Managed IT has become a catch-all phrase. Two providers can quote the same monthly figure per user and deliver wildly different things — one answers the phone, the other actually keeps the environment healthy. The difference only becomes visible during an incident, which is the worst possible time to discover it.
A credible agreement states what is monitored, how quickly someone responds at each severity level, who owns patching, and how backups are proven. If backups are listed but never restore-tested, they are an assumption rather than a control. We schedule test restores because an untested backup has failed silently more often than not.
Ask for the reporting too. A monthly report that shows ticket volume, recurring causes, patch compliance and restore results tells you whether problems are being fixed or merely absorbed. Without it, you are paying for activity instead of outcomes.
Finally, insist on an exit path. Asset registers, documentation and administrative credentials belong to you. A provider confident in its work has no reason to hold them hostage.