1.4: How to Build a Rock-Solid Master Service Agreement for Your MSP

“Wow, does my agreement even cover…”

What happens when a client points a finger at you for something that may not even be your mistake? Technology lawyer Brad Gross explains how to build a solid ring of defense around your MSP using a master service agreement, including:

The one thing more important than legal considerations that an MSA must account for
How to know when your MSA doesn’t cut it
How to use your MSA to save on insurance premiums
Why your MSA should never change
The easy way to have clients accept your MSA

Who’s on this episode

Host: Jennifer Tribe
Guest: Brad Gross, Law Office of Bradley Gross, P.A.

Brad Gross is the founding partner of the Law Office of Bradley Gross, P.A., a law firm that focuses on transactions involving software development companies, technology solution providers, VARs, technology resellers, and IT professionals worldwide. Brad is an award-winning speaker, author, professor, and a leading legal authority in managed IT service transactions. He sits on the board of several technology companies and acts as general counsel for hundreds of technology solution providers throughout the United States. He is the host of the MSP-devoted podcast, The Technology Bradcast.

Episode transcript

Jennifer: Today on the show, how to craft and use a rock solid master service agreement to protect your MSP.

In episode 1, we talked about cyber insurance. Wes Spencer from FifthWall explained why your insurance policy should be your absolutely last ring of defense for your business.

Today, we’re going to explore one of the rings of defense in front of your insurance—your master service agreement or MSA.

My guest is Brad Gross, a lawyer based in Florida who specializes in working with technology companies. He has a podcast for MSPs called The Technology Bradcast, which I encourage you to check out. I’ll put links to that in the show notes. In particular, check out the episode on legally raising your fees by any amount without client protest. You’ll find it has a great tie-in to Workflow episode 3 with Erick Simpson where we talk about raising your rates every time you fire clients.

Now the MSA. By the way, I have variously seen MSA used as an acronym standing for master services agreement and managed services agreement. Brad and I use the former definition — master service agreement — and this is an important distinction.

Because the master service agreement is just that — the master of all. It’s an overarching agreement that governs everything you do for every client. And in Brad’s view, it never changes.

“Those rules apply to everyone”

Brad: An MSA, in my view, should never ever talk about a particular service. It shouldn’t. Okay. Now what do I mean by that? An MSA should be service agnostic. It should be cost agnostic. Price agnostic, client agnostic. Doesn’t matter what the service is. The MSA is that guiding principle foundational document that governs services. Services themselves should be in a different document: a quote, a statement of work, a proposal, whatever the MSP wants to call it. But the concept is is that if you include services in your MSA, specific services and what you’re going to charge and your rates and your service levels and so forth, well then, since those are variables, those things change. Every time you have a different customer, you’re going to have a different MSA. You’re changing your MSA. And in my view, your MSA never changes.

If you’re going to make a change, if there’s something that your customer says, well, we read your MSA and we want to revise something, then that something goes in the quote or the statement of work. Because if your MSA is written correctly, quotes, statements of work, and so forth take precedence over the MSA.

The analogy I like to give is the big set of rules when you go into a pool, like a community pool or a pool where a lot of people are and they have those rules, right? No running, no jumping, no diving, no glass bottles. Those rules apply to everyone at the pool. It doesn’t say Brad, Jen, if you’re at this pool, well, no glass bottles. No, it says no glass bottles. Who are they talking about? Everybody. It doesn’t matter. You can be tall, short. You can know how to swim. You could just be there to get a suntan. Doesn’t matter. It applies. The same thing goes with an MSA. Your MSA should just be the rules that govern reality and legal. Everything else is removed from the MSA and put in a quote.

It is the quote that is the latest thinking, the latest version, iteration of the parties agreement. That’s where the changes go. And by doing that, you are lowering the bar of entry. You’re making it easy for your customer to accept your quote because the quote is not appended to or part of this MSA that talks about legal and talks about reality and so forth.

