Outsourcing Software Maintenance for SMEs: SLA, Costs and Checklist

You had an application built, or a system has been running for years, and it works. Until it doesn't: a browser update breaks the login page, a supplier discontinues an integration, a security review flags an outdated library. Software maintenance is the least glamorous part of custom IT, yet it decides whether your investment is still paying off three years later. In this article you'll learn why outsourcing software maintenance is often the smart choice for SMEs, which types of maintenance exist, what it costs and what to look for in the SLA.

What software maintenance actually is

Software maintenance isn't one thing. The theory (Lientz and Swanson, 1978) distinguishes four categories, and that breakdown helps you understand what you're buying:

• Corrective maintenance. Fixing bugs discovered after delivery. Think of a calculation that rounds incorrectly or a form that crashes on a specific character.
• Adaptive maintenance. Keeping the software working in a changing environment: a new browser, a new operating system, updated integrations, new versions of external APIs.
• Perfective maintenance. Improvements to performance, user experience and maintainability. New features fall under this too.
• Preventive maintenance. Proactive refactoring, updating dependencies and reviewing the architecture to prevent future problems.

What stands out in the classic 1978 study by Lientz, Swanson and Tompkins: 17.4 per cent of maintenance effort went on corrective work, 18.2 per cent on adaptive work and no less than 60.3 per cent on perfective work. The lesson: most maintenance isn't bug fixing. It's ongoing development and adaptation to a changing world.

For an SME, this means a pure "we only call when something breaks" approach leads to neglect. Maintenance is about continuous improvement, not just firefighting.

Why outsource software maintenance

There are three kinds of reasons not to handle software maintenance yourself: capacity, expertise and risk.

Capacity. Even if you have one developer in-house, that person is a single point of failure. Holidays, illness, a resignation: and your application ends up on the waiting list. Outsourcing gives you access to a team, and therefore to continuity.

Expertise. Besides knowing the codebase, software maintenance requires knowledge of security, dependency management, DevOps, browser compatibility, cloud hosting and sometimes compliance. Building that combination in-house is rarely efficient for an SME. Outsourcing buys you a broader skill set.

Risk. A neglected codebase slowly becomes unmanageable. Outdated libraries with known vulnerabilities, version numbers that lag decades behind, technical debt that keeps piling up. Outsourcing to a partner who stays on top of this proactively covers that risk.

Doing it yourself isn't wrong, but be realistic: for most SMEs, handling 100 per cent in-house is rarely sustainable. See also our breakdown of the pros and cons of outsourcing IT.

What software maintenance typically costs

The broad rule for custom software is that you can budget annual maintenance at 15 to 20 per cent of the initial development cost. Some sources put the lower limit at 10 per cent, while others go up to 25 per cent including hosting and licences. For web applications you often see ranges of 15 to 30 per cent, because browser and framework updates move faster there.

What does that mean in practice? If your software cost €60,000 to build, expect roughly €9,000 to €12,000 a year in maintenance. For a €100,000 project, that rises to €15,000 to €20,000 a year. And from year three onwards you often see a peak, driven by unavoidable large-scale refactoring of outdated parts.

Hourly rates for maintenance from Dutch developers range roughly from €75 to €150 excluding VAT for SME-focused providers, and €90 to €175 for niche agencies or specialist firms. Outside office hours (nights, weekends), providers typically charge one and a half to three times the standard rate.

For context on custom software itself, what it costs to have custom software built gives a broader picture.

Fixed price, hourly rate or a bank of hours?

You'll come across three contract models for software maintenance. Each has its own pitfalls.

Fixed price per month or year. You pay a fixed amount for a defined scope (for example: patching, hosting, monitoring and X hours of change work). Advantage: predictable. Disadvantage: maintenance that falls outside the scope costs extra.

Bank of hours (prepaid hours). You buy, say, 40 hours a month and draw every type of maintenance from that. Advantage: flexible. Disadvantage: if the bank runs dry halfway through the month and a production issue hits, you're under time pressure to approve extra budget.

Pure hourly rate with no retainer. You pay afterwards for every hour worked. Advantage: no minimum. Disadvantage: no priority. If your supplier has busy clients on fixed contracts, you go to the back of the queue.

Most SMEs are best served by a combination: a fixed base fee for patching, monitoring and availability, plus a bank of hours for actual development work. More on the bigger picture in SLAs for IT services: which agreements you should insist on.

What the SLA should cover

A good SLA for software maintenance is more than "we respond within 8 hours". It should include the following:

• Scope. Which application(s), which environments (production, staging) and which components (frontend, backend, integrations, hosting).
• Response times per priority. P1 (production down), P2 (critical function broken), P3 (annoying), P4 (cosmetic). And for each priority, a response time and a resolution time. Responding is not the same as resolving.
• Availability. Office hours only, or 24/7? Half of all SME applications don't need 24/7 cover, and that makes a big difference to the cost.
• Maintenance cadence. How often are dependencies updated, security patches applied and backups tested?
• Reporting. A monthly overview of changes made, hours, incidents and tickets.
• Escrow or code access. What happens to the source code if the supplier goes bankrupt or the contract ends? A source code escrow clause protects your access.
• Exit clause. What does it cost to switch to another provider? Is knowledge documentation handed over?
• Change control. How are changes requested, approved and invoiced?

