Talk to us
Talk to us

Buyer's guide

What a software support and maintenance agreement should include

Software is not finished when it launches. What an agreement to look after it should say, how times are agreed, and what you should see every month.

For businesses that run their own software8 min read

Read the guide Talk to us about support This guide as Markdown

What maintenance covers

Maintenance is not only fixing what breaks. Phones, browsers, payment services such as M-Pesa and tax rules in Kenya change around software that nobody has touched, and it stops working without a fault of its own. Software maintenance services, and any agreement for them, should say which of these four kinds of work they include.

The four kinds of maintenance
Kind What it is An example
Fixing faults Putting right what does not do what it should. A report that adds up wrongly.
Keeping up with change Changing the software because the world around it changed. A payment service changes how it confirms a payment.
Small improvements Changes to how it works, short of a new project. A new field on a form, or a new report.
Preventing problems Updates, security patches, monitoring and tested backups. A library with a known flaw replaced before it is used against you.

Severity levels, response times and fix times

Disputes about support often come from two words used as if they meant the same.

Response time
How soon somebody acknowledges the request and starts looking at it.
Fix time
How soon the problem is put right, or worked around. Also called resolution time.
Hours covered
Business hours, extended hours or round the clock, in which time zone, and what happens on public holidays.
Severity levels to agree
Level What it means What to agree
Critical The system is down, or money or customers' data is at risk. The fastest response, the people to call, and an update at set intervals until it is fixed.
High A main function is broken and there is no workaround. A fast response and a target for the fix.
Medium Something is wrong but the work can go on. A response in working hours and a fix in the next update.
Low A question, a small defect or a wish. A response, and a place in the list of work.

A promise to respond is not a promise to fix

An hour to reply tells you somebody is looking. Ask what the agreement says about how long a critical fault may last, and what happens if it lasts longer.

What a good agreement says

Use this as a checklist for any application support contract. It does not need to be long. When you choose a provider, it does need to answer these.

  • Scope: which systems, which environments, and which parts of them.
  • Exclusions: what is not included, such as new features, a fault in a service somebody else runs, or damage from changes made by others.
  • Requests: who may raise one, how (a ticket, an email, a phone call for the critical ones) and how it is tracked.
  • Times: the response and the fix target for each severity level, and the hours they count in.
  • Reporting: what you receive every month (below).
  • Security and backups: that updates are applied on a schedule, and that a restore from a backup is tested and not assumed.
  • Access: the accounts, keys and servers are in your company's name, and the provider uses access you can withdraw.
  • Changes: how a request that is too large for the agreement is quoted and agreed.
  • Term and exit: how long it runs, how much notice either side gives, and what you are handed if it ends.

Ways to pay for support

How it is paid for decides what the provider is paid to care about.

Ways to pay for support
Model How it works Works when Watch out for
Monthly retainer A fixed fee for an agreed scope and an agreed amount of work. The system matters and you want a team that knows it ready. Paying for hours that go unused, or work that is outside the scope.
Bank of hours You buy hours in advance and they are used as work is requested. The work is irregular but you want a quick start. Hours that expire, and unclear rules on what counts.
Pay per request or incident Each piece of work is quoted or charged by time. The system is small and rarely changes. Nobody is on call when it breaks, and delay in approving a quote.
Included with hosting or a managed service Support is part of a service that also runs the system. You want one party responsible for it all. Being unable to leave, because the system and the support are one.

What you should see every month

A support provider that is working leaves a trail. Ask for a short report that says:

  • The requests received, by severity, and how long each took to answer and to fix.
  • What is still open, and why.
  • The updates and patches applied, and the ones waiting.
  • The result of the latest backup restore test.
  • Any outages, with what caused them and what has been done to stop a repeat.
  • What is coming: renewals of certificates and licences, and changes in services the system depends on.

Taking over software that somebody else built

A different company can look after software it did not write, if it starts with a review and not a promise.

  1. Get access you control

    The code, the servers, the domain, the app store and cloud accounts and every key, in your company's name.

  2. Ask for a first review

    A short look at what the system is, how it is built, how it runs and what is out of date or at risk.

  3. Put monitoring and backups in place

    Before any change, so that you know when it breaks, and can bring it back.

  4. Write down what is known

    A list of the faults people already know of, and the parts nobody dares to touch.

  5. Start with small, safe changes

    They teach the new team the system, and show you how it works.

Red flags

Any one of these is a reason to ask more questions.

  • A promise of an answer, and none of a fix.
  • No list of what is excluded.
  • Accounts and keys held by the provider.
  • No report, or one that only says that everything is fine.
  • Backups that have never been restored.
  • A long term with no way out.
  • Nobody who knows your system is named.

Test it before you need it

Ask the provider to show you how a critical request is raised and answered. If the first time you find out is a fault on a Friday night, it is too late.

Keep reading

Common questions

What is software maintenance?

Software maintenance is the work of keeping software running and useful after it is launched: fixing faults, changing it as phones, browsers and services around it change, making small improvements, and preventing problems with updates, patches, monitoring and backups.

What is included in a software maintenance agreement?

The systems and environments in scope, what is excluded, how requests are raised, response and fix times for each severity level, monthly reporting, security updates and tested backups, access in your name, how larger changes are quoted, and the term and the way out.

What is an SLA in software support?

An SLA, or service level agreement, is the part of a support agreement that states the service in numbers you can check: the hours covered, how soon a request is answered and how soon it is fixed, for each severity level.

What is the difference between response time and resolution time?

Response time is how soon somebody acknowledges a request and starts on it. Resolution time, or fix time, is how soon the problem is put right or worked around. A short response time does not promise a short fix.

How much does software maintenance cost?

It depends on how large and how important the system is, how many hours it is covered and how fast you need answers. Ask for the cost as a retainer, a bank of hours or a charge per request, and what each includes.

Do I need maintenance if my software already works?

Yes. Software that nobody touches still stops working when the phones, browsers, payment services and rules around it change, and its security flaws are found over time. Maintenance is how you find out before your customers do.

Can a different company maintain software it did not build?

Yes, if it starts with access you control, a review of the system, monitoring and backups, and a list of what is known to be wrong, and makes small safe changes first.

Need someone to look after your software?

Tell us what you run and who looks after it today. We will say what we would check first and how we would agree the times.

Talk to us about support