When a company decides to outsource the management of its information system, it generally enters into an IT outsourcing contract with a service provider often confused with a managed services provider (or “MSP”).
This type of contract is essential to ensure that the provider meets the company's needs and delivers quality services. In this article, we will start with a few reminders and definitions concerning IT outsourcing, before listing the essential points to consider when concluding an IT outsourcing contract.
What is IT outsourcing?
Definition of IT outsourcing
IT outsourcing is a practice that consists of entrusting a third party with the management, operation, optimisation and security of all or part of an organisation's information system.
Different types of IT outsourcing
As we saw above, this outsourcing can take several forms and have a scope that is more or less broad. There are, in particular, IT outsourcing arrangements
- relating to infrastructure, which enable the management of IT hardware
- relating to the supply and/or management of applications, the purpose of which is to manage software and software packages purchased or leased by the client (ERP, CRM, etc.)
- which are global and cover the entire information system
This outsourcing – whether global or partial – of such a strategic resource for an organisation requires a contract to be put in place
Differences between IT outsourcing and managed services
Although the two terms are often confused, there are some differences between the practice of IT outsourcing and that of managed services.
Without going into too much detail (we will dedicate a full article to this subject), there is a fundamental difference in terms of objectives. In general, IT outsourcing – as its name suggests – has as its main purpose the management of all or part of an organisation's information system, which implies a reactive approach (problem→solution) and a delegation of management. Differently, the managed services provider acts in support of an IT department, more in a co-management mode, and with a mission that is often further upstream and more proactive on optimising and improving the information system.
Finally, according to AFNOR, managed services are a category within the IT outsourcing family.
The main points to watch in an IT outsourcing contract
Scope: what the contract covers, or does not cover
The IT outsourcing contract must clearly define the scope of the services to be provided. This includes the IT services to be managed, the required service level and the expected performance levels. The scope of the contract must also specify the responsibilities of each party, including the service provider's obligations regarding maintenance and updating of the IT infrastructure.
Performance: SLAs (Service Level Agreements)
The IT outsourcing contract must include service levels (the well-known SLAs) that define the expected levels of service.
Beyond a simple definition of service levels, the contract must also provide for other performance indicators, such as response times to support requests, the availability of IT services, or the expected uptime of the IT infrastructure.
Finally, the penalties applicable in the event of failure to meet these service levels must also be set out, both in terms of quantum (rate/basis/cap) and the terms of application and/or exemption.
Costs: price, payment terms and scalability
The contract must, of course, clearly set out the costs of the IT outsourcing services and the payment terms.
This includes fees for the services provided, any additional cost for hardware or software, and any penalty for non-payment. Specific provisions may be included to give the provider an interest in the savings achieved with the client's vendors and other publishers/suppliers.
Finally, the payment terms must specify the payment schedule, including the frequency of payments, the compensation for late payment, as well as any arrangements for offsetting penalties inherent to the SLAs against payments owed to the service provider.
Security: measures and protection of personal data
Putting in place a non-disclosure agreement (NDA) is not sufficient to ensure the security and confidentiality of the services performed by a service provider. In terms of IT outsourcing, it is now essential that the IT outsourcing contract includes provisions relating to security and data protection.
In this respect, it is important to ensure: (i) the implementation of adequate processes, (ii) the existence of documentation relating to measures and processes in this area, and finally (iii) the existence of regular training and awareness sessions for staff.
These measures, documentation and best practices regarding protection against unauthorised access, intrusions, breaches or loss of data, backup procedures, data recovery arrangements, and, more generally, security incident management, are now must-haves imposed by major private and public clients alike.
Management: reporting and resolving difficulties
Management is an essential topic, yet one that is often neglected in hosting contracts (or with MSPs, Managed Services Providers).
Nevertheless, this is an essential theme to ensure the monitoring of a contract's performance, the anticipation of difficulties, risks and changes, but also the arrangements for handling (and, where necessary, escalating) difficulties encountered during the life of the contract.
In short, in order to avoid having to invoke liability or termination clauses, make sure to spend the necessary time contracting for performance management topics in your contracts. In practice, this could range from reporting scheduled during quarterly reviews (QBR – Quarterly Business Review), which will help identify actions carried out, response times, or underused services.
Term, termination and renewal
The IT outsourcing contract must include provisions relating to the term of the engagement, as well as the terms of termination or renewal.
The circumstances and terms under which the contract may be terminated (with or without fault on the part of the provider), the notice period required for termination, and any penalties in the event of early termination, must be set out, along with the consequences in terms of reversibility and support for the transition to a new provider or the reinternalisation of the function.
The contract must also specify the renewal conditions, including any changes to the scope of services or payment terms.
Liability
Last but not least: let's talk about liability! Who is responsible for what if something goes wrong?
Generally, when this clause is revisited after the contract has been concluded, it is because the relationship between the parties has started to become strained: all the more reason to spend time on it at the contract set-up stage!
Here we are mainly referring to the clause dealing with the liability of both parties in the event of damage, loss or claims arising from the work of the service provider (or one of its subcontractors). It also defines the limits and exclusions of liability, as well as the indemnification obligations and procedures. Liability and indemnification clauses must be balanced, reasonable and compliant with applicable laws and regulations. You should negotiate liability and indemnification clauses with the supplier based on the nature and scope of the work, the potential risks and impacts, as well as insurance cover and policies.
Conclusion
Concluding an IT outsourcing contract is an unavoidable step for many companies, large and small. Ensuring a lasting and effective partnership between the client and the IT outsourcing service provider requires – at the very least – taking into account the essential points covered in this article.
However, it remains essential to bear in mind that concluding the contract is only one step (albeit an important one) in the contract lifecycle. Next comes execution and contract management & administration of the project, which is equally crucial.
For any assistance on this topic, please do not hesitate to contact Prime Conseil's contract management consulting team!
