IT maintenance and technical support agreement

Corrective maintenance fixes defects, preventive maintenance reduces risk and adaptive maintenance responds to environmental changes. Enhancements add functions and require separate estimates unless included in a clear budget.

The agreement identifies covered applications, versions, infrastructure and third-party components. An attached technical inventory avoids support implicitly expanding to every connected system.

Every request must enter through a tracked channel and receive a justified classification. The client’s stated priority may be recalibrated against actual impact through an agreed procedure.

• Persons authorised to open and close tickets.
• Minimum information: system, version, steps, logs and impact.
• Severities based on affected functions and users.
• Response, workaround and target remediation times.
• L1, L2 and L3 levels and escalation timing.
• Monthly reporting, recurring problems and preventive action.

The provider must know whether it may apply patches unilaterally, needs client approval and who bears responsibility when an update is delayed. Test environments, backups, rollback and maintenance windows are defined.

For vulnerabilities, monitoring sources, classification, deadlines and confidential communication are established. The Cyber Resilience Act introduces phased obligations for products with digital elements, including reporting from 11 September 2026 for covered situations.

Termination must include handover of repositories, documentation, accounts, configurations, passwords through secure channels and incident history. Transition assistance duration and fees are agreed before conflict arises.

The agreement clarifies which copies are deleted, which data is lawfully retained and when the former team’s access ends. For data processing services, Data Act provider-switching rules may become relevant.