Two MSP contracts at the same monthly price can differ wildly in what they actually commit to. The clauses that matter surface only when something breaks.
Managed IT is sold as a monthly number, which makes contracts look comparable when they are not. The difference between two providers at the same price is usually invisible until an incident makes it visible.
Here is what the categories should mean, and where the gaps usually sit.
Monitoring means alerts someone acts on
Every provider monitors. The question is what happens at 2am on a Sunday when an alert fires — is there a person, what is their target response time, and is that written into the SLA or merely described on a website?
The second question is tuning. Monitoring that fires constantly gets muted, and muted monitoring is worse than none because everyone believes it is working.
Backup is not backup until it has been restored
Almost every contract includes backup. Far fewer include periodic tested restores.
An untested backup is an assumption, and the moment you discover the assumption was wrong is the worst possible moment. Ask specifically: how often is a restore actually performed, and do you get the result in writing?
Patching has a scope boundary you should read
Operating system patching is standard. Third-party application patching often is not, and third-party applications are a common route in.
Unpatched systems remain one of the most common causes of small-business compromise, so this boundary matters more than its placement in the contract suggests.
The clauses worth reading twice
Response versus resolution: many SLAs commit to acknowledging an issue quickly and say nothing about fixing it.
Severity definitions: who decides whether your outage is critical, and does that definition match how your business experiences it?
Onboarding and exit: how long is discovery before the SLA takes effect, and if you leave, do you get your documentation and access back — in what format, and how quickly?
The right shape for most organisations
Complete outsourcing suits organisations with no internal IT. Most growing companies do better with a split: the provider takes monitoring, patching, backup and after-hours coverage, while internal people keep the business-specific systems they understand best.
That arrangement also avoids the failure mode where nobody owns anything, because both sides can name exactly what is theirs.
