A managed IT agreement for an insurance agency should spell out 9 things in writing: what's covered, what isn't, response times, security standards on both sides, backup and restore testing, who owns your data and documentation, how client information is protected, insurance, and how either side can exit. If any of those live only in a sales conversation, they aren't part of your agreement.
For context on cost: fully managed IT from Tomorrow's Technology Today runs $175 to $350 per user per month. That's $1,750 to $3,500 a month for a 10-person agency, $4,375 to $8,750 for 25 people, and $8,750 to $17,500 for 50. Here's what an agreement at that price should actually say.
"Comprehensive IT support" is a red flag in a contract, not a description. The agreement, or the proposal attached to it, should list services by name. Ours include live phone support from 7am to 5pm on business days, 24/7 managed detection and response with a human-staffed Security Operations Center, security awareness training, Microsoft 365 backup, automated patching, technology planning reviews, and Great Start onboarding with a dedicated project manager. For the full price breakdown, see what managed IT costs for a 10 to 50 person agency.
Exclusions are where surprise invoices come from. Ours are spelled out: home and personal devices we didn't set up, software with a lapsed vendor maintenance agreement, damage from misuse, theft, fire, water, or power events, training classes, and writing your own procedures. Projects, such as replacing a server or moving files to the cloud, are quoted at a flat rate before work begins.
One agency-specific point: your agreement should say how your agency management system is supported. We work with your software vendors on your behalf, and we ask every agency to keep an active maintenance agreement with them, so there's always someone to escalate to.
A guaranteed response time only matters if it's written down for the service level you're paying for. Ours appears on the managed services proposal you accept: 120 minutes for critical issues on Gold, and 60 minutes on Platinum and Titanium, during business hours. If your CSRs can't quote or bind during renewal season, this is the clause to read twice.
A good agreement doesn't just describe what the provider does. It also states the minimum standards the agency agrees to keep. Ours lists them: multifactor authentication, supported operating systems, endpoint detection and response, email security, administrative account controls, and security awareness training. It also says what happens when an agency declines a recommended security control: the decision is documented, and the agency accepts that risk.
This matters at renewal. Those are the same controls your cyber insurance application asks about. See what it takes to qualify for or renew cyber insurance.
"We back you up" isn't enough. The agreement should say what's backed up, how long copies are kept, and whether restores are tested. A backup that completes isn't the same as a backup that restores. We run a full restore test of every backup every other week, with a screenshot of the restored system as proof. Make sure whatever your provider promises here is written into your agreement or order.
Your policyholder files are yours, and so is the map of your systems. Our agreement states that the agency owns its data and the documentation we create for its environment: network diagrams, configuration records, asset inventories, and credential records. If you ever leave, those come back to you.
Your agency holds driver's license numbers, dates of birth, and financial details for the people you insure. Ohio and Indiana both have insurance data security laws, and your IT agreement should support your obligations under them. Ours limits our use of your data to delivering services, requires subcontractors with access to follow terms at least as protective, and commits to notifying you within 72 hours of a confirmed security incident involving your data.
You sell coverage for a living, so you'll appreciate this one. The agreement should state what insurance the provider carries, and what it expects from you. We carry professional liability and cyber liability coverage of at least $2 million, and our agreement requires clients to carry at least $2 million in cyber liability coverage as well. If we're asking you to be protected, we hold ourselves to the same standard.
Before you sign with anyone, work through 21 questions every insurance agency should ask before choosing an IT provider.
Don Ritchey, President of Block Insurance Agency in Waynesfield and Wapakoneta, Ohio: "The single biggest benefit our company experienced is the ability to concentrate on selling and serving insurance rather than dealing with our technology and computer issues."
See how we support independent insurance agencies across Ohio and Indiana.
Want to read our agreement before you sign anything? Book a 10-minute discovery call. Call us at (419) 678-2083 or visit www.TomTechToday.com/discoverycall to schedule yours.