How to Sign a Contract with an IT Outsourcing Agency

Outsourcing is an excellent way to reduce the cost of development while ensuring the highest standards of product quality. However, it is vital to establish the terms of partnerships to protect the product and specify the responsibilities, rights, and terms of collaboration in advance.

Signing a contract with an IT outsourcing agency also ensures the product is delivered per defined quality and within a specified timeframe, and that those services are compensated for per the agreement. Should anything go wrong, the contract specifies the consequences and ways to remedy the situation.

But let’s dive into the matter a bit deeper.

An outsourcing contract is a legal, binding agreement that specifies all parties’ roles, responsibilities, and rights. It includes project details regarding the time intervals, price, payment methods, qualities, features, risks, remedies, IP concerns, protection of sensitive data, and more. Outsourcing contracts are designed to secure that all parties benefit from the relationship and conclude it with the expected outcome.

More specifically, outsourcing contracts specify:

• Services. The contract should include a description of service elements, requirements, and standards (at least to some extent). How well the project scope will be defined upfront depends on the project in question.
• Payment terms. The method and specific payment terms are defined in advance, and the outsourcing contract should state the amount, frequency, and processing method. The agreement should also cover the consequences in case any of the two parties fails to fulfill their duties (payment or delivery of services) per specifications.
• Data compliance and protection. Regular audits are required to ensure that high standards for sensitive data protection are kept, and policies followed. The clause included in the agreement must comply with established rules and regulations (for instance, with GDPR in the EU, CCPA in California, etc.)
• Intellectual property rights. The outsourcing contract outlines the rights to intellectual property (IP) developed as a result of the relationship. In most cases, the client represents the IP owner unless they fail to follow the payment terms. In case the vendor hasn’t been compensated for the IP they built, they are allowed to use it.
• Representation, liability, and warranties. This section specifies the liability cap and specifications that indicate the project deadlines, product quality, payment terms, regulations, etc. The clause helps manage risks and control business financial exposure in case of data loss, subcontractor liability, or any breach.
• Business Continuity and Disaster Recovery (BCDR) plan. The clause ensures that business operations continue with minimum or no interruption and delays when the outsourcing provider is, for any reason, unable to provide the services per the agreement. 
• Notice period. The section specifies the notice period within which the changes are allowed and must be accounted for.
• Contract termination. An exit clause of the outsourcing contract specifies the early exit strategy. This can include procedures for returning assets and equipment, penalties, liabilities, methods of handling intellectual property, etc.

Naturally, the unique nature of the project dictates the contract stipulations. In consultation with the business and legal team, the two parties should agree on the contract model, list of requirements, and specific outsourcing contracts to be signed to protect the interests of both parties.

While the two parties can ask their legal team to draw up any kind of legal document they believe is necessary for the purpose of the project, we would like to underline the following 4 as the most crucial ones for establishing an outsourcing business relationship:

1. Non-Disclosure Agreement (NDA)

The Non-Disclosure Agreement is a standard document signed between two parties that expect to share sensitive information. The purpose of an NDA is to protect the information from being disclosed to a third party not covered by the agreement.

A non-disclosure agreement should include the following points:

• Definition of confidential information, including passwords, access to information, procedures, development strategies, databases, prototypes, source code, etc.
• Use of confidential information to indicate in which way can the defined confidential information be used by any of the parties covered by the agreement.
• Return or destruction of confidential information to indicate what the parties can or cannot do once they end the collaboration. NDA should cover different types of data storage (cloud, USB storage, hard drives, services, copies, etc.)
• Confidentiality terms to define the time frame during which the specific information is considered confidential and prohibited from being shared with a third party.
• Disclosure clause to list all parties allowed access to confidential information (e.g., internal and/or external employees, stakeholders, freelance contractors, etc.)
• Remedies clause to define how a breach of the NDA contract will be handled and how the party who breached the contract will compensate for the disclosure.

‍

2. Master Service Agreement (MSA)

A Master Service Agreement is signed between the parties that intend to establish a long-term partnership. MSA covers:

• Provision of services, i.e., the order in which the required services will be provided.
• Service acceptance and payment, including any taxes, timesheets, and any other fees.
• Term, that is, the time frame of MSA validity and conditions for its termination.
• The intellectual property rights and ownership clause specifying what intellectual property is and the terms for its management (e.g., copywriting, trademarking, or applying for patents). The IP rights and ownership clause is also commonly found as a standard section of an NDA. 
• The confidential information clause defining confidential information and the terms of its management.
• Liability, warranties, and representation to define the project participants and their responsibilities.
• Indemnification clause describing how a party will compensate in case they breach the MSA. 
• Severability clause to set out the unenforceable provisions of the agreement.

The MSA can also include special notices and miscellaneous items to explain how the agreement will be delivered and specify the benefits, amendments, and anything else the parties may deem relevant.

‍

3. Statement of Work (SOW)

Statement of Work describes the details of the project, the stages, product features, risks, criteria, etc. The SOW commonly includes:

• CI/CD pipeline diagram
• Schedule of development procedures, such as project communication, procedures for approval, objections, reporting, deploying, project closure, etc.
• List of devices and specifications, including screen resolutions, browsers, and specific versions to be used for testing purposes.

The SOW agreement can also include a special attachment regarding the chosen payment model. It can also cover items like major risks and consequences, the influence those risks may have on the project, unenforceable circumstances, and more.

‍

4. Data Processing Agreement (DPA)

Data Processing Agreement aims to regulate data processing and the relationship between the data processor (contractor) and data controller (client). The agreement specifies how the data will be stored, processed, and protected. As such, the DPA is developed according to the data compliance and protection laws in effect.