An analogy would be if I told you if here’s my quote, I’m going to deliver a pizza to your house in 30 minutes or it’s free. That’s my quote. Okay. But if I attach that quote to something like I’m going to deliver a pizza to your house in 30 minutes or it’s free. But before you tell me what you want, I have to tell you a few things. First, if my driver gets into an accident, we have a limitation of liability. I’m going to talk to you about that, and we’re going to arbitrate that issue. And if it’s within 500 feet of your house, it’s going to be limited to six pizzas as opposed to 12 pizza. You get the idea. We’re now attaching that legal to the quote. It’s not as palatable, is it? So my suggestion is separate MSA from services. Have them accept the MSA separately and we can talk about how that gets accepted, but have them accepted separately and proceed with a different document that talks about services.

“The customer points its finger at the MSP and says…”

Jennifer: Let’s take a step back and talk about what the MSA does in an MSP business, the role it serves.

Brad: An MSA has two purposes, in my view. The first purpose is to cover the legal end of things, right? That’s the stuff that lawyers love to write. That’s the indemnification and your legal limitations of liability and so on. That’s your what I’ll call your legal insurance in case you totally mess something up and you think, Oh, I got to write a check. How much am I writing this check for? So that’s important, right? That’s your sort of insurance policy. But what an MSA also must do is it must address reality, what I call situational reality. Situational reality in many ways is actually more important than the legal end of things.

Jennifer: What do you mean by situational reality?

Brad: So situational reality is where an MSP is actually dealing with a customer and something happens. It could be a mistake, right? It could be a misunderstanding. It could be a miscommunication. It could just be that things happen, which they do from time to time. And at that point, the MSP turns around and thinks, Well, now what do we do? If you can’t answer that “now what” question, then your MSA has failed you. Because that’s why we have contracts. We don’t have contracts just in case we totally mess something up and we have to write a check. We have contracts to give us guidance, give us direction. And if the contract, the MSA doesn’t give direction and guidance in all of these situations that an MSP might find itself, that’s a crappy contract and it’s got to go.

Jennifer: Can you give me an example of a mistake that an MSA might cover and what an MSA might guide you to do?

Brad: MSPs do something poorly, incorrectly, in an incomplete way. That happens from time to time. What I think is probably more often the case is where there is no actual mistake, but there’s the appearance of a mistake. For example, an MSP tells a customer that it has to implement the service. The customer declines the service. And then the thing that the MSP feared would happen actually happens. The first thing that happens is the customer points its finger at the MSP and says, This was your mistake, you did this. This is something that went wrong. You’re in control of our system. Why aren’t you fixing this?

MSP turns around and says, Well, we told you what to do. You didn’t listen to us. And of course, the response to that is usually in the form of an attorney’s letter from the customer’s attorney saying, Listen, you may have said that they should implement whatever it is that you said, but I don’t really see in your contract which says we have to listen to you. I do see on your website where it says you’re our trusted IT professional, that you’re going to proactively do things. I do see in your contract, which is you’re going to fix things. So fix it. Now what?

And the paradigm here is that parties will now argue back and forth and attorneys will argue at hundreds and hundreds and hundreds of dollars an hour slowly about who’s right, when the truth is that if that situational reality, the reality of customers decline services and that happens, if that was just addressed in the MSA they wouldn’t be in that situation. That’s a reality.

If we sat back and thought about it, we could come up with, I mean, Lord knows this is what I do, I come up with realities all the time from the thousands of MSPs we deal with, we come up with a couple of dozen realities. Realities in co-managed situations. Reality in regulatory compliance situations. Reality in the fact that upstream providers fail, and when they fail, there’s not a lot that the MSP can do about that. Who’s going to take on liability for an upstream provider’s failure? These are realities. If an MSA doesn’t deal with these realities, the kind of day to day, week to week impacting issues well then in my view, the agreement is almost worthless.

“Now you’re on the road to situational reality”

Jennifer: OK. So it covers legal and situational realities. What does that translate to in terms of the sections or area you need to address in a good MSA?

