IT Support Contract Template

Reviewed by the Agiled editorial teamUpdated June 2026

IT support contracts sell a promise measured in hours: how fast someone responds when the server dies versus when a mouse won't scroll. The SLA grid — severity...

Part of our free contract template library — 75+ agreements in Word and PDF, ready to customize and sign.

IT Support Contract Template — page 1

Read the full template ↓

Actual preview of the template you'll download — not a stock image.

Full template text

IT SUPPORT SERVICE CONTRACT
This IT Support Service Contract ("Agreement") is entered into as of [Date] by and between:
Provider: [Business Name], located at [Address], Phone: [Phone], Email: [Email] ("Provider")
Client: [Business Name], located at [Address], Phone: [Phone], Email: [Email], Primary Contact: [Name, Title] ("Client")
1. Term
a) This Agreement is effective from [Start Date] to [End Date] (the "Initial Term").
b) After the Initial Term, this Agreement shall automatically renew for successive [1-year / month-to-month] periods unless either party provides written notice of non-renewal at least [60 / 30] days before the end of the current term.
2. Scope of Services
The Provider shall deliver the following services:
a) Help Desk Support: Remote technical support for end-user issues, including email, software, hardware, connectivity, and printing problems.
b) Network Monitoring and Management: 24/7 monitoring of the Client's network infrastructure, including routers, switches, firewalls, and wireless access points.
c) Server Management: Monitoring, patching, and maintenance of the Client's servers, including [list specific servers or "all servers listed in Exhibit A"].
d) Workstation Management: Software patching, antivirus management, and performance monitoring for [Number] workstations.
e) Backup Management: Daily backup of [specified data / all critical data] with verification of backup integrity.
f) Security Management: Firewall management, antivirus/anti-malware deployment, email filtering, and security patch management.
g) Vendor Coordination: Acting as the Client's liaison with third-party technology vendors and ISPs for issue resolution.
h) Quarterly Business Reviews: The Provider shall meet with the Client quarterly to review system health, outstanding issues, upcoming needs, and strategic IT planning.
3. Exclusions
The following are NOT included in this Agreement:
a) Hardware procurement and replacement costs (the Provider may assist with procurement for an additional fee).
b) Software licensing costs.
c) Support for personal devices not owned by the Client.
d) Support for software not listed in Exhibit A.
e) Cabling, electrical work, or physical infrastructure modifications.
f) Data recovery from failed hardware not covered by the backup services in this Agreement.
g) Projects exceeding [4] hours of work, which shall be quoted and billed separately.
h) Support for end-of-life hardware or software no longer supported by the manufacturer.
4. Service Level Agreement (SLA)

