IT Advisory

IT Outsourcing Contract Checklist: What to Settle Before You Sign

Last updated 2 October 2026

An IT outsourcing contract checklist should cover eleven areas: structure, scope, service levels, service credits, fees and tax, people, security and data, intellectual property, liability, exit, and disputes. The aim is to write down what both sides assume. This is general information, not legal advice, so have a Saudi-qualified lawyer review the final text.

Disclosure: WASNA Digital Solutions offers IT outsourcing and resource augmentation. The checklist applies to any provider, including us.

How to use the IT outsourcing contract checklist

Work through this IT outsourcing contract checklist with the draft open. For each point, find the clause that deals with it. If there is none, or the wording says “to be agreed”, you have found a gap. Close it before signing or accept the risk on purpose.

Settle the engagement model first. An IT outsourcing contract for people working under your direction differs from a managed services contract for an outcome the provider owns, and that decides who carries the risk. IT outsourcing vs staff augmentation explains the split.

1. Structure, parties and term

The first clauses of an IT outsourcing contract fix who is bound, to what and for how long.

One master agreement with a schedule per service, and a stated order of precedence when documents conflict.
The exact legal entity on each side, including who invoices and who employs staff.
The initial term, whether renewal is automatic, and the notice needed to stop it.

2. Scope and change control

Services listed by name, with inclusions and exclusions.
Your own dependencies (access, information, decisions), with a clause that moves the provider’s deadlines if you miss yours.
The volume assumptions behind the price, and what happens when volume leaves the agreed band.
A written change procedure covering who can request a change, how it is priced and who approves it.

PMI paper author Marco Negri lists vague deliverables and undefined quality measures among the pitfalls of outsourced work. Both are scope problems, cheaper to fix in the draft than in a dispute, which is why scope comes early in any IT outsourcing contract checklist.

3. Outsourcing SLA and reporting

In an IT outsourcing contract, the outsourcing SLA sets how service is measured. Each measure needs four things written down.

A plain definition. “Availability” means little until the contract says what counts as downtime and which planned maintenance is excluded.
A measurement method and tool, with your right to see the raw data.
A target and the hours it applies to, including how weekends, public holidays and Ramadan working hours are handled.
A reporting format and frequency, with a named service manager who presents it.

Add a measure of business impact beside the technical ones. For service desk measures, see the IT service desk SLA template.

4. Service credits and remedies

Service credits are the price reductions a provider gives when it misses an agreed service level, and the IT outsourcing contract must say exactly how they work.

The credit formula, the monthly cap, and whether credits apply automatically or must be claimed.
A statement that credits are not the only remedy, a right to terminate after repeated or severe misses with the threshold written out, and a root-cause report after each miss.

On Saudi law, law-firm summaries of the Civil Transactions Law (Royal Decree M/191, in force since December 2023) report that Article 178 lets parties fix compensation in advance and that under Article 179 a court may reduce an excessive amount, or raise it where fraud or gross negligence caused greater harm. Ask your lawyer whether the credits in your IT outsourcing contract count as a price adjustment or as agreed compensation.

5. Fees, tax and invoicing

The pricing model for each service in the IT outsourcing contract. PMI authors Brannan and Lee describe time and materials as leaving overrun risk with the buyer and fixed price as leaving most of it with the seller.
Volume bands, price indexation, a rate card for extra work, a cap on expenses and a process for disputed invoices.
Whether prices include VAT. If the provider is not resident in Saudi Arabia, ask your tax adviser about withholding tax and who bears it. ZATCA’s FAQ, for example, says repair work by a non-resident with no permanent establishment in the Kingdom is treated as technical and consultancy services and is subject to 5% withholding tax.

6. People and subcontractors

Named key personnel, a handover period for replacing them, and your right to ask for a person’s removal.
A written statement of which entity employs and sponsors each person working in the Kingdom, and how Saudization obligations are handled.
Subcontracting only with your written consent, with security and data duties passed down to the subcontractor.

