When a company asks what an IT maintenance contract includes, it’s almost always measuring the wrong thing: the list of faults they’ll get fixed. But a good contract isn’t judged by how many things it repairs, but by how many it stops from breaking. The scope —which systems it covers, what gets monitored, what gets documented— is what separates a service that keeps your business running from an emergency switchboard you only call once everything is already on fire.
We’re not going to go through clauses or fine print here. Let’s get to what really matters before you sign: which services are part of complete maintenance, how to tell a contract that prevents problems from one that just puts out fires, and what the cheapest fees leave out. If by the end you know exactly what your contract should cover, we’ll have done our job.
Maintenance isn’t “fix it when it breaks”: it’s prevention
The starting mistake is to see maintenance as breakdown insurance. With that mindset, the provider only shows up when something fails, charges for every call-out and —without realising it— makes money when your infrastructure is doing badly. It’s a perverse incentive: the more incidents, the bigger the bill. Real maintenance flips the approach. Its goal is for you to have no incidents, and that’s why it works before they happen.
Prevention takes the shape of specific, boring tasks nobody ever sees: keeping security patches up to date, checking the health of disks before they die, confirming that backups actually restore, watching a server’s temperature, renewing certificates before they expire. None of those tasks trigger an alert at nine on a Monday morning. That’s exactly why they work. Well-run maintenance is invisible: you notice it in the outages that never happen.
The difference pays for itself. A disk replaced on a scheduled Tuesday afternoon costs a fraction of what that same disk costs when it blows up in the middle of billing, with the office at a standstill and a technician running around. The right question to ask about a contract isn’t “how long do you take to come out when something fails?”, but “what do you do to make sure it doesn’t?”.
What a complete maintenance contract covers
Serious maintenance isn’t a single thing, it’s a set of services covering your entire infrastructure, from the sales rep’s laptop to the server running your ERP. If the proposal on your desk is missing any of these blocks, it isn’t a complete contract: it’s a cutback with a nice name. This is what should be inside:
- User support: day-to-day help by tiers —L1 for the everyday stuff (an email that won’t come through, a locked-out user, a printer), L2 for systems and network, L3 for anything touching critical infrastructure—, remotely and on-site when needed.
- Workstation management: onboarding and offboarding of users, devices, an up-to-date operating system, security patches applied and inventory control. The kit your people work with, up and running.
- Servers and systems: administration, updates, performance and capacity reviews, and preventive replacement of anything showing symptoms before it dies.
- Network and communications: firewall, WiFi, VPN, switches and connectivity monitored and maintained. When the network runs slow, it’s your business that runs slow.
- Managed security: antivirus/EDR, access control, application of critical updates and a defined incident response. Basic cybersecurity isn’t an extra, it’s part of the floor.
- Verified backups: making backups isn’t enough; you have to prove they restore. A backup with no tested restore is a useless file with a reassuring name.
- Monitoring: servers, network and critical services watched to spot the problem before the user does, ideally 24/7.
- Vendor management: having your IT partner talk to the ERP vendor, the telco or the cloud provider on your behalf, instead of passing the headache back to you. A single point of contact for everything technical.
Added together, these blocks are what it really means to outsource your IT department: not a breakdown hotline, but someone who takes responsibility for keeping all your technology running. If a single item is left out, that gap is one you’ll end up covering yourself, with your time or with one-off invoices.
Preventive, corrective and proactive: the difference that saves money
Three types of maintenance coexist inside a contract, and understanding how they differ tells you at a glance the quality of what you’re being offered. Corrective is the most obvious: something breaks and gets fixed. Essential, but it’s the reactive part; if your contract is only this, you’re paying for a fire brigade.
Preventive is the scheduled work that reduces breakdowns: patches, periodic reviews, cleaning, updates, planned replacements. It’s what keeps corrective work from spiralling. And proactive goes one step further: it uses monitoring and data to get ahead of problems that haven’t yet surfaced —a disk whose indicators are getting worse, a service eating more and more memory, an odd traffic pattern that smells like a security incident—.
Corrective maintenance shows up on the invoice. Preventive and proactive maintenance show up in the invoices that never arrive.
The balance between the three is the best indicator of whether you’re well looked after. If almost everything your provider does is corrective, the infrastructure is poorly cared for and it’s only a matter of time before the next breakdown is a big one. When the weight shifts towards the preventive and the proactive, incidents drop, and with them the real cost —that of having your team idle— that never shows up on any fee.
Contract models and what usually gets left out
The same scope can be contracted in several ways, and each one aligns the incentives differently. It’s worth knowing which suits you before you look at the price.
- Fixed fee (flat rate): you pay a monthly amount and everything in the scope is included. It’s the one that best aligns both parties: the provider wants you to have no incidents, because each one costs them. The recommended option as soon as servers are in the picture.
- Block of hours: you buy a package of hours and use them up. It works for one-off needs when someone in-house handles the day-to-day, but it has a well-known effect: because every call burns credit, people tend not to call and small problems are left to grow.
- Per device or per user: billed by the number of seats or managed devices. It’s predictable and scales well as you grow, as long as the scope per unit is clear.
Whatever the model, there are items that are almost never inside the fee and are worth being clear about up front: projects (a migration, a rollout of new devices, an infrastructure change is not maintenance and is quoted separately), licences and hardware (software and equipment are paid for, the fee covers managing them), and sometimes advanced cybersecurity or regulatory compliance, which go beyond the basic floor. There’s nothing wrong with these being left out: what’s wrong is not being told. An honest provider spells out the boundary before you sign, not on the first surprise invoice.
Managed maintenance with MagicBoxDesk: clear scope, no surprises
At MagicBoxDesk we do exactly what this article tells you to demand. We cover the entire scope of complete maintenance from a single team: L1·L2·L3 support remote and on-site with call-outs to your office, workstation management, servers, network, managed security, tested backups, continuous monitoring and management of your technology vendors. All with a scope set out in writing, so from day one you know what’s in and what’s out, and with the weight placed on the preventive and the proactive so incidents become the exception.
We outsource the IT department of SMEs and larger companies across Spain, with GDPR and ISO 27001 compliance built into how we work, not bolted on as a last-minute extra. The benefit isn’t only technical: it’s no longer having to worry about technology and getting your team’s time back for what really grows your business.
We take care of all of this so you can focus on your business. Get a no-obligation quote and we’ll tell you, straight and without the spin, what scope your company really needs —and what it doesn’t.