Priority Level	Description	Response Time	Resolution Target
Critical (P1)	System-wide outage, security breach, data loss	[15 minutes / 1 hour]	[4 hours]
High (P2)	Single user unable to work, critical application failure	[1 hour / 2 hours]	[8 hours]
Medium (P3)	Performance degradation, non-critical software issues	[4 hours]	[24 hours]
Low (P4)	Informational requests, how-to questions, minor issues	[8 hours / 1 business day]	[3 business days]
a) Response time is measured from the time the support request is received via an approved support channel during support hours.
b) Resolution target is the target for resolving or providing a workaround. The Provider shall use commercially reasonable efforts to meet these targets but does not guarantee resolution within these timeframes for issues caused by third-party vendors or hardware failures.
c) Uptime Guarantee: The Provider guarantees [99.5]% uptime for the Client's core network and server infrastructure, measured monthly, excluding scheduled maintenance windows.
d) SLA Credits: If the Provider fails to meet the uptime guarantee, the Client shall receive a service credit equal to [5]% of the monthly fee for each [0.1]% of downtime below the guaranteed level, up to a maximum of [25]% of the monthly fee.
5. Support Channels and Hours
a) Support requests shall be submitted via: [Phone: [Number] / Email: [Address] / Ticketing Portal: [URL]].
b) Standard Support Hours: [Monday through Friday, 8:00 AM to 6:00 PM [Timezone]].
c) After-Hours/Emergency Support: Available for P1 and P2 issues at [no additional cost / an additional rate of $[Amount] per hour].
d) The Client shall designate [Number] authorized contacts who may submit support requests.
6. Pricing and Payment
a) Monthly Service Fee: $[Amount] per month, covering all services described in Section 2.
b) Per-User Fee (if applicable): $[Amount] per user per month for [Number] users.
c) Out-of-Scope Work: Billed at $[Amount] per hour, with a [1-hour] minimum, pre-approved by the Client.
d) Project Work: Quoted separately on a per-project basis.
e) Payment Due: The [1st] of each month, payable via [ACH / Check / Credit Card].
f) Late Payment: A late fee of [1.5]% per month shall apply to balances more than [15] days past due.
g) The Provider reserves the right to suspend non-critical services if the Client's account is more than [30] days past due, with [10] days' written notice.
7. Client Responsibilities
a) Maintain active warranties on all hardware covered under this Agreement.
b) Provide the Provider with remote and on-site access to systems as needed.
c) Designate authorized contacts for support requests and approval of changes.
d) Follow the Provider's recommended security policies, including password management, multi-factor authentication, and acceptable use policies.
e) Promptly report any issues, security incidents, or changes in the IT environment.
f) Maintain valid software licenses for all applications.
g) Approve and schedule maintenance windows as needed.
8. Data Security and Confidentiality
a) The Provider shall maintain commercially reasonable security measures to protect the Client's data, including encryption, access controls, and employee background checks.
b) The Provider shall comply with all applicable data protection laws and, where applicable, [HIPAA / PCI-DSS / SOC 2 / Other: ___] requirements.
c) Each party agrees to keep the other's confidential information — including business data, technical configurations, customer lists, and financial information — strictly confidential.
d) The Provider shall notify the Client within [24 / 48] hours of discovering any data breach or security incident affecting the Client's systems or data.
9. Backup and Disaster Recovery
a) The Provider shall perform [daily / hourly] backups of the Client's [servers / critical data / all data].
b) Backups shall be stored [on-site / off-site / in the cloud at [Location/Provider]].
c) Backup retention: [30] days of daily backups, [12] months of monthly backups.
d) Recovery Time Objective (RTO): [4 / 8 / 24] hours for critical systems.
e) Recovery Point Objective (RPO): Data loss shall not exceed [1 / 4 / 24] hours.
f) The Provider shall test backup recovery [monthly / quarterly] and provide test results to the Client.
10. Liability and Indemnification
a) The Provider's total liability under this Agreement shall not exceed [12 months' / 6 months'] fees paid by the Client.
b) Neither party shall be liable for indirect, incidental, consequential, or punitive damages.
c) The Provider shall not be liable for downtime, data loss, or service interruptions caused by the Client's actions, third-party vendors, internet service providers, or force majeure events.
d) Each party shall indemnify the other against third-party claims arising from the indemnifying party's breach of this Agreement or negligence.
11. Termination and Transition
a) Either party may terminate this Agreement at the end of the current term by providing [60 / 30] days' written notice.
b) Early termination by the Client during a fixed term requires payment of an early termination fee equal to [Number] months' fees.
c) The Provider may terminate immediately for non-payment exceeding [60] days or for Client actions that violate the law.
d) Upon termination, the Provider shall:

Provide all Client data in a standard, accessible format within [30] days.
Assist with the transition to a new provider for up to [Number] hours at no additional cost.
Return or securely destroy all Client data in the Provider's possession within [30] days.
Provide all administrative passwords and access credentials to the Client.
e) The Client shall pay all outstanding fees through the effective date of termination.
12. Dispute Resolution
Disputes shall be resolved through good-faith negotiation, followed by mediation if necessary. If mediation fails, disputes shall be submitted to binding arbitration in [City, State]. This Agreement shall be governed by the laws of the State of [State].
13. Entire Agreement
This Agreement, including any attached Exhibits, constitutes the entire understanding between the parties. Amendments must be in writing and signed by both parties.
EXHIBIT A: Covered Assets
[Attached inventory of hardware, software, and network components.]
SIGNATURES
Provider Representative: ___________________________ Date: _______________
Print Name / Title: ___________________________
Client Representative: ___________________________ Date: _______________
Print Name / Title: ___________________________

Managed services: $100 – $250 / user / month
Break-fix hourly: $100 – $200
Critical response: 1 – 4 hours
Backups: Verified and restore-tested

What your it support contract should cover

Service model

Managed services (flat per-user or per-device monthly, proactive monitoring, the provider profits from prevention) versus break-fix (hourly, reactive, the provider profits from problems) — the incentive difference worth understanding. Hybrids: managed core with project work quoted separately.

