You are reading Part 10 of our 12-part Non-Profit Authority Series.
A managed services agreement should cover the ongoing operation, support, monitoring, documentation, and protection of a technology environment, but it should not be assumed to include every future IT project or specialized risk service. For a 15-30 employee non-profit, common out-of-scope items may include major server or network projects, migrations, new locations, cameras, extensive onsite work, Business Continuity and Disaster Recovery, third-party penetration testing, and specialized compliance services. Clear boundaries help leadership budget accurately and avoid confusion about who is responsible for what.
The 5-Part Service Scope Framework
Non-profit leaders can evaluate an IT agreement using five categories:
- Recurring managed services
- Included support
- Project work
- Optional risk-management services
- Explicitly accepted risk
The goal is not to make the agreement complicated. It is to make responsibilities clear.
1. Understand What the Managed Agreement Is Designed to Cover
WTITC’s standard operating model is managed services, not traditional break-fix IT.
Every managed client engagement includes three layers:
- Security Package
- Managed Services Fee
- Tiered Technology Fee
The $40 per endpoint per month Managed Services Fee includes:
- Datto RMM monitoring and patching
- Proactive alerting and remediation
- IT Glue documentation
- Secure password management
- Unlimited Help Desk support
- Coordinated remote and onsite support when warranted
The Tiered Technology Fee supports the broader management infrastructure, including:
- 24/7 monitoring infrastructure
- Security operations
- Alert triage
- Monthly service audits
- Technology Alignment Manager oversight
- Tooling and automation
- Internal escalation
- Service management
- Dispatch
- Quality control
This means the monthly agreement is designed around the ongoing health of the environment.
It should not be interpreted as unlimited access to every possible IT service.
2. Separate Support From Project Work
A support issue and a project are not the same thing.
Examples of project work may include:
- Server replacement
- Network redesign
- Security upgrades
- Camera systems
- New office locations
- Major migrations
- Large infrastructure changes
- Exceptional or specialized work
WTITC uses $150 per hour as its professional services benchmark for project and out-of-scope work.
That benchmark helps place a value on technical expertise that may not be included in the recurring monthly agreement.
For leadership, the key question is:
Is this work necessary to operate and support the current environment, or is it a separate change to the environment?
The answer often determines whether the work belongs inside the agreement or should be scoped separately.
A realistic annual IT budget should distinguish recurring managed services from projects, equipment replacement, optional risk controls, and exceptional work.
That distinction makes forecasting more accurate and helps executive directors and finance committees understand where technology spending is going.
3. Understand How Onsite Support Is Handled
Onsite support should never be represented as free or unlimited.
WTITC’s approved service language is that onsite support is coordinated when warranted.
Some onsite hours may be included based on agreement size, but additional onsite needs may require separate professional services.
This matters because onsite work can vary significantly.
A technician visiting the office for a specific issue is different from:
- Replacing a server
- Rebuilding a network
- Deploying equipment across an office
- Installing cameras
- Supporting a major relocation
- Performing a large infrastructure upgrade
A clear agreement should distinguish those situations rather than creating an expectation that every onsite activity is automatically included.
4. Identify Optional Risk-Management Services
Several important services may be appropriate for an organization but are not automatically included in every managed agreement.
WTITC identifies three specific a la carte services:
- Business Continuity and Disaster Recovery
- Third-party penetration testing through Vonahi
- Compliance Manager
These services address different types of risk.
BCDR addresses recovery and operational continuity.
Third-party penetration testing evaluates security exposure from an independent testing perspective.
Compliance Manager can support organizations that need additional structure around compliance-related controls and documentation.
Backup and BCDR solve different problems, so leadership should understand whether ordinary data protection is sufficient or whether the organization needs a broader recovery capability.
If one of these services is recommended and declined, the associated operational, security, or compliance risk should be acknowledged.
That is an important governance practice.
5. Treat Declined Services as Risk Decisions
A service can be optional without being unimportant.
For example, a non-profit may decide not to purchase BCDR because:
- The environment is simple
- The organization can tolerate longer downtime
- The cost does not fit the current budget
- Leadership has accepted the recovery risk
That can be a legitimate business decision. The important point is that the decision should be conscious. The same logic applies to penetration testing or specialized compliance tooling.
Leadership should ask:
- What risk does this service address?
- What happens if we decline it?
- Is the risk acceptable?
- Who approved that decision?
- Should the decision be revisited next year?
This is more mature than assuming every service should either be included or ignored.
6. Compare Providers by Boundary Clarity
One of the strongest trust signals an IT provider can offer is a clear explanation of what it does not include.
A provider should be able to explain:
- What is covered monthly
- What requires a project
- How onsite work is handled
- Which services are optional
- What happens when a client declines a recommended control
- How professional services are priced
- Where provider responsibility ends
Organizations that expect every project, every onsite need, and every specialized risk service to be included without additional scope may not be a strong fit for a structured managed services model.
That does not make the organization wrong.
It means the buyer’s expectations and the provider’s business model may not align.
Clear fit language protects both parties.
Hypothetical Example: A 20-Employee Non-Profit Planning a New Location
Consider a hypothetical Midland non-profit with 20 employees and 23 managed endpoints.
The organization is opening a second office and assumes its monthly managed services agreement will include:
- New network design
- Equipment installation
- Cabling coordination
- Firewall deployment
- Workstation setup
- Onsite deployment labor
Some parts of the ongoing management of the new environment may ultimately become part of the managed agreement.
The actual buildout, however, is a project.
A clearer approach would be:
- Scope the new location separately.
- Identify equipment requirements.
- Estimate professional services.
- Determine onsite needs.
- Add the new managed endpoints to the recurring agreement.
- Update documentation and monitoring after deployment.
The result is clearer budgeting and fewer billing surprises.
Managed Services Scope Checklist
Before signing an agreement, ask:
- What does the monthly fee include?
- Which security tools are included?
- Is Help Desk support included?
- How is remote support handled?
- How is onsite support handled?
- Are any onsite hours included?
- What qualifies as a project?
- What professional services rate applies?
- Is BCDR included or optional?
- Is penetration testing included or optional?
- Is Compliance Manager included or optional?
- How are new locations handled?
- How are major migrations handled?
- What happens when a recommended service is declined?
- How are accepted risks documented?
How Should a Non-Profit Think About Service Scope?
A strong managed services relationship should create predictability without pretending every future technology expense can be bundled into one monthly payment.
For planning purposes, a properly secured managed environment can generally be described as approximately $125-$175 per endpoint per month, but that planning range does not automatically include every project, optional service, onsite requirement, or infrastructure purchase.
Clarity is better than a promise that sounds unlimited.
Review a managed services approach built around clear scope, predictable operations, proactive support, and transparent service boundaries.
