What should organisations look for when procuring managed IT services?

Organisations procuring managed IT services should look for a provider with proven delivery in comparable environments, measurable service levels backed by meaningful remedies, transparent pricing, tested security and continuity arrangements, and a contract that makes exit realistic. The strongest decisions come from treating this as IT outsourcing procurement rather than a technology purchase: the commercial terms determine whether the service delivers value in year three, not just at go-live.

The right choice also depends on who owns the problem, whether that is cost pressure, capability gaps or supplier underperformance. The sections below cover the criteria, SLA content, pricing models, risk testing, contract structure and procurement approach that experienced IT procurement consultancy teams apply.

Which criteria separate strong managed IT providers from weak ones?

Strong managed IT providers can evidence comparable delivery, show how they retain and develop skilled staff, report openly on performance and accept accountability when things go wrong. Weak providers rely on generic credentials, vague service descriptions and references that do not match your size, sector or technical environment.

When evaluating bidders, test the following areas:

• Relevant experience: Ask for references from organisations with similar scale, regulatory demands and legacy complexity, then speak to them directly.
• Service delivery model: Establish who actually delivers the service, where they are based, how much is subcontracted and how escalation works.
• Security and compliance credentials: Look for evidence of independently audited controls, such as ISO 27001 certification or Cyber Essentials Plus, and ask how they handle data protection obligations under UK GDPR.
• Staff continuity: High turnover on a managed service means your knowledge walks out of the door. Ask about attrition and succession planning for key roles.
• Cultural and commercial fit: A provider that treats the contract as a partnership will raise problems early. One that treats it as a ticket queue will not.

Be cautious of providers that score highly on presentation but cannot show their reporting. Sample service reports from existing customers reveal far more than a polished pitch.

What should a managed IT services SLA include?

A managed IT services SLA should define each service, its measurable targets, how performance is calculated and reported, and what happens when targets are missed. Without clear definitions, service credits and remedies, an SLA records intentions rather than creating enforceable commitments.

Core elements to include:

• Service scope: What is in and out of scope, including supported systems, locations and user groups.
• Priority definitions: Clear incident severity levels with response and resolution times for each.
• Availability targets: Uptime commitments for critical systems, with agreed maintenance windows excluded transparently.
• Measurement methodology: How and where performance is measured, and who holds the data.
• Service credits and remedies: Financial consequences for failure, plus persistent failure triggers that allow escalation or termination.
• Continuous improvement: Obligations to reduce repeat incidents and improve performance over the contract term.

Choose a small number of metrics that reflect outcomes users actually experience. A dashboard of forty green indicators can sit alongside a poor service. Reviewing these obligations as part of ongoing supplier relationship management keeps them meaningful after signature.

How do managed IT services pricing models compare?

The main managed IT pricing models are fixed price, per user or per device, consumption based and time and materials. Fixed and per unit models give the most budget certainty, consumption models offer flexibility but variable costs, and time and materials carries the highest risk of overspend.

• Fixed price: Predictable and easy to budget, but rigid. Check how changes in scope or volume are priced, as variation charges can erode the apparent saving.
• Per user or per device: Scales with headcount and estate size. Ensure there are sensible bands and the ability to reduce volumes as well as increase them.
• Consumption based: Suits variable demand, particularly cloud services, but needs strong usage monitoring to prevent drift.
• Time and materials: Appropriate for defined projects, rarely for steady state operations, unless rate caps and approval controls are in place.

Compare bids on total cost of ownership over the full term, including transition charges, onboarding, change requests, exit costs and indexation. Pricing that looks competitive in year one can become expensive if annual uplifts are uncapped. Independent procurement benchmarking helps confirm whether rates and unit costs are in line with the market.

What risks should be tested before signing a contract?

Before signing, test security, service continuity, dependency on key individuals, subcontractor reliance, transition delivery and financial stability. These risks rarely surface in standard tender responses, so they need to be probed through scenario questions, due diligence and evidence requests.

Practical ways to test them:

• Security incident scenarios: Ask bidders to walk through how they would detect, contain and report a breach, including notification timings.
• Business continuity evidence: Request recent test results for disaster recovery, not just policy documents.
• Transition plan scrutiny: Transition is where many outsourced IT arrangements struggle. Look for named transition leads, realistic timelines and clear knowledge transfer arrangements.
• Financial health: Review accounts and consider parent company guarantees where the provider is a subsidiary.
• Concentration risk: Understand any reliance on a single technology vendor or a small number of key engineers.

For critical services, such as those supporting clinical or safety-related operations, a failed transition carries consequences far beyond cost. Planning for those scenarios up front is part of good IT procurement consulting.

How should contract terms and exit plans be structured?

Contract terms should align the term length with the investment required, include clear change control, and make exit practical through documented exit plans, data return obligations and fair transfer arrangements. An exit plan agreed at the start is far easier to enforce than one negotiated during a dispute.

Key provisions to secure:

• Term and extensions: Avoid long, inflexible terms unless matched by commercial protections. Build in break clauses and review points.
• Exit plan: Require a maintained exit plan, updated annually, covering knowledge transfer, documentation and cooperation with an incoming supplier.
• Data and asset ownership: Confirm that your data, configurations and documentation are returned in usable formats, at no unreasonable cost.
• Intellectual property and licences: Clarify who owns bespoke tools and how third-party licences transfer.
• Governance: Specify regular service reviews, escalation routes and benchmarking or market testing rights.

Negotiating these terms is much easier before award than after. Existing arrangements can also be improved through structured contract negotiation, particularly around renewal points.

What procurement process works best for managed IT services?

The best process starts with a clear requirements baseline, engages the market early, evaluates on quality and whole-life cost together, and uses clarification and negotiation where the rules permit. Running a structured, compliant competition protects value and reduces the risk of selecting on price alone.

A sound approach typically follows these stages:

1. Define requirements: Document current services, volumes, pain points and desired outcomes before approaching the market.
2. Market engagement: Test what is achievable and refine the specification with provider input.
3. Select the route to market: Public sector organisations must follow the applicable procurement regime, so confirm whether the Procurement Act 2023 or the Public Contracts Regulations 2015 apply to your procurement, and consider the Procurement Act readiness implications for your processes.
4. Evaluate on outcomes: Weight quality, delivery approach, risk and whole-life cost, and moderate scoring consistently.
5. Negotiate and prepare for transition: Resolve SLA, pricing and exit terms before award, and agree a governance model for the first twelve months.

Many organisations lack the internal capacity or specialist experience to run this process alongside day-to-day responsibilities, which is where independent support adds value.

How can eXceeding help?

eXceeding is independent of any supplier, system or framework, so our advice on managed IT services is always in your interest. We support organisations through requirements definition, tender design, evaluation, contract negotiation and supplier transition, and we have experience of managing complex IT exit and transition arrangements in high-stakes environments.

If you are planning a managed IT services procurement or reviewing an existing arrangement, get in touch with our team to discuss how we can help.

Related Articles

• How do you write a compliant public sector procurement specification?
• What is the difference between value for money and lowest price in procurement?
• What governance model works best for outsourced procurement?
• How do you build a business case for procurement outsourcing?
• What KPIs should you track in a procurement outsourcing contract?