The SLA grid

Severity definitions with examples (critical: business-stopping outage; high: degraded for many; medium: single user impaired; low: inconvenience), response windows per tier (critical 1–4 hours, low next business day), and the honesty line: these are response commitments — resolution targets stated separately where offered, because no one can warrant how long a vendor's bug takes.

Scope: covered and excluded

Covered users, devices, servers, and SaaS applications inventoried as an exhibit; the excluded list explicit (home equipment, unsupported OS versions, software past vendor end-of-life, anything the client installs against advice) — and the inventory updated quarterly, because scope drift is billing drift.

Security responsibility matrix

Who owns what, in a table: patching cadence, endpoint protection/EDR, firewall management, MFA enforcement, security awareness training, and backup operation. Shared-responsibility ambiguity is how breaches become lawsuits between client and provider.

Backups, verified

The clause that matters most and gets read least: backup scope (what's included — SaaS data like M365/Google often isn't, without a stated add-on), schedule, retention, offsite/immutable copies, and verification — automated integrity checks plus periodic restore tests with documented results. An unverified backup is a hope, not a control.

Onboarding and offboarding users

The account-lifecycle SLA: new-hire setup within a stated window from ticket, and — the security-critical one — departing-employee deactivation within hours of notice, with a documented checklist (accounts, MFA, devices, shared credentials).

After-hours and emergency terms

Business-hours definition, after-hours/weekend rates (1.5–2×) or the premium SLA tier that includes them, and the emergency contact path that actually reaches a human at 2 a.m.

Third-party vendor coordination

The provider acts as the client's technical liaison with ISPs, software vendors, and hardware warranty channels ('vendor management') — time billed within the plan or hourly, and the boundary stated: coordinating the ISP's repair isn't owning the ISP's outage.

Data handling and breach notification

Confidentiality, least-privilege access to client systems, where credentials are stored (a proper PAM/vault, not a spreadsheet), breach notification within a stated window (24–72 hours), and compliance posture for regulated clients (HIPAA BAAs signed where applicable).

Term, termination, and the exit package

12-month terms with auto-renewal and 60–90 day notice, and the offboarding clause that determines switching costs: documentation current and delivered (network maps, credentials, license inventories), admin access transferred, no 'hostage' withholding — cooperative transition billed at standard rates.

Typical IT support terms (U.S., 2026)

Item	Typical range	Notes
Managed services	$100 – $250 / user / month	Stack depth drives it
Break-fix hourly	$100 – $200	After-hours 1.5 – 2×
Critical response SLA	1 – 4 hours	Response ≠ resolution
Standard response SLA	4 – 8 business hours	Medium severity
Offboarding (security)	Within hours of notice	Departing employees
Breach notification	24 – 72 hours	Contractual window
Term / notice	12 months / 60 – 90 days	Auto-renewal typical

Pricing scales with the included stack (EDR, backup, SaaS management) and SLA tier. The backup-verification and exit-package clauses are where providers genuinely differ — read them harder than the rate.

How it support contracts work in practice

The managed-services relationship

A 30-person company on a per-user monthly plan: monitoring, patching, helpdesk, backups, security stack. The contract's working parts: the covered-inventory exhibit (the CFO's home laptop is in or out — decided in writing), the SLA grid doing expectation management daily (the broken mouse is a low; the down file server is a critical; both get answered, on different clocks), the quarterly business review where the inventory, ticket trends, and roadmap get a standing meeting, and the per-user math that keeps billing clean as headcount moves — joiners and leavers adjusting the invoice by the stated mechanism, not by annual renegotiation.

The ransomware test

The scenario every clause was secretly written for: encryption event, Monday 6 a.m. What the contract determines: the response (critical SLA clock starts; the provider's incident-response role and any IR retainer terms engage), the recovery (the backup clause is now either the company's survival or its obituary — immutable offsite copies, tested restores, and a documented RTO mean a bad week; an unverified backup means negotiating with criminals), the notification machinery (breach notification windows, cyber-insurer coordination, regulated-data obligations), and the accountability map — the security matrix showing patching was current and EDR was deployed is the provider's defense; gaps the client declined in writing are the client's.

