An annual maintenance contract is a promise about the future written by the party who benefits from it being vague. Most of the ones we read are not dishonest — they are simply unfalsifiable. "Prompt support," "best-effort resolution," "as required" — none of these can be breached, which means none of them can be relied on.
Here is what we look for, and what we put in our own.
1. Response time and resolution target are different numbers
"Four-hour response" usually means someone will acknowledge your ticket within four hours. It says nothing about when the printer works again. A contract worth signing states both, and states them per severity level.
A workable structure for a 30–80 seat office:
- P1 — business stopped (no internet, server down, no one can work): 1 hour response, 4 hour target
- P2 — a team blocked (one department, a shared printer, a line-of-business app): 4 hour response, next business day target
- P3 — an individual affected: next business day response, 3 business day target
The exact numbers matter less than the fact that they exist and that severity is defined by business impact, not by the vendor's convenience.
2. What happens when the target is missed
If there is no consequence, there is no target. This does not need to be a penalty clause — service credits, an escalation to a named person, or a documented root-cause note are all reasonable. What is not reasonable is silence.
3. Who is actually coming, and how often
"On-site engineer visits as required" means zero visits. A real schedule looks like: one scheduled preventive visit per month, plus unlimited incident-driven visits within the covered scope. Write down the number.
4. What is explicitly excluded
Every AMC has exclusions. The good ones list them: hardware cost, licence renewals, work caused by third-party changes, sites outside a radius, out-of-hours work. If the exclusions are missing from the document, they still exist — you will just meet them during an incident.
5. Backups: verified, not configured
This is the clause that separates a maintenance contract from a maintenance theatre. "Backups monitored" means somebody looks at a green tick. What you want is:
A test restore of at least one system per quarter, with the result recorded in the service report.
We have walked into more than one office where backups had been "running" for a year and no one had ever restored from them. The tape was fine. The data was not.
6. Documentation and credentials are yours
Network diagram, IP plan, asset register, firewall rules, admin credentials — all of it should be handed over and kept current. If leaving your provider requires reverse-engineering your own network, you do not have a maintenance contract; you have a hostage situation.
7. The exit clause
Notice period, handover obligations, format of the handover, and what happens to your data on their systems. Agree this at the start, when everyone is friendly. It is unpleasant to negotiate at the end, which is exactly when it is needed.
None of the above is exotic. It is what any competently written service contract contains — and it is missing from most of the ones we are asked to review. If you are about to sign one, read it against this list first. If your current provider will not agree to any of the seven, that is your answer.