📌 Quick Summary
Managed I.T. services typically exclude project work, third-party software licences, hardware purchases, cloud data backup, after-hours emergency call-outs and end-of-contract data handover, unless each one is named in the agreement. Unclear scope can lead to unexpected costs, service gaps and disagreements about responsibility. This guide covers nine questions to ask before signing, spanning what the service schedule covers, where project billing begins, what response times actually promise, how far backup reaches, and what happens to your credentials and documentation if you leave.
Businesses often compare managed I.T. providers on price and reputation, but service scope deserves equal attention. Across the Greater Toronto Area and the Golden Horseshoe, the monthly price alone may not show exactly what is included in a managed I.T. service.
Canadian businesses are increasingly relying on outside consultants and managed service providers for some technology and cyber security needs. The Canadian Centre for Cyber Security reports an 11 per cent drop in organizations employing their own cyber security workers, driven mainly by the move toward outside consultants and managed service providers.
💼 Why Does Managed I.T. Scope Matter More Than Price?
Scope matters because unclear responsibilities can create service gaps and unexpected costs.
The numbers behind that:
- Statistics Canada reported in October 2024 that small businesses spent roughly $300 million recovering from cybersecurity incidents in 2023
- Medium-sized businesses spent a further $300 million, while national spending on prevention and detection reached $11.0 billion
- Recovery costs can become a point of dispute when responsibilities are not clearly documented.
If you are already noticing warning signs in your current support arrangement, the questions below will usually explain why.
📋 Which Devices, Users and Locations Does the Agreement Cover?
Coverage should be clearly documented in the agreement, service schedule or asset list. Anything that does not appear in writing is unlikely to be covered in practice.
Is pricing per user, per device, or per site? These models are not interchangeable. A ten-person Mississauga office where everyone carries a laptop, a desktop and a phone looks very different under per-user pricing than under per-device pricing.
What sits on the covered list? Workstations are commonly included, although coverage varies by provider, which is why endpoint and user support pricing swings so widely. Items often left out:
- Servers, firewalls and network switches
- Printers and point-of-sale terminals
- Personally owned laptops and phones
- Equipment at secondary or seasonal sites
For a Burlington manufacturer or an Oakville retailer, that matters, because the equipment closest to revenue is often the equipment a per-user agreement never touches.
🔧 Is Project Work Included in Managed I.T. Services?
Project work is usually excluded from monthly managed I.T. fees and quoted separately. Migrations, server replacements and major infrastructure upgrades commonly fall outside ongoing support.
Where does support end and project billing begin? That separation is reasonable. Finding out in month seven is not. Even routine preventative I.T. maintenance only protects your budget when it sits inside the scope you already pay for.
How are licences and hardware handled? Software subscriptions and equipment may be passed through at cost, marked up, or left outside the agreement for you to buy and manage. Any of the three can work. Only one matches what you assumed.
⏱️ What Response Times Should a Managed I.T. Agreement Specify?
A managed I.T. agreement should state a response time for each severity level, and state separately whether evenings, weekends and public holidays carry different terms.
What is the committed response time by severity? Words like rapid and responsive are not commitments. A time is a commitment.
What counts as an emergency, and who decides? If the provider classifies severity, their definition of a crisis may differ from yours. Remote and on-site support may be priced or covered differently, so businesses should confirm how each is handled.
In many service agreements, response time refers to acknowledgment or the start of work rather than resolution time, so confirm how your provider defines it. Ask what resolution looks like for a server outage in your Hamilton office, a network failure, and a single user problem.
💾 Is Data Backup Included in Managed I.T. Services?
Backup may be offered separately from managed I.T. services. Coverage can vary between files, servers, databases, system state and cloud-hosted data, so businesses should confirm exactly what is protected.
What does the backup actually protect? The recovery that matters rebuilds a working environment, not a folder, so the distinction between file-level and system-level protection decides whether you are back trading tomorrow or next week.
Is your cloud-hosted data covered? Microsoft’s own shared responsibility model states that data, endpoints, accounts and access management always remain the customer’s responsibility, including for software-as-a-service products such as Microsoft 365. Platform uptime and data protection are separate responsibilities, which is why cloud backup still applies to hosted platforms.
Backing up and encrypting data also sits among the baseline controls the Canadian Centre for Cyber Security recommends for small and medium organizations.
Then ask what separates a safeguard from a line item:
- ✅ Who tests restores, and how often
- ✅ How many hours a full restore takes
- ✅ Who is notified when a backup job fails
🔑 What Happens to Your Credentials and Documentation if You Switch Providers?
If ownership and handover responsibilities are unclear, retrieving credentials, documentation and data during a provider transition can become more difficult. Naming them in advance avoids that.
What comes back to you at the end of the term? Confirm the notice period, what transition assistance looks like, and the format your data returns in, because an export you cannot open is not a handover.
Patching responsibility deserves the same treatment. Verizon’s 2026 Data Breach Investigations Report found that 31 per cent of breaches now begin with software vulnerabilities, overtaking stolen passwords as the leading way in. If patching responsibilities are not clearly assigned, important systems can fall between the responsibilities of the business and the provider.
💡 The Smarter Move Forward
- ✅ Coverage: get the covered items documented in writing
- ✅ Projects: know where monthly support ends
- ✅ Response: ask for times by severity, including after hours
- ✅ Backup: confirm what is protected and who tests restores
- ✅ Exit: document who controls and receives credentials and data before you sign
The same standard applies whether you are hiring for the first time or reassessing an existing managed service provider at renewal. AccuIT supports businesses in Toronto, Brampton, Stoney Creek, Grimsby and Niagara Falls, including teams whose internal staff need co-managed I.T. support rather than full outsourcing.
❓ Common Questions About Managed I.T. Services Scope
What is usually not included in managed I.T. services?
Managed I.T. services usually exclude project work such as migrations and server replacements, third-party software licences, hardware purchases, cloud data backup, after-hours emergency call-outs and end-of-contract data handover. Each of these can be added, but only when the agreement names it directly. AccuIT recommends confirming all six in writing before signing.
Does managed I.T. include data backup?
Not automatically. Backup may be a separate service, and coverage can vary between files, servers, databases, system state, and cloud-hosted data. Ask which workloads are protected and who tests restores.
What questions should I ask before signing a managed I.T. agreement?
Ask how pricing is calculated, which items are documented as covered, where project billing begins, what response time attaches to each severity level, whether after-hours rates differ, what the backup protects, how often restores are tested, and who controls credentials and documentation at the end of the term.
Are after-hours I.T. support calls included in the monthly fee?
Often not. Many agreements apply different response commitments outside business hours, and on-site emergency attendance frequently carries a separate call-out rate. Ask how severity levels are defined, who declares an emergency, and what the rate is before you need it rather than after.
📞 Where to Start
Before you renew, have someone read your current agreement against these nine questions. If the answers are not clearly documented, ask the provider to confirm them in writing.
Call AccuIT at 1-866-409-8647 or visit www.accuit.ca to book a complimentary I.T. infrastructure assessment and see exactly what is covered today and what is not.