Brad: Generally speaking, there are certain areas that you always want to cover. For example, you want to make it clear if you’re drinking the Kool-Aid that I’m pouring, you want to make it clear that the MSA is just that, it’s a master agreement that controls all transactions and that it is going to be devoid of services. It doesn’t have services in this document. Where are you going to find services? That’s going to go into a different document: a quote, statement of work or a proposal, whatever it might be.

You also want to cover certain areas. Obviously, you want to make sure that from a legal perspective, your liabilities are limited, that you’re not warranting upstream provider services, that you’re not guaranteeing that if you’re acting as a VAR, for example, and purchasing hardware, that the hardware will be functional or operational under all circumstances. You want to make the relationship between you and your customer very clear and in doing that, you have to describe the fact that there are other parties involved, upstream providers, whomever they may be, and that there are things you’re going to take responsibility for and there are things you won’t take responsibility for. So that’s the legal end.

The reality end? It really depends on the MSP but one good rule of thumb is you sit back and you think about all the parade of horrible things that have happened to you in a business perspective and then say, how does my document address it? Let’s say, for example, a customer is being a jerk, a really bad person, okay? And he pays his bills, but he’s being a bad person, difficult to deal with. It’s actually costing the MSP more money to have this person as a customer than not. But here’s the problem. They’re locked into a one or three-year deal and the customer pays its bills on time every day, every month, rather. But the customer is such a bad customer. What are you going to do? How do you get out of that?

That’s the kind of thing that you that you turn around and you think, Wow, does my agreement even cover when somebody acts like a jerk or somebody acts in a way that makes it impossible or impractical for me to deliver this service at the price point or using the supplies and the manpower I have that we kind of thought about at the beginning of the deal. How do I deal with that? And if your contract doesn’t deal with it, then make sure it does. Now you’re on the road to situational reality.

“A good MSA builds a high fence”

Jennifer: You described the MSA earlier as almost like an insurance policy. How do your actual insurance policies fit into the MSA?

Brad: While an MSA is like your insurance policy in that it protects you should bad things happen, obviously it is not an insurance policy and I would advise everybody to purchase sufficient insurance for everything they’re doing: cyber piracy insurance, business interruption, fraud, and so on. That said, what we are finding with dramatically increasing frequency is insurance companies are reviewing their insureds’ MSA to make sure that the MSA properly covers the insured, the MSP. And we have many customers that come to us every year saying, I need to hire you. Yes, I need to hire you because I should have a good MSA, right? I should have good documents. But candidly, the reason why I’m hiring you is I can’t get insurance until I have a good MSA. I’ve actually been rejected. I can’t get a policy.

So an MSA works with insurance in that sometimes, first of all, it’s a foundational element. You need it. The second idea is that a good MSA builds a high fence that protects that policy. A lot of MSPs think that, well, if I get sued, that’s why I have insurance. That should not be the attitude. That should not be the concept because if you get sued, your insurance can double, triple, quadruple overnight or or you might not even be able to find insurance.

So the idea is not to have insurance and say, okay, world, come get me. No, the idea is to have insurance for that all hell broke loose situation and now you put an MSA as a wall in front of that policy. So if customers have any ideas about maybe I’m going to go after them, maybe I’m going to sue them, they gotta get through that MSA first. So a good MSA not only protects the policy, it’s required by insurance companies, in many cases, it will actually lower your rates because if you have a good contract in place, there’s less risk.

“Make it easy for your customers to accept your documents”

Jennifer: Let’s circle back to a comment you made earlier about having customers accept the MSA separately from a quote, a proposal, a statement of work. How do you recommend MSPs go about doing that?

Brad: First we have to become very goal oriented. The idea here is to lower the bar of entry and make it easy for your customers to accept your documents. That’s goal number one. Goal number two is to manage expectations. We’re doing both. You want to manage expectations of your customers, and you want to make it easy for them to accept your documents. So we already discussed lowering the bar of entry and making it easy for them to accept because we’ve talked about the fact that we’re going to take this MSA, put it on its own, separate it from the services, thereby we’re not sending them a quote or statement of work that’s 30 pages long with legal and reality. So we’re lowering the bar, making it easy for them to accept.

