IT Support Contract and SLA: What Should Be in Writing

Response time vs resolution time in an IT SLA

Most disputes over IT support come from mixing these up. A provider promising a '1-hour response' may only promise that someone replies within an hour, not that the problem is fixed.

• Response time: how long until a person acknowledges the ticket and starts work. Easy to promise, easy to measure.
• Resolution or restore time: how long until the service works again, even with a temporary workaround. Harder to promise; often given as a target rather than a guarantee.
• Support hours: the clock the SLA runs on. A 4-hour response 'in business hours' raised at 5pm Friday may mean Monday morning.

Ask for both numbers, by priority, and the hours they apply in. The example below shows the structure; the right targets depend on your business and budget.

Scope: what the IT support contract covers (and does not)

'Unlimited support' rarely is. Get scope written as lists, so both sides know what is included in the monthly fee and what is billed extra.

Also check how out-of-scope work is quoted: an hourly rate, a minimum block, and whether the provider must get approval before starting chargeable work. Our managed IT vs ad-hoc support guide helps decide which model suits you.

Admin access and ownership: keep the keys in your name

The most expensive IT contract problem shows up when you try to leave: the provider set up your Microsoft 365 tenant, domain, firewall or backups under their own account, and getting control back takes weeks. Write ownership into the contract from day one.

PDPA and data protection clauses

An IT provider that can access your mailboxes, files and customer database processes personal data on your behalf. Under the PDPA, a data intermediary that processes personal data for another organisation under a written contract is subject to the Protection, Retention Limitation and Data Breach Notification Obligations, as summarised in the PDPC's Advisory Guidelines on Selected Topics. Your business remains responsible for the data either way.

The PDPC's data breach guide requires data intermediaries to notify the organisation they work for when they detect a breach. Once you have credible grounds to believe a breach occurred, you must assess within 30 calendar days whether it is notifiable, and notify the PDPC within 3 calendar days of deciding it is. You cannot meet those deadlines if your provider is slow to tell you.

• Purpose: the provider uses your data only to deliver the service.
• Security: MFA on admin accounts, least-privilege access, logging. The PDPC's Guide to Data Protection Practices for ICT Systems is a useful reference list.
• Breach notice: the provider tells you without delay, with a stated maximum such as 24 hours from discovery.
• Subcontractors and location: who else touches the data, and in which countries.
• Return and deletion: data and copies returned or deleted at the end, with confirmation.

Exit, handover and reporting

Write the end of the relationship into the start. An exit clause costs nothing to agree on day one and is very hard to negotiate during a dispute.

1. 1

   Notice period

   One month is common for small business contracts. Avoid automatic multi-year renewals.

2. 2

   Handover pack

   Credentials, admin accounts transferred, documentation, licence list and open tickets, delivered within a set number of days.

3. 3

   Transition help

   A set number of hours at an agreed rate to brief the new provider.

4. 4

   Removal of access

   Provider's accounts and remote tools removed, with written confirmation. Our offboarding IT checklist applies to outgoing providers too.

For reporting, ask for a monthly or quarterly summary: tickets raised and resolved against SLA, patch and backup status, security alerts and recommendations. If the contract involves security work, the CSA's Cyber Essentials mark gives a useful baseline to report against. It is valid for two years once certified.

Red flags in IT support agreements

Walk away, or at least negotiate, if a proposal shows any of these.

• No numbers: 'priority support', 'fast response' or 'unlimited' without defined hours or targets.
• The provider owns your tenant, domain or licences.
• No mention of personal data, breach notification or what happens to backups when you leave.
• Long lock-in with auto-renewal and a fee to release your own credentials.
• Every exclusion vague, every inclusion specific to what is cheap to deliver.

For a wider view on picking a provider, see how to choose IT support in Singapore and our IT support cost guide.

Do it yourself or get help?

You can use the checklists above to review any proposal yourself; most providers will add ownership, breach and exit clauses if asked. Have a lawyer review long or high-value contracts.

IT Sorted's monthly plans are written this way. Protect Standard (S$19 per user per month, minimum 3 users) covers endpoint protection, encryption compliance, password manager admin, monthly awareness lessons and quarterly backup restore tests, with help within 1 business day when you forward a vendor alert. Care Plus (S$349 per month) covers website and workspace care with replies within 4 business hours. Both are cancel-any-time, and accounts stay in your name.