Software maintenance cost in Malaysia: what an AMC should cover

Most software quotes in Malaysia end with one of two lines: “AMC: 15% of project cost per year”, or “one year free maintenance”. Very few say what either one buys, or what software maintenance should really cost.

If your system has run fine for years, maintenance can look like money for nothing. But much of what maintenance is for happens outside your system. In October 2026, for example, PHP shipped an urgent fix for two flaws that let attackers take over web servers. Installing it was nobody’s job unless someone’s contract said so. What PHP2Shell means for your website or system covers that one.

What “maintenance” usually means in a quote

An AMC (annual maintenance contract) is a yearly fee for looking after a system once it is live. “Free maintenance for 12 months” usually means something narrower: the developer fixes bugs in what they built, for a year. Neither phrase tells you whether anyone updates the server, checks the backups or answers the phone on a Saturday.

So treat the word “maintenance” as a heading, and ask for the list under it.

What a good contract covers

1. Security and platform updates. The language, framework, database and server the system runs on all get security fixes, and someone has to install them. For apps, the App Store and Google Play raise their rules every year.
2. Monitoring. Who finds out first when the system is down or slow: you, your customers or your vendor?
3. Backups, with a tested restore. A backup nobody has restored is a hope, not a backup. Ask when a restore was last tested.
4. Bug fixes, measured against what was agreed and accepted. A change to how something works is a different thing. What happens after go-live sets out the difference.
5. Certificates and domains. Website certificates now expire about twice a year. Renewal should be automatic and someone should watch it. More in why a working system can still be a risk.
6. Response times and hours, in writing. For example: business hours, a reply by the next business day, and what counts as urgent.
7. A regular report: what was checked, what was updated and what needs a decision.
8. Telling you about a breach. Malaysia’s breach guideline expects a vendor who runs a system for you to tell you promptly, and your contract to say so.^⁠[1]
9. A clean exit. The code, hosting and accounts stay in your company’s name, and the contract says what the vendor hands over if you leave. Who should own the code, hosting and accounts? covers what to hold.

What it usually leaves out

• New features and changes to how the system works.
• Third-party fees: hosting, software licences, app store accounts, SMS and email services.
• Work outside the agreed hours, unless you pay for cover.
• Problems someone else caused, such as another vendor’s change or a staff member deleting records.

None of these are unreasonable to leave out. They just need to be written down, so nobody is surprised.

What software maintenance costs

A common rule of thumb is to budget 15 to 25% of the build cost every year to keep a system running and changing.^⁠[2] For a RM100,000 system, that is RM15,000 to RM25,000 a year.

The catch is what that budget includes. In the same breakdown, new features and improvements make up 40 to 60% of it, and keeping up with technical changes such as upgrades another 20 to 30%. Fixing bugs is the smallest part.^⁠[2]

So an AMC at 15% that only covers bug fixes is not the same as a 15% budget. The upgrades and the changes the business keeps asking for will still need paying for. Our guide to software costs in Malaysia has the build ranges this percentage applies to.

Warning signs

• “Maintenance” with no list. If it isn’t written down, it isn’t included.
• No response time. “We will attend to it” is not a response time.
• The vendor holds the hosting account or domain in their own name.
• “Unlimited changes”. No team can deliver unlimited work. Something gets rationed, usually quietly.
• Free maintