Managed Services
Managed services are the ongoing delivery of clearly scoped IT operations by an external provider, based on a contract with measurable service levels rather than per-incident time and materials billing. Typical scope: monitoring, patching, backup operations, incident and change handling, reporting. Distinctions: project work is time-boxed and delivers a result, break-fix reacts only after an outage, managed services own the running state. Where personal data is processed, a processing agreement under Article 28 GDPR is mandatory.
Managed Services in practice
A managed service contract defines three layers: scope (which systems, which activities), service quality (availability, response and restoration times, service hours) and the split of responsibility. The latter is usually documented as a RACI matrix, because cloud environments already impose a shared responsibility model: the platform operator owns the infrastructure, the customer owns data, identities and configuration — and the provider takes over a contractually named subset.
Operationally, managed services rest on the practices of the ITIL framework; ITIL 4 describes 34 practices, of which incident management, service desk, change enablement, monitoring and event management and service level management form the core. Steering relies on a few hard metrics: adherence to agreed response times, patch compliance per system group, number of tested restores per year, and the count of recurring incidents.
Legally the provider is not a neutral third party. Where personal data is processed, Article 28 GDPR applies, with instruction binding, sub-processor rules and deletion obligations at contract end. Where the customer falls under NIS2 — transposed in Germany by the NIS2 implementation act in force since 6 December 2025 — it must evidence supply chain security, so the provider's evidence becomes part of the customer's own compliance file. Privileged access design, logging, an exit clause and documentation handover therefore belong in the contract, not in the termination phase.