For business-critical systems you'll also want an RTO/RPO in the SLA (Recovery Time Objective, Recovery Point Objective) and a rehearsed failover scenario. More on that in the disaster recovery plan for SMEs.

Maintenance and security: why postponing updates is expensive

The most underestimated cost in software maintenance is deferred security work. Every week you put off a critical library update, your attack surface grows. Known vulnerabilities in popular frameworks are exploited by attackers within days.

Preventive maintenance covers this. In practice:

• Dependency monitoring. Automated scans (Dependabot, Snyk, Renovate) that flag vulnerable libraries and prepare updates.
• Patch cadence. Critical patches within days, regular updates in a monthly cycle.
• Framework updates. Major versions at planned moments, not ad hoc.
• Security testing. Periodic code scans and, for business-critical applications, a periodic penetration test.

Go deeper with what patch management is and why it's crucial and the cybersecurity checklist for SMEs.

What you often see in the market: suppliers charge separate rates for "major upgrades" (for example, a new major version of your framework). With a good partner, that's included in the contract and carried out in small steps. With a reactive provider, you periodically receive a quote for a big chunk of work. That's a sign too little preventive work has been done.

Vendor lock-in: how to keep your freedom to switch

Software maintenance is a close relationship. Your supplier knows the codebase, the architecture and the history. That's useful for speed, but it makes switching difficult. To avoid lock-in:

• Source code in escrow. A contractual arrangement that gives you access to the code if the supplier goes bankrupt or terminates unilaterally.
• Documentation as a deliverable. System documentation, an architecture overview, deployment instructions and runbooks belong in the contract, rather than depending on one person.
• Standard stack. Software built on mainstream frameworks and languages can be handed over. An exotic framework or a proprietary development platform is a form of lock-in.
• Infrastructure ownership. If the hosting and accounts (cloud provider, domains, DNS) are in your company's name, you stay in control. If everything is in the supplier's name, you're dependent on them.

See also our checklist for choosing an IT partner, where the same principles apply.

When outsourcing software maintenance isn't the smart move

To be fair: not every situation calls for outsourcing. Outsourcing is a poor fit when:

• Your software will be replaced by an off-the-shelf package or SaaS within a year. Keeping it ticking over in-house with minimal effort is often cheaper in that case.
• You have a strong in-house development team with specialists who already know the codebase.
• The application is so critical and so specific that you'd effectively need a dedicated supplier on staff, and the cost of that eats up the added value of outsourcing.

For most SMEs, though, the arguments come down firmly in favour of outsourcing. Especially if the alternative is "we'll call when it breaks".

Frequently asked questions about outsourcing software maintenance

What does software maintenance cost per year on average? For custom software, the common guideline is 15 to 20 per cent of the initial development cost per year. Some sources put the lower limit at 10 per cent; for web applications you see ranges of 15 to 30 per cent. For a €60,000 application, that means roughly €9,000 to €12,000 a year. Complexity, integrations and the service level you need determine where you land in that range.

What is the difference between preventive and corrective software maintenance? Corrective maintenance is fixing bugs discovered after delivery. Preventive maintenance is proactive work to prevent future problems: dependency updates, refactoring, security patches and monitoring improvements. Companies with a lot of corrective work have often done too little preventive work.

What should an SLA for software maintenance include at a minimum? Scope, priority levels with response and resolution times, availability (office hours or 24/7), a maintenance cadence for patches and dependencies, monthly reporting, a source code escrow clause, an exit clause with documentation handover, and a change control process.

Can I combine software maintenance with workplace management at the same provider? Yes, and it has advantages: a single point of contact and shared insight into incidents and compliance. The downside is that you become more dependent on one supplier. For business-critical custom software, a specialist development partner is often the better choice, while general IT management can stay with a combined IT partner.

How do I avoid vendor lock-in with software maintenance? Make sure the source code is held in escrow, documentation is a contractual deliverable, the software is built on mainstream technology, and cloud accounts, domains and DNS are registered in your company's name. That way you stay in control and switching remains a realistic option.

Why do maintenance costs often rise after year three? Because larger refactoring rounds are needed by then (major framework versions, dated integrations, outdated architecture), and because three years of changes have made the codebase more complex. A supplier that does preventive maintenance well spreads those costs and avoids sudden spikes in your invoices; a reactive supplier lets the peak land in year three or four.

Conclusion

For most SMEs, outsourcing software maintenance is wiser than doing it yourself: it delivers continuity, a broader skill set and a structured approach to preventive work. Budget roughly 15 to 20 per cent of the build cost per year, expect a peak around year three, and set up an SLA with clear priority levels, escrow, an exit clause and a preventive cadence.

TRON Group works as a software engineering partner with SMEs on maintenance that goes beyond firefighting: a patch cadence, dependency monitoring, planned upgrades and clear reporting. Want to know whether your current contract still fits, or what a good maintenance plan for your application would cost? Call us on +31 85 303 5869 for a no-obligation conversation, or get in touch via the website. Moving IT Forward, even after the first release goes live.