Managed IT usually bundles helpdesk support, monitoring, patching, and backups into one flat fee. Hardware, big projects, and some after-hours work often cost extra — here's what's typically included, what isn't, and how to check your contract.
Most managed IT sales conversations sound the same: unlimited support, proactive monitoring, one flat monthly fee, complete peace of mind. Then a server migration project shows up as a separate invoice eighteen months later, and the business owner is genuinely confused about why “managed” didn’t cover it.
That gap — between what people assume is bundled in and what’s actually named in the contract — is where most managed IT relationships go sideways. Usually it’s not dishonesty. It’s that “managed IT” isn’t a standardized product with a regulated definition: two providers can both call themselves fully managed and differ by tens of thousands of dollars a year in what that actually covers. ACT360 builds every managed IT engagement around removing that ambiguity from day one — you can see how the full program is structured on our managed IT services page.
This is the plain-English version of what’s actually inside a managed IT contract: what’s genuinely bundled into a typical flat fee, what almost always costs extra even at reputable providers, what’s never included no matter who you sign with, and how to read your own SLA so you’re not finding out the hard way.
What Does “Managed” Actually Mean in Managed IT?
Managed IT is a flat-fee or per-user arrangement where an outside provider takes ongoing responsibility for monitoring, maintaining, and supporting a defined set of technology systems — instead of break-fix support, where you call someone and pay only when something breaks. “Managed” describes a billing and responsibility model, not a fixed list of services. What’s actually inside that model is defined entirely by the contract and statement of work you sign, which is exactly why two “managed IT” agreements can look identical on a sales page and behave completely differently in practice.
In broad strokes, managed IT typically spans four areas: user and device support, network and infrastructure oversight, a cybersecurity baseline, and data backup. We’ve broken down each of those categories in detail in our explainer on the scope of IT managed services — this article does something different. It walks through what should actually be named in your contract, line by line, so you can tell the difference between what you’re paying for and what you assume you’re paying for.
What’s Actually Included in the Flat Monthly Fee?
Set aside the marketing language for a second. Across most reputable managed IT contracts — and confirmed by CompTIA’s own buying guide for managed services — the base fee reliably covers a consistent set of line items:
- Helpdesk and remote support for named users and devices
- Network and server monitoring, with alerting before something fails
- Patch management and routine software updates
- A baseline of endpoint security (antivirus/EDR, firewall management)
- Scheduled, automated data backups
- Vendor management for core platforms like Microsoft 365
- Quarterly business reviews or vCIO check-ins, at many providers
Here’s what that looks like in practice for a 40-person engineering firm: helpdesk tickets get answered same-day without an email chain, patches roll out overnight instead of interrupting a Tuesday afternoon, and a phishing attempt gets flagged and contained before it reaches payroll processing. None of that shows up as a separate line item — it’s what the flat fee is actually buying, even though it’s invisible until the day it matters.
That quarterly review is worth a specific mention. CompTIA’s research on the managed services market found that structured quarterly business reviews are close to standard operating procedure among established providers, not a premium add-on. We cover what that actually looks like — and how it differs from a generic account check-in — in our breakdown of what a vCIO does.
What Almost Always Costs Extra, Even With a “Comprehensive” Plan?
This is the part most sales conversations skip. Here’s how these line items typically split between “in the flat fee” and “billed separately,” based on standard managed services contract structures:
| Contract Line Item | Usually in Base Fee | Usually Billed Separately |
|---|---|---|
| Helpdesk & remote support | Yes | — |
| Network & server monitoring | Yes | — |
| Patch management | Yes | — |
| Endpoint security baseline | Yes | Advanced SOC / 24-7 threat hunting |
| Scheduled backups | Yes | Extended retention, DR testing |
| Vendor / license management | Yes | — |
| Quarterly reviews / vCIO | Often | Standalone strategic engagements |
| Hardware (servers, laptops, switches) | No | Always a separate purchase or lease |
| New employee / location onboarding | Partial | Setup labour often hourly |
| Major projects (migrations, moves) | No | Scoped and quoted separately |
| After-hours emergency response | Usually | Scheduled after-hours project work |
| Compliance audits / documentation | No | Specialist engagement, billed separately |
None of this means a provider is padding your invoice. Most of these are genuinely outside what a flat fee can reasonably absorb — a full server migration project has a different cost structure than a helpdesk ticket. A 45-person manufacturer opening a second location, for example, will usually find that new-site network setup, additional switches, and on-site cabling get quoted as a project, not absorbed into the existing per-user fee, even with the same provider they’ve used for years. We’ve written more specifically about how these add-ons get priced in our managed IT cost breakdown for Barrie businesses; the principle holds regardless of which provider you use.
