Managed Services Agreement

A Managed Services Agreement in the United States defines the scope of work, fees and deliverables governing the provider's services to the client.

The Managed Services Agreement is governed by general US contract law — the Restatement (Second) of Contracts and Article 2A of the Uniform Commercial Code (UCC) where applicable to software and service elements — and by the specific federal and state regulatory frameworks applicable to the data the MSP accesses on behalf of its clients. Because MSPs typically have broad access to client systems, networks, and sensitive data, compliance with data privacy and security law is a defining legal feature of the MSA.

For healthcare organization clients, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 C.F.R. Parts 160 and 164, requires that any business associate — including an MSP that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity — execute a HIPAA Business Associate Agreement (BAA) meeting the requirements of 45 C.F.R. § 164.504(e). The BAA is typically incorporated into or attached to the Managed Services Agreement. An MSP that accesses PHI without an executed BAA exposes both itself and its healthcare client to HIPAA civil money penalties under 42 U.S.C. § 1320d-5, which range from $100 to $50,000 per violation (up to $1.9 million per violation category per year).

For clients subject to the Payment Card Industry Data Security Standard (PCI-DSS) — merchants and service providers that store, process, or transmit cardholder data — the MSP must comply with PCI-DSS requirements applicable to service providers under the PCI Security Standards Council's requirements, and the MSA should incorporate the client's and MSP's respective PCI-DSS responsibilities.

The California Consumer Privacy Act (CCPA), Cal. Civ. Code §§ 1798.100–1798.199.100, as amended by the California Privacy Rights Act (CPRA), and other state privacy laws including the Virginia Consumer Data Protection Act (VCDPA), Va. Code Ann. §§ 59.1-571 et seq., the Colorado Privacy Act (CoPA), C.R.S. § 6-1-1301 et seq., and the Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code §§ 541.001 et seq., impose obligations on MSPs acting as 'service providers,' 'processors,' or 'contractors' when processing personal data on behalf of their clients. The Managed Services Agreement must include a Data Processing Agreement (DPA) or data processing addendum specifying the nature and purpose of processing, the data subject categories, and the security measures the MSP will implement.

A US Managed Services Agreement is needed whenever a business, nonprofit organization, healthcare system, financial institution, or government agency engages a managed service provider (MSP) to assume ongoing, proactive management of IT infrastructure, cybersecurity, cloud services, network operations, or other critical operational functions rather than handling those functions with in-house staff.

Small and medium-sized businesses (SMBs) — defined by the Small Business Administration (SBA) as companies with fewer than 500 employees — are the primary market for managed IT services in the United States. According to industry research by CompTIA and Gartner, the US managed services market exceeds $100 billion annually, driven by SMBs that lack the internal resources to hire full IT departments. Law firms, dental and medical practices, accounting firms, real estate brokerages, and retail businesses use Managed Services Agreements with regional MSPs to outsource their IT helpdesk, endpoint management, Microsoft 365 administration, backup and disaster recovery, and cybersecurity functions.

Healthcare organizations — hospitals, physician groups, health systems, dental service organizations (DSOs), and behavioral health providers — use Managed Services Agreements with healthcare IT MSPs such as Netsmart Technologies, Azalea Health, and regional managed security service providers (MSSPs) to manage their electronic health record (EHR) systems, medical device networks, HIPAA-compliant data backup, and cybersecurity monitoring. Every such agreement must include a HIPAA Business Associate Agreement (BAA) as required by 45 C.F.R. § 164.504(e).

Financial services firms — registered investment advisers, broker-dealers registered with FINRA, insurance companies, and community banks — use Managed Services Agreements to outsource IT functions while maintaining compliance with SEC Regulation S-P (17 C.F.R. § 248.30), which requires financial institutions to implement safeguards to protect customer records and information, and the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (16 C.F.R. Part 314), which imposes specific cybersecurity program requirements.

Government contractors and federal agencies use Managed Services Agreements that incorporate compliance with the Federal Acquisition Regulation (FAR), DFARS cybersecurity clauses (252.204-7012), NIST SP 800-171 Controlled Unclassified Information (CUI) protection requirements, and FedRAMP cloud authorization requirements for cloud service providers.

