The National Cyber Security Centre's supply chain guidance makes a recommendation that very few organisations act on: review existing supplier contracts at renewal, or sooner where the supplier is critical. For most businesses, the MSP is about as critical as a supplier gets — privileged access to systems, data and identity — and the contract governing that relationship was often last read properly the week it was signed.
When we scan MSP contracts, the same five structures come up again and again. None of them is exotic. All of them are quietly expensive.
1. Auto-renewal with a narrow exit window
Evergreen clauses that roll the contract for a further term unless notice is served within a specific window — sometimes 90 or 120 days before expiry — are standard in the sector. They are also the single most common way organisations lose a year of leverage. Miss the window and the renewal conversation you planned to have from a position of strength happens from a position of none. Diary the notice date the day the contract is signed; if it wasn't, find it today.
2. Service levels defined — and measured — by the provider
An SLA is only as good as its definitions and its measurement. Contracts that leave categorisation, priority and measurement methodology to the provider's discretion, with no customer audit rights over the underlying data, produce exactly the green-but-failing reporting covered elsewhere on this site. If you cannot independently verify the numbers, you do not have service levels. You have a newsletter.
3. Uncapped charging mechanisms
Per-user and per-device pricing that ratchets up automatically but never down. Annual increase clauses with no index cap. And the perennial one: a narrow definition of "in scope" that turns everything else into billable project work. The base fee is rarely where an MSP relationship becomes expensive — the accumulation of out-of-scope charges is. If the contract doesn't make the boundary crisp, the invoices will make it expensive.
4. Weak exit provisions
The clauses nobody reads until they matter most. What must the provider return, in what format, in what timeframe? Is there an obligation to provide offboarding assistance, and at what rate? Who owns the documentation, configurations and runbooks describing your own environment? Contracts silent on these questions convert an ordinary commercial decision — changing supplier — into a hostage negotiation. EU financial regulation now mandates documented, tested exit strategies for exactly this reason; the logic applies to any business, regulated or not.
5. No audit or access rights
The clause that determines whether any of the above can ever be checked. Without a contractual right to audit — billing accuracy, service data, security posture — every other protection in the document depends on the provider's goodwill.
The direction of regulation makes this sharper, not softer. The UK's Cyber Security and Resilience Bill brings managed service providers into statutory regulation for the first time — government analysis anticipates 900–1,100 providers in scope — with the Bill now before the House of Lords and Royal Assent expected late 2026. Regulated providers will face duties; their customers will increasingly be expected to hold contracts that evidence secure, resilient arrangements. A contract that predates all of this deserves a fresh read.
That fresh read is precisely what our red-flag report does: a short, confidential scan of your existing MSP contract that surfaces these structures before they surface themselves.