‍

5. Service-Level Agreement (SLA)

The Service-Level Agreement should specify the services the outsourcing agency is expected to provide. It can be anything from designing a feature to developing software from the ground up. The client is also expected to provide a list of deliverables for which the outsourcing agency will be liable. SLA sets the benchmark for product quality and can also include necessary steps to maintain quality.

The SLA can include the following points:

• Milestones and their individual deadlines
• Contractual penalties for failing to meet the requirements
• Processes for requesting changes or reviews
• Details of subcontracting in case the outsourcing company employs subcontractors (e.g., name the subcontractor for them to be vetted)

‍

There are several types of outsourcing contract models formed based on the pricing plan and type of engagement. From our experience, you are most likely to sign an outsourcing agreement based on one of the three following models:

1. Fixed-price model

Fixed pricing is ideal for smaller projects where the requirements are specified in advance. This model requires the outsourcing vendor to deliver the product based on the client’s expectations and within the pre-defined (fixed) budget. The outsourced partner is 100% responsible for the results and project success.

This type of contract is typically accompanied by the Request for Proposal (RFP), a formal document that covers the project details and the vendor’s description of how to meet the project requirements. Since fixed pricing eliminates the flexibility from the equation, any changes through the development phase must be accompanied by the Change Order document.

Those who sign a fixed-price contract must think about all aspects of the project and define pricing, budget, deadlines, and other details in advance. Considering all this, the model is becoming less popular among software developers who find it difficult to outline exact project specifics in the earliest stages.

Fixed pricing comes with reduced client responsibility and involvement, leaving project management to the outsourced PM. For this reason, it is essential to provide the outsourcing agency with detailed specifications and expectations.

Fixed-price contracts are for:

• Small-scale projects with a short timeframe
• Very specific projects where all details are known in advance
• Simple projects that are easy to carry out and don’t require many changes in the process
• Businesses with limited budgets that can’t afford to be blindsided with additional expenses

‍

2. Time and materials (T&M) model

Time and materials contracts are signed when a company requires an external contractor to jump in on a long-term project. Time refers to the hourly rate established for each remote team member and materials for any physical/digital tools they use to complete the project. For a successful T&M contract completion, we recommend you keep the milestones manageable and analyze progress reports regularly.

The payments are based on the services and time required to complete the project. Unlike the fixed-price contract, it offers flexibility and ends only when the agreed-upon results are achieved.

Time and materials contract is suitable for:

• Agile projects
• Innovative project ideas where estimates of scope are hard to define
• Projects that require the use of emerging technologies
• Complex and raw project concepts

‍

3. Dedicated development model

A dedicated team model refers to employing a specialized team to work on product development and is a more appropriate choice for long-term partnerships. The external team is the extension of the internal one, and it is not uncommon to extend the partnership and involve the same team on a different project. This model puts the client in charge of managing the development team that has the flexibility to adapt their work per changing project requirements. The outsourcing team is paid a monthly fee, and the contract rarely includes a pre-defined exit clause and termination strategy.

The dedicated development model is ideal for:

• Long-term and complex projects
• Projects where modifications are expected
• Projects where the client wants to stay in charge of the remote team
• Businesses planning to grow and expand

The bottom line is that an outsourcing contract is signed to help the vendor and the development team prevent and overcome the most common challenges of working with remote teams. How?

We are strong advocates for choosing a more flexible, agile approach to development. It allows for innovation, continual improvement, and activities that prove essential only after you’re already halfway through the project.

However, we’re all for establishing some ground rules in an outsourcing contract. These rules should keep all the members aligned and aware of expectations but leave enough room for improvisation and unique, cutting-edge ideas.

Remote employee management has always been one of the top outsourcing challenges. Managers simply can’t help but worry about how the remote team spends their hours and whether they are truly productive.

This is where the era of time-tracking software began. Though controversial in some circles, no one can deny they help get better results. Especially when you agree on hourly pricing, time-tracking tools help keep accurate records of work hours and ensure they are adequately compensated for.

However, the idea of using any tracking tool brings micromanagement to mind and immediately casts a shadow over the entire project. But if implemented properly, time-tracking software doesn’t have to affect employee satisfaction and retention negatively.

From our experience, the use of a time-tracking tool is well-received when everyone on the team understands why it was introduced in the first place. They should learn about the platform in advance, the activities that will be tracked, in what way, and most importantly – the benefits of the system.

It is crucial to explain that the tool will not be used to monitor every single minute of employee activity, but that it is simply there to foster accountability, provide employees with a way of tracking their productivity, and understand the extent of their contribution better.

As a result, an increasing number of companies have decided to lay out uniform rules and guidelines for using time-tracking software in the outsourcing contract.

While we are making great strides in the field of cybersecurity, remote teams still face challenges when it comes to averting the associated risks. From phishing attacks and lack of visibility of monitoring tools to infrastructure vulnerabilities and outdated response plans, security teams have a lot on their plate. Remote teams, in particular, are more susceptible to disruptions and take longer to figure out and address the problem.

To mitigate risks and effectively respond to threats, outsourcing partners should establish detailed security policies and a Business Continuity Management Plan (BCP). These documents should cover a range of possible scenarios and comply with local and international security standards (including, but not limited to PCI DSS, relevant ISO standards, GDPR, and HIPAA requirements). BCP, in particular, should outline recovery actions in case of power, server, or backup failures, network security attacks, load VPN tests, and backup scenarios.

1. Specify the services
2. Define deliverables ownership
3. Define ownership of intellectual property
4. Define confidential information
5. Enforce compliance with relevant rules and regulations
6. Transfer the IT assets
7. Establish the payment method
8. Determine scenarios in case of breach of contract
9. Establish ways to terminate the contract

Once the agreement is signed, the client is expected to transfer the necessary IT assets, including hardware, and software licenses, tools and equipment leases, telecommunication equipment, and more.

‍