Managed Security Service Providers (MSSPs) — companies that provide 24/7 Security Operations Center (SOC) monitoring, SIEM (Security Information and Event Management) services, endpoint detection and response (EDR), and threat intelligence — use specialized Managed Security Services Agreements that define incident response obligations, SLA response times for security events, and the MSP's notification obligations under state data breach notification laws such as California Civil Code § 1798.29, New York General Business Law § 899-aa, and the requirements of all 50 state breach notification statutes.

A legally effective US Managed Services Agreement must contain the following essential provisions to define the service scope, establish performance standards, allocate security and data processing responsibilities, and provide enforceable remedies for service failures.

The service scope definition — often documented in a Service Schedule or Exhibit A attached to the MSA — must precisely identify all systems, devices, users, and service categories covered by the agreement. The scope should list: covered devices (servers, workstations, laptops, network switches, firewalls, storage systems) by type and quantity; covered software platforms (Microsoft 365 tenants, Google Workspace, specific line-of-business applications); covered service categories (helpdesk support, patch management, backup monitoring, network monitoring, cybersecurity); business locations covered; and any systems or services expressly excluded from managed services scope. Ambiguity in scope is the most common source of MSP-client disputes, and a detailed scope schedule prevents arguments about whether a particular service or system is included in the monthly fee.

The Service Level Agreement (SLA) must specify measurable performance standards including: response time commitments by incident severity level (P1 critical — 15-minute response; P2 high — 2-hour response; P3 medium — 4-hour response; P4 low — next business day response); resolution time targets for each severity level; uptime guarantees for managed servers and infrastructure; monitoring frequency; and monthly reporting requirements. The SLA must define what constitutes a service credit when SLA targets are missed, the maximum credit per month, and the exclusions from SLA measurement (third-party outages, client-caused incidents, scheduled maintenance windows, and force majeure events).

The data security and privacy clause must specify: the MSP's obligation to implement and maintain information security controls appropriate to the sensitivity of the client's data; the minimum security standards the MSP must meet (SOC 2 Type II compliance, ISO 27001 certification, or equivalent); access control requirements (role-based access, multi-factor authentication, privileged access management); the prohibition on the MSP using client data for any purpose other than delivering contracted services; the MSP's data breach notification obligation — including the timeframe (24 to 72 hours after discovery of a confirmed breach is standard) and the information to be included in the notification; and the MSP's cooperation obligations in the event of a regulatory investigation or data breach response.

The HIPAA Business Associate Agreement (BAA) addendum must be incorporated or attached for any client that qualifies as a HIPAA covered entity or business associate. The BAA must satisfy the requirements of 45 C.F.R. § 164.504(e), including provisions on the MSP's permitted uses and disclosures of PHI, the MSP's obligation to implement HIPAA Security Rule safeguards, the MSP's obligation to report breaches of unsecured PHI under 45 C.F.R. § 164.410, and the obligations upon termination of the BAA.

The fee structure and billing clause must specify: the monthly managed services fee; the billing cycle and payment due date; the procedure for adding or removing covered devices or users and the resulting fee adjustment; the separate hourly rate or project fee structure for out-of-scope work; annual escalation terms; and the consequences of late payment including interest and suspension of services.

The limitation of liability clause must address the MSP's aggregate liability cap (typically limited to 3 to 12 months of fees paid), the mutual exclusion of consequential and indirect damages, and the carve-outs from the cap for gross negligence, willful misconduct, breaches of data security obligations, and HIPAA BAA violations. The MSP's required insurance coverage — commercial general liability, professional liability/errors and omissions, cyber liability, and workers' compensation — should be specified as a condition of the agreement, with minimum coverage amounts.

The termination and transition clause must specify each party's termination rights (for cause after cure period, for convenience on 30 to 90 days' notice), the MSP's transition assistance obligations upon termination (continuing services through the transition, providing documentation and credentials to the incoming provider), and whether any early termination fee applies for convenience terminations within an initial contract term.