The provider switch

The relationship ends — outgrown, underwhelmed, or acquired — and the exit clause gets its one performance. The good version: 60–90 days' notice, current documentation delivered (network diagrams, credential vault export, license and warranty inventories, backup configurations), admin rights transferred with the new provider in a coordinated handoff, and transition support billed at standard rates. The bad version — the industry's open secret — is the provider who kept documentation thin and credentials proprietary precisely so leaving hurts. The contract clause that prevents it is signed on day one, when everyone's friendly: documentation as a deliverable, current at all times, owned by the client.

Mistakes that weaken a it support contract

Confusing response with resolution

'4-hour SLA' usually means engagement, not repair — and the gap between those readings is the relationship's first fight. The contract should define both terms and state plainly which it commits to.

Unverified backups

Backups that have never restored are a checkbox, not a control — and the discovery moment is the worst possible one. Mandate integrity checks and periodic documented restore tests, including SaaS data scope.

Ambiguous security ownership

'They handle our security' meets 'we recommended MFA and they declined' in a deposition. The responsibility matrix — who owns patching, EDR, MFA, training, backups — in a table, with client declinations documented.

No offboarding SLA for departing staff

The ex-employee whose accounts lived for three weeks is the most preventable breach vector in small-business IT. Deactivation within hours of notice, with a checklist, as a contractual commitment.

Signing without an exit package

Thin documentation and provider-held credentials make switching cost more than staying — by design. Documentation as a client-owned deliverable, current always, is the clause that keeps the relationship voluntary.

How to use this template

01
Download the IT support contract template in Word or PDF.
02
Choose the model — managed per-user or break-fix — and attach the covered inventory.
03
Build the SLA grid: severity definitions, response windows, after-hours terms.
04
Complete the security responsibility matrix, including backup verification.
05
Set onboarding/offboarding SLAs and breach-notification windows.
06
Add the exit package — documentation, credentials, transition — then sign.

Skip this template if…

One-off computer repairs — a repair work order with diagnostic fees covers single-device fixes without SLA machinery.
Custom software builds — development engagements run on a software development agreement with acceptance and IP terms.

FAQs

How much does IT support cost?

Managed services run $100–$250 per user per month depending on the included stack (helpdesk, monitoring, patching, EDR, backup); break-fix support bills $100–$200 hourly with 1.5–2× after hours. Managed pricing usually wins past ~10 users — and aligns incentives toward prevention rather than billable problems.

What is an SLA in an IT support contract?

The service-level agreement mapping issue severity to committed response windows — critical outages at 1–4 hours, routine issues next business day. The precision that matters: response time (engagement begins) versus resolution time (it's fixed) are different commitments, and most SLAs promise the former. Both should be defined in the contract.

What's the difference between managed services and break-fix?

Managed services: a flat monthly fee for proactive monitoring, maintenance, and support — the provider profits when things don't break. Break-fix: hourly billing when something fails — the provider profits when they do. The incentive difference is the real product difference; managed models suit any business where downtime costs more than the subscription.

Who is responsible for backups — the IT provider or the business?

Whoever the contract says — which is why the security responsibility matrix matters. A proper backup clause covers scope (including SaaS data like Microsoft 365, which needs an explicit add-on), schedule, retention, immutable offsite copies, and verification: automated integrity checks plus periodic restore tests with documented results. An unverified backup is a hope with a line item.

What should happen when an employee leaves?

Account deactivation within hours of notice — not days — executed against a documented checklist: credentials, MFA tokens, device retrieval, shared-account rotation, and mailbox/data handling. The lingering ex-employee account is the most preventable breach vector in small-business IT, and the offboarding SLA is the contract's answer.

How do I switch IT providers without getting held hostage?

With the exit clause signed at the start: documentation (network maps, credential inventories, license records) maintained as a client-owned deliverable throughout the relationship, admin access transferable on notice, and cooperative transition support billed at standard rates. Providers who keep documentation thin and credentials proprietary have made leaving expensive on purpose — the contract is where that's prevented.

Pair it with the it consulting invoice template

The contract sets the terms — the invoice collects on them. Free download with the right line items pre-filled.

Need more than a template?

Create, send, and e-sign contracts with Agiled — alongside your CRM, invoicing, and projects.

Start free with Agiled