When MSPs Get Sued

One of the immediate questions to be raised is what duty the provider had, absent a documented service agreement. One of obvious reasons UCS Objective 9 has a signed agreement requirement is to prevent situations like this case from ever happening. Of course, disagreements occur between reasonable parties, and so a signed agreement documenting the obligations of both parties can be extraordinarily helpful.

MSPs who comply with the UCS must demonstrate their use of signed agreements for managed services relationships. The fact that the client had to resort to arguing the existence of a verbal agreement to establish a “managed services relationship” is quite telling. Which, of course, brings us to the ultimate question of whether the provider was, in fact, an MSP.

Was the provider an MSP?

Why does this question matter? This question is fundamental, both to this case and to future cases because the duty of the MSP (as defined by a managed services agreement) is different from the duty of a break/fix company. Why is there a difference? Because reactive IT companies are not proactively managing anything. Break/fix (or reactive IT, synonymous terms) respond to problems after they have occurred and repair them, but they do not provide anything close to the same types of solutions as an MSP.

Even the presence of "MSP tools" in the hands of a reactive IT company does not mean that the client is receiving anything proactive in terms of monitoring, management, or preventative IT services.

Issues such as recklessness or negligence may be factors in this case, time will tell. But even a cursory review of the provider's website would lead any MSP to quickly determine that they were not an MSP. In fact, there is nothing on the website I could tell that even mentioned managed services.

We have a very real separation, a divide if you will, between managed services and reactive IT; we have had it for several decades. Today, in 2024, there is no reason for anyone to be misled by what types of services you are receiving from an IT provider; services are either proactive or reactive, not both.

The outcome of this case will be interesting for the MSP profession for many reasons, chiefly because it may set a standard of care for reactive IT companies. What everyone else should take from this case is that there are real distinctions and standards of care between MSPs and reactive IT companies.