Key takeaway
A list of services is not enough: document the owner, covered systems, escalation path and reporting measure for each task.
Turn “managed IT” into specific responsibilities
A managed IT provider may handle user requests, monitor devices and networks, administer accounts, schedule updates and assist with backups. Does the service stop at a help desk, or include servers, cloud accounts and security incidents? For each system and task, document the provider’s work, the organization’s retained responsibility and any exclusions.
User support
Define request types, priorities, service hours and escalation.
Infrastructure
List devices, networks, servers, cloud resources and backups.
Security
Check whether monitoring, vulnerability follow-up and incident response are in scope.
Agree on ownership, access and service measures
A responsibility matrix can state that the provider accepts requests, performs initial analysis and takes agreed actions, while the customer makes decisions, approves changes, shares knowledge of critical systems and names people available for escalation. Provider accounts should be individual and least-privileged, with access and changes recorded. If the contract sets target times, define the triggering event, covered hours, exclusions and reporting period. A general “24/7” label does not define a response or resolution commitment.
Review the service through outcomes and risks
At a monthly or quarterly review, examine recurring faults, missed escalations, planned updates, backup restoration exercises and access reviews alongside ticket counts. Choose measures for the environment and agreement; no single metric proves quality or security. Escalate exceptions and remaining risks to accountable managers, assigning an owner and due date to each follow-up action.