What’s Never Included, No Matter Who You Sign With?
Some things don’t transfer to your provider no matter how comprehensive the contract is. Canada’s Centre for Cyber Security is explicit about this in its guidance for organizations consuming managed services: your organization remains the data owner and carries the ultimate legal responsibility for protecting that data, even when a provider is doing the day-to-day work. Three things specifically stay with you:
- Legal ownership of your data — a provider manages it, they don’t own it
- Regulatory and compliance accountability — a breach notification obligation lands on you, not your MSP
- The business decision of what to prioritize — a provider can recommend; only you can decide what risk is acceptable for your business
That’s not a technicality. It’s the reason the Cyber Centre recommends organizations contractually retain the right to recover their own systems and data, and confirm in writing what happens to that data if the relationship ends — before signing, not after a dispute starts. (Source: Canadian Centre for Cyber Security, ITSM.50.030.)
How Do You Read an SLA So the Numbers Actually Mean Something?
Two clocks matter in a service level agreement, and providers routinely quote only the more flattering one. Response time is how long it takes someone to acknowledge your ticket. Resolution time is how long it takes to actually fix the problem and close it. A “1-hour response” commitment, on its own, tells you almost nothing about how long you’ll actually be without a working system.
Vendor documentation on IT service management shows how these commitments are typically tiered by severity:
| Priority Level | Typical Response Target |
|---|---|
| Critical (outage, all users down) | 15–30 minutes |
| High (major function down, several users) | 1–2 hours |
| Medium (single-user issue) | Same business day |
| Low (minor request, no urgency) | 1 business day |
Ask your provider for both numbers — response and resolution — broken out by severity level, in writing, not the number quoted in the sales conversation. If your current agreement only lists one blended response time for every kind of issue, that’s worth flagging.
5 Things to Check in Your Contract Before You Renew
- Are services named specifically, not just grouped into vague categories?
- Are response and resolution times broken out by severity, in writing?
- Does the contract state who owns your data and what happens to it if you leave?
- Is hardware refresh explicitly in scope or out of scope?
- Is there a defined process — and cost — for onboarding a new employee or location?
If you can’t answer two or more of these from memory, that’s not necessarily a red flag on your provider. It’s a sign the contract was never walked through in plain language in the first place.
Signs You’re Only Getting “Managed IT” on Paper
A few patterns tend to show up when a business is paying for managed IT but actually getting break-fix support with a subscription wrapper around it:
- You only hear from your provider when something is already broken, never before
- Nobody can tell you the last time your backups were actually tested, not just scheduled
- Every “quick call” or after-hours request comes with a surprise line-item charge
- You’ve never had a business review — just tickets closed and invoices sent
- Your provider can’t tell you how many devices they’re monitoring without looking it up
- Security patches happen “whenever,” not on a defined schedule
If two or three of these sound familiar, the contract might say managed IT, but the delivery is closer to reactive support. That’s not necessarily a scam — it’s often just a provider that scaled past its process. Either way, it’s worth a direct conversation before renewal.
What This Looks Like at ACT360
At ACT360, every managed IT engagement runs on ACTION — our named process for making sure what we deliver actually matches what a business needs, rather than a generic checklist applied the same way to every client.
That starts before a contract is signed. We assess what’s actually happening in a business — not a device count — and build the plan from there. It’s also why every ACT360 client gets a named contact instead of a rotating helpdesk queue, quarterly business reviews led by a vCIO that cover business outcomes rather than just ticket counts, and a 90-day exit clause on managed IT contracts, because a provider confident in what they deliver shouldn’t need to lock a client in to keep them.
“The goal isn’t more tools. It’s making sure what you already have is actually structured to support where you’re headed.”
— Jeffrey Bowles, Partner & Director of IT Services, ACT360
The Bottom Line
None of this is really about finding the “best” managed IT provider — there isn’t a universal one. It’s about knowing what you already agreed to, so you can tell the difference between a genuine gap in your coverage and a gap in your own expectations. Fix that structure first. The tools and the automation are easy after that part is actually clear.
If you’re not sure whether your current agreement has any of the gaps this article just walked through, an IT Readiness Assessment is built to catch exactly that — before it becomes a problem, not after.
T: 705-739-2281 E: [email protected]
