Managed Cloud: What a Contract Should Specify

What good managed cloud covers

• Monitoring and incident response: 24×7 coverage, staffed or on-call, with response and restoration targets written in minutes. Ask for summaries of the last three incidents, with timings.
• Patching and backups: patch cadence, backup frequency and retention, and tested recovery targets. Ask for the most recent restore test record.
• Security operations: who approves privileged access, how secrets are handled, and how often vulnerability scans run. Ask for an access review report and a scan summary.
• FinOps: who owns rightsizing and commitment decisions, and what the monthly report contains. Ask for a sample monthly report.
• Named owner: a named technical account manager and an escalation path with names and hours. Ask for the escalation matrix, with time zones.

You keep the application code, the decisions on business continuity, the choice of which data is in scope, and the approval of your own staff's access. A provider can run the platform. It cannot decide how much interruption your business accepts.

Questions to ask any provider

• Is 24x7 coverage staffed around the clock, or on-call overnight? Look for named hours and a written handover rule.
• Are response and restoration targets in the contract, in minutes? A percentage uptime figure on a web page is not a commitment.
• Is there a named owner, or a shared ticket queue?
• Is FinOps included in the fee, or billed separately?
• Does the cloud provider's own support plan need to be bought, and who pays for it?
• Can the provider invoice in the currency and tax format your finance team needs? Taxes apply as applicable in your jurisdiction and the contract.

How TiCON scopes it, and what it holds

TiCON's managed scope includes a named technical account manager, 24x7 SRE coverage for in-scope infrastructure, and security and FinOps duties. The named TAM is provided without a separate AWS Enterprise Support fee. Response-time minutes are written into the contract, not into marketing copy.

Engagements are quote-based and billed in USD. Other currencies are by contract, so ask. Engineering and operations run from Dhaka, Bangladesh (UTC+6, head office and R&D center). The Korea office (Suwon, UTC+9) and the US office (US Eastern) take client contact in their own hours and pass technical requests to Dhaka. Exact overlap hours are agreed for each engagement.

Ask for the report, not the badge. TiCON holds two ISO certificates, both issued by A Cube TIC Limited: ISO/IEC 27001:2022 (certificate 25/18024, valid to 6 October 2028) and ISO 9001:2015 (certificate 25/182622, valid to 7 October 2028). A SOC 2 report is an audit report, not a certificate. TiCON does not hold a SOC 2 report; its managed work is built to SOC 2 readiness. For payment-card data, TiCON works to PCI DSS readiness and holds no company PCI DSS certificate. Write down which reports you need before you start the review, and ask each provider which of them it holds.

Next step: send us the scope list filled in for your estate, and book a call. The service is described in managed cloud and SRE.

Related reading

[Cloud Cost Optimization: A FinOps Starter for Small Teams](/resources/blog/finops-starter-for-smes) How to give cloud spend an owner, set alerts and run a monthly review.

[Reading AWS Pricing: Cost Drivers and a Worked Example in USD](/resources/blog/aws-pricing-bdt-examples) The main cost drivers, and how partner pricing and invoicing change the picture.

[How to Reduce Your AWS Bill: 6 Tactics That Work](/resources/blog/how-to-reduce-your-aws-bill) Tagging, rightsizing, commitments, idle cleanup, storage tiers and data transfer.