7. Security, personal data and data location

These are the clauses where an IT outsourcing contract for a Saudi organisation differs most from a generic template. For entities within the scope of the National Cybersecurity Authority’s Essential Cybersecurity Controls (ECC-2:2024), meaning government agencies and their affiliates and private entities that own, operate or host critical national infrastructure, some contract content is prescribed. Control 4-1-2 requires third-party contracts that could affect your data or services to include non-disclosure, secure removal of your data at the end of service, incident communication procedures and an obligation to apply your cybersecurity requirements. Control 4-1-3 adds, for IT and managed service providers, a risk assessment before signing and a requirement that cybersecurity managed service centres for monitoring and operations that use remote access be fully located in the Kingdom. Outside that scope, the list is still a sensible baseline for an IT outsourcing contract.

For personal data, SDAIA’s guide to the Personal Data Protection Law (PDPL) defines a processor as a party that processes personal data for the benefit and on behalf of a controller, and says the controller must ensure its processors comply. The guide says the law came into force on 14 September 2023, with a one-year grace period to 14 September 2024. Write down what the provider may do with your data, who its sub-processors are, how quickly it must report a breach to you, and how data is returned and deleted. Ask your lawyer which clauses the PDPL and its Implementing Regulations require.

Ask the provider to list every place your data is stored or accessed from, including backups and support staff. ECC-2:2024 notes that its data-localisation controls moved to the National Data Management Office at SDAIA, and tells entities to refer to that office before acting. Ask for audit rights too, because a certificate helps only if its scope covers your service. ISO/IEC 27036-1:2021 offers guidance on supplier security.

8. Intellectual property and deliverables

Who owns what is built for you (scripts, configurations, automations, documentation), and a licence to any provider-owned tool you need in order to keep the service running afterwards. Ask your lawyer to confirm the wording is effective under Saudi law.
Runbooks and network diagrams as contract deliverables, kept current during the term, with administrator accounts held in your name.

9. Liability and insurance

The liability cap, whether it applies per claim or in total, and what sits outside it, such as confidentiality, data breach and wilful misconduct.
Indemnities for intellectual property infringement and for data breaches the provider causes, and the insurance it must hold.

Law-firm commentary on Article 173 says limitation of liability clauses are generally enforceable but not where there is fraud or gross fault, so ask your lawyer how that affects the cap in your IT outsourcing contract.

10. Exit and transition plan

An exit and transition plan decides how hard it is to change provider or bring the work back in-house. It is the easiest part of an IT outsourcing contract checklist to leave until last, and by then your bargaining position is weakest, so agree it at signing.

Termination rights for cause, for repeated service failure, for convenience (with notice and any fee stated) and on a change of control.
A termination assistance period in which the provider keeps running the service at the agreed price and may not suspend it during a dispute.
A written exit plan, reviewed each year, naming who does what and by when, and who pays for it.

Item to hand back	What to specify
Your data	A usable format, a deadline and a deletion certificate. For entities in scope, ECC-2:2024 requires secure removal at the end of service (4-1-2) and, for cloud and hosting, return of data in a usable format (4-2-3).
Documentation and credentials	Current runbooks and every administrator account, with a check that no provider-only access remains
Licences and third-party contracts	Which transfer to you, on what terms and at whose cost

11. Disputes, governing law and language

The governing law and forum. Saudi courts and arbitration are both routes, and the Saudi Center for Commercial Arbitration’s 2023 Arbitration Rules cover arbitrations filed on or after 1 May 2023. Ask your lawyer which is enforceable for your parties.
The language of the IT outsourcing contract. Article 23 of the Saudi Law of Civil Procedures says Arabic is the official language of the courts and foreign-language documents need a certified Arabic translation from a licensed office. State which version prevails.
An escalation ladder with time limits, and a duty to keep the service running meanwhile.
Government buyers should check the Government Tenders and Procurement Law (Royal Decree M/128) with procurement before negotiating.

Run the IT outsourcing contract checklist past a lawyer

This IT outsourcing contract checklist shows what to look for, not what the law requires for your contract. Use it to prepare questions, then have a Saudi-qualified lawyer review the security, data, liability and exit clauses. If you are still choosing, WASNA Digital Solutions describes how its IT outsourcing and resource augmentation engagements are structured. Whichever provider you choose, ask it to state in writing which model it proposes.