A critical application to maintain?
Third-party application maintenance (TMA, from the French tierce maintenance applicative) means entrusting the maintenance and evolution of existing applications to an external provider: fixing defects, delivering functional changes, adapting to the technical environment and providing support, under service levels defined in a contract. This guide explains the scope of a TMA contract, the contract models, the indicators to demand and the steps of a successful takeover.
What is third-party application maintenance?
“Third-party” means the maintenance is carried out by a party other than the team that built the application. TMA covers the software itself: its code, its features and its application data. It does not normally cover infrastructure (servers, networks, workstations), which falls under managed infrastructure services.
Companies typically turn to TMA in four situations: the internal team spends more time on incidents than on the roadmap, the original developer has left, a critical application needs to be stabilised, or the company wants to turn an unpredictable cost into a measured service.
The four types of maintenance
The usual terminology follows the ISO/IEC 14764 standard, which distinguishes several categories of software maintenance.
- Corrective maintenance: analysis and correction of defects and production incidents, through to closure.
- Evolutive maintenance: new features and business adaptations, prioritised with your teams.
- Adaptive maintenance: adapting the application to changes in its environment: operating system, database, browsers, interfaces with other applications, regulation.
- Preventive maintenance: work done before an incident occurs: security updates, refactoring, technical debt reduction, monitoring.
Support levels: L1, L2 and L3
- Level 1: intake, qualification of the request and resolution through documented procedures. It is often handled by the client’s own service desk.
- Level 2: application-level analysis, reproduction of the problem and routine fixes. It requires good knowledge of the application.
- Level 3: deep expertise, changes to the code, resolution of root causes and handling of architecture problems.
In a TMA contract, the provider generally takes on levels 2 and 3, and sometimes level 1.
TMA, managed infrastructure, operational readiness: do not mix them up
Managed infrastructure (infogérance in French) concerns running the infrastructure. TMA concerns applications. Operational readiness (MCO, maintien en condition opérationnelle) covers all the activities that keep a system operational; depending on the contract, it may include TMA. Finally, “run” covers operating and maintaining a system in production, as opposed to “build”, which covers new projects.
Fixed price, time and materials, work units: which contract model?
- Fixed price: the provider commits to an application scope and to service levels for a fixed monthly or annual price. This model suits predictable, measurable activity.
- Time and materials (staff augmentation): engineers are made available to you and billed for the time spent. Flexibility is maximal, but the provider commits to means, not to results.
- Work units: billing depends on the number of tickets or the volume of work handled. This model fits variable volumes, provided the unit is clearly defined.
- Mixed: a fixed base for support and fixes, completed by a time-and-materials budget for evolutions. It is often the best compromise.
To choose, ask yourself two questions: is the scope stable and measurable? Can you manage the resources yourself? If the scope is stable and you cannot manage the resources, fixed price is the best fit. If the need keeps changing, time and materials or the mixed model suit better.
The service levels (SLAs) to demand
Without measurable service levels, you have no way of knowing whether the service is actually delivered. The most useful indicators:
- the acknowledgement time for an incident;
- the workaround time and the resolution time, depending on severity (blocking, major, minor);
- the coverage window: business hours or extended on-call;
- the compliance rate with the agreed times;
- the recurrence rate of incidents and the number of regressions after delivery;
- business user satisfaction.
These indicators must be measured the same way by both parties, reported monthly and reviewed in a regular steering committee. Set realistic thresholds: an unrealistic SLA pushes people to work around the rules instead of improving quality.
Taking over an existing application: the steps
- Scoping and audit: inventory of applications, dependencies and environments, assessment of code quality, documentation and tests.
- Knowledge transfer: workshops with the outgoing team, collection and updating of documentation, access to development, test and production environments.
- Gradual takeover: the provider first observes, then acts under supervision, then takes over. This ramp-up avoids discovering risks in production.
- Operation and continuous improvement: handling of requests according to the SLAs, reporting and a plan to reduce technical debt.
The duration of the takeover depends on the size of the application and the quality of its documentation. The main risks are dependence on a single person, the absence of automated tests and environments that cannot be reproduced. An initial audit measures them before you commit to service levels.
Reversibility: plan it from signature
Reversibility ensures that you can change provider or bring maintenance back in-house without losing knowledge of the application. Provide in the contract for:
- handover of the source code, its history and the access rights;
- up-to-date documentation: architecture, operating procedures, a record of known incidents;
- a support period for the handover, with a defined duration and price;
- ownership of the code and deliverables, assigned in writing.
Nearshore TMA from Tunisia
For a European company, entrusting TMA to a team in Tunisia offers several advantages: a compatible time zone (0 to 1 hour difference with France), French-speaking and English-speaking teams, under three hours by air for on-site meetings and costs that are more predictable than local hiring. Hydatis combines a presence in France with an engineering centre in Tunisia. Discover our application maintenance (TMA) services and our IT outsourcing and dedicated teams from Tunisia.
Three points demand rigour:
- Organisation: a referent on the client side, a service manager on the provider side, a weekly check-in and a monthly committee.
- Security: named accounts, access limited to what is necessary, non-disclosure agreements and traceability of actions.
- Personal data: transfers outside the European Union require appropriate safeguards. Have your data protection officer validate the arrangement.
Ten questions to ask before signing
- What is the exact scope: applications, environments, technologies, volumes?
- Which support levels do you cover, and during which hours?
- Which SLAs do you offer, and how are they measured and reported?
- How does the takeover work: duration, deliverables, team involved?
- Who are the people assigned, and what is your turnover rate?
- How do you ensure continuity when an engineer is absent?
- What billing model do you use, and what happens if the scope is exceeded?
- Which reversibility and code ownership clauses do you provide?
- Which security policy do you apply: access, workstations, backups, personal data?
- Can you provide references on comparable applications?
Frequently asked questions about TMA
What is the difference between TMA and in-house maintenance?
With in-house maintenance, your own teams handle support and fixes. With TMA, a provider does it under contractual service levels, which frees your teams to work on the roadmap and secures service continuity.
How much does a TMA contract cost?
The cost depends on the scope, criticality, technologies, service levels and contract model. Ask for a quote based on an audit of the existing application, and be wary of a price given without a precise scope.
Can you outsource the maintenance of an old or poorly documented application?
Yes. The takeover starts with an audit and an observation period. Maintenance is then accompanied by a gradual modernisation, without a risky cut-over, to reduce technical debt.
How long is a TMA contract?
Contracts are often multi-year, with a reversibility clause and the possibility to adjust the scope. The term should leave time to amortise the takeover while preserving your freedom to change provider.
Does TMA suit cloud and SaaS applications?
Yes. It applies to any application, whether hosted on-premises or in the cloud, including your own SaaS platforms: defect fixing, updates, evolutions and support.