An IT support agreement should explain who can access your systems, who owns each responsibility, and what happens when the relationship changes. For a small Texas business, those details matter as much as the list of software and the monthly fee.
Your provider needs enough access to perform the agreed work. Meanwhile, your business needs appropriate control over its own accounts and records. The practical goal is a documented relationship that remains understandable during everyday work, an incident, or a transition.
Start with an account-ownership register
List your domain registrar, business email tenant, backup service, password manager, website hosting, and critical applications. Record the company owner, billing contact, administrator, and recovery method for each.
Then distinguish business-owned accounts from provider-owned service platforms. Your IT company may use its own management tools while administering accounts that belong to your business.
Ask which products can transfer and which need replacement when the agreement ends. Do not assume every license or portal works the same way.
Define how administrator access works
Ask the provider to describe the privileged access it needs and how it protects that access. Include individual administrator identities, multifactor authentication, and removal of access when staff responsibilities change.
Also clarify whether access is ongoing or granted for a specific task. Where practical, the permissions should match the work instead of giving every support person broad control indefinitely.
However, do not request a shared master password as a substitute for governance. Have your IT provider design appropriate company recovery access and explain how authorized people will use it.
Plan recovery access before an emergency
Name the company representatives who can authorize account recovery or emergency changes. Then test whether they can locate the instructions without relying on the unavailable employee or provider.
Keep recovery information in approved storage with suitable access controls. A business password manager such as 1Password can support password-first security, but the recovery process still needs an owner and documented steps.
Next, consider how a lost phone, unavailable email account, or personnel change affects the process. Record a review date so recovery contacts do not quietly become outdated.
Write a shared-responsibility matrix
A responsibility matrix turns broad service language into assigned work. Use separate fields for who performs the task, who approves decisions, and who receives evidence.
| Task | Questions to resolve |
|---|---|
| Employee departures | Who notifies IT, removes access, and confirms completion? |
| Backup recovery | Who monitors jobs, tests restores, and approves recovery? |
| Security alerts | Who investigates, escalates, and authorizes extra work? |
| Software renewals | Who checks need, approves cost, and updates billing? |
| Major changes | Who assesses impact, approves downtime, and verifies results? |
Copy the table into your own document and fill it with named roles. “The provider handles security” is too broad to explain every decision.
Clarify incident responsibilities and communications
Ask what happens when either your business or the provider suspects a compromise. Identify the reporting channel, escalation contact, available assistance, and any separately billed response services.
Then establish who can authorize containment actions that interrupt work. Some decisions may need urgent action, so discuss those circumstances before an incident.
Also decide how you will communicate if normal email is unavailable. Keep a verified alternative contact method and document how staff confirm urgent instructions.
Ask about subcontractors and outside access
If another organization helps deliver support, ask which work it performs and what information or permissions it receives. Confirm how the provider oversees that relationship.
Likewise, identify access used by application vendors, website contractors, and other third parties. Your managed IT provider may not control every outside account unless the agreement assigns that work.
A useful review should expose those boundaries. Then your business can decide who coordinates them and how access changes reach the right people.
Define useful documentation and reporting
Request the business documentation you need: asset lists, service contacts, configuration summaries, recovery instructions, and unresolved issues. Specify an appropriate delivery method and update routine.
However, distinguish your operational records from the provider’s internal systems and confidential information about other clients. Agree on the documentation deliverables rather than assuming unrestricted access to every support tool.
For reports, ask what decisions they support. An owner should be able to identify a significant gap, its responsible person, and the next action without interpreting pages of unexplained alerts.
Build an exit plan while the relationship is healthy
Check notice periods, renewal rules, final billing, and transition assistance. Then list the accounts, records, licenses, and tools that need handover, removal, or replacement.
For a fictional eight-device office, the transition could involve company email administration, domain access, backup continuity, and replacement of the outgoing provider’s management agent. Coordinate timing so removing one tool does not leave a protection gap.
Next, verify that the incoming responsible person can perform essential tasks. Confirm exports open, recovery instructions work, and required permissions exist before ending old access.
Finally, document the removal of unnecessary provider accounts and connections. Resolve record retention and secure disposal questions through the applicable agreement and business requirements.
Free resources for your agreement review
CISA’s Risk Considerations for Managed Service Provider Customers offers a free reference for evaluating outsourced IT relationships. Select the considerations relevant to your size and services.
The NIST Small Business Quick-Start Guide provides broader planning context. Pair these resources with your account register and responsibility matrix.
Our Managed IT services page explains STS service context. For related operational guidance, browse the STS resource library.
Frequently asked questions
Establish appropriate business recovery and governance access with your provider. The design should support company control without encouraging routine use of highly privileged accounts.
Not necessarily. Licensing, account structures, and provider tools differ. Document what transfers, what needs replacement, and who pays for transition work.
No. It identifies operational questions. Have an appropriate adviser review legal terms when needed, especially where the agreement affects significant obligations or sensitive information.
Make ownership and responsibilities clear
Contact SofTouch Systems for an IT evaluation. Bring your current support agreement and account questions so we can discuss practical next steps for your small Texas business.
Discover more from SofTouch Systems
Subscribe to get the latest posts sent to your email.