And by the way, I would recommend that those MSAs get posted on a MSP’s website. And then they are clearly, unequivocally, and unquestionably referenced at the beginning of the quote. ‘This quote is governed under the terms of our MSA located here. By accepting this quote, you accept our MSA and if you cannot access it or do not agree, do not sign this quote.’ Okay. So right away, we’ve now brought in the power and the governing part of the MSA, but we’re not including it in the quote. That’s going to lower the bar of entry.

Now how do we manage expectations? Well, it has been my mantra, I have come up with a solution that I think every MSP should be following, and it manages expectations while keeping the bar of entry low. The short version of it is that I think that every MSP should consider having a services guide, a services guide akin to a user manual.

The fact is that the services that MSPs provide are static, meaning the services they’re receiving from upstream providers don’t change very often. They are what they are. If you have a security stack from a series of upstream vendors and I open up an MSP and I use the same vendors, it’s the same service. I might charge differently, I might have different customers, but it’s the same service. So that’s good because it means that you can start to describe these services in a user manual. They’re not going to change. And the concept is is that the user manual will explain what you’re doing and how you’re doing it.

“Boom boom boom”

I like to analogize it to the user manual of a television set. If you want to know how to program the set, how to get it to work with your soundbar, how to program the universal remote it comes with, you look at the user manual. If you want to know what you paid for the set, where you bought it, and how many of them you bought, you’re going to look at the receipt. The receipt is your quote, your proposal. The user manual, that service guide, that’s the document you’re going to use to actually explain things. And your MSA is going to cover legal and reality. So think about this paradigm for a moment.

Your quote that you send out now begins with, ‘This quote is governed under the terms of our MSA located here www dot whatever dot com forward slash MSA. The services in this quote are described and governed in our service manual located at www dot whatever dot com forward slash manual. By accepting this quote you accept our MSA and our manual or guide. If you have any questions or you can’t access those documents, don’t sign this quote. Instead, call us. Now we’re going to tell you what you’re going to get.’ Boom boom boom.

What we’ve done is we have now lowered the bar of entry because customers only have to read the quote. Will they read the MSA? Don’t know. Don’t care. As long as they know that it exists and they have the option to read it, whether they actually read it or not, is not my concern. The same way that all of your listeners install software all the time and just simply click that end user license agreement without reading it. Doesn’t mean it’s not enforceable. It meant you didn’t read it.

Well, same concept applies here. As long as they know the MSA is out there, great. And now you’re going to give them a user manual. So if they actually have a question about something that’s in the quote, they’re going to read that manual and they’re gonna say, Oh, now I get it. It says the Brad Gross security awareness program. What does that mean? That’s what it says in my quote. Let me look in the manual. The manual says, if you are choosing the Brad Gross security awareness program, here’s what you get. Boom boom boom. That is how you manage expectations while keeping the bar of entry low. That’s what I think every MSP should be doing.

Jennifer: And when you say put it on your website, do you mean publicly available or somewhere private?

Brad: My advice is always put it on a nonpublic non indexable location on your website for a few reasons. I mean, one, there’s the financial reason. You’ve paid most likely to have someone do your documents and why should you give them away for free from the prying eyes of your colleagues and your competitors. That’s one. Two, I like to tell MSPs to put them on a specific location specific site so that in your quote, you can direct your clients to that site. You’re not going to send them to your home page so they have to scroll down two or three screens, find another link, click that link, and that gives you a portal page. No, no, it should be one location, a specific URL. Like I said, not indexable, not public, and that’s where you should be sending your customers.

“If it’s done right, it’s going to last you for years”

Jennifer: I think we’ve pretty clearly established that a good MSA is a critical layer of protection for your MSP and you should have one. But I know some will still have a bit of a hard time parting with the money to get one done, especially in the early days of their business. Are there ways that a smaller or newer MSP can get an MSA in place cost-effectively?

