offered, flag the clauses that will hurt later, and if you decide to switch, we run the entire transition, credentials and breakup call included, with zero downtime. Month to month, no lock-in, because we think contracts should earn renewal rather than enforce it.