Brad: I was thinking about sugarcoating this, but why should I sugarcoat it? Let’s just talk, right? Why not? We get a lot of clients, more than we can count, that come to us and say, I wish that I had known about you guys before I hired so-and-so or before I joined so-and-so and got this and that and so forth. Because what ends up happening is people try to go down the… not the cheap way of doing things because nothing is cheap but a cheaper way, and they end up spending money and their own time, which is valuable. Your time is valuable. Spending money and time with a document that really doesn’t address legal or it doesn’t address reality or doesn’t address both of them. It doesn’t contemplate lowering the bar of entry. It does not contemplate managing expectations.

So they come to us after they’ve spent hundreds, if not a few thousand dollars somewhere else, and all of these hours and hours and they say, I’m nowhere. Okay. My first thought is the cheapest way to go is not always the best way. And I know we’ve all heard that before, but that’s the truth. Think about your time alone, right? You spend 500 bucks and you say, oh, well, I got a template. Now how many hours is it going to take you to turn that into something that you’re comfortable with. Not something that you’d use because you’d probably use whatever it is. Something that you could go to bed at night, look up at the ceiling and think, ‘oh, I’m fine.’ How many hours?

If you’re going to think about costs in this regard, whether they hire our firm or any firm, you have to start off with people, with attorneys who understand the field, who understand the legal, which is important, and the realities. If they don’t understand both, if they cannot talk to you at length about the various solutions that you have and what realities might arise from those solutions and the interaction of solutions, then you’re going to end up spending money for something that is not going to be worth your while. So my first bit of advice is you have to associate yourself with professionals that understand the industry, that really, truly get it. That’s one.

Two, if you do your documents correctly, then your MSA, in my view, probably doesn’t need to be revisited more than once every 3 to 5 years at best. And by the way, I say revisited, it doesn’t necessarily mean rewritten, it just means revisited. So if you’re going to spend a few thousand dollars today, you probably are not going to have to spend that much money for another three, four, five, six years down the road. If you don’t have the right document upfront, you’re going to revisit it next year and the year after. And then when your clients tear it apart, then you’re going to seek more professional help.

So find people who understand the industry, understand that the investment that you make today is likely, if it’s done right, is going to last you for years and years. And then I would say that you kind of sort of have to put these things into reality, which is if you’re going to spend, let’s say three grand, four grand on getting all of your documents in order, well, you’re saving in the long run.

Why are you saving in the long run? Because you’ve just set that wall up so no one can touch your insurance policy. Because if someone touches your insurance policy, I promise you, I promise you it’s going to be more than three or $4,000 increase. We’ve seen people who have called us and started off at 10 or 15,000 a year. Now they’re up to 50. Now they’re up to 100 or they’re not being invited to get a policy at all. To me, the few thousand dollars upfront is worth the investment.

Jennifer: That was technology lawyer Brad Gross.

What did you think of today’s episode? Let us know with a review for Workflow on Apple Podcasts or send me an email at podcast@syncromsp.com. If you do leave a review, take a screenshot of it and email it to me and I’ll send you your choice of a free Workflow or Syncro t-shirt.

And don’t forget to tell your friends about us. Until next time, this is Jennifer Tribe. Thanks for listening.

Listen, rate & subscribe

🔊 Listen on: Apple Podcasts | Spotify | Google Podcasts | Your podcast player of choice

➕ Follow and subscribe to get new episodes as they publish.

🤔 Tell us what you think with a review on your podcast platform. Send a screenshot of your review to podcast@syncromsp.com and we’ll send you a Workflow for MSPs t-shirt.

Resources from this episode

It’s time to find your flow

Workflow for MSPs is brought to you by Syncro, the integrated platform for running a profitable MSP. Enjoy PSA, RMM, and remote access in one affordable package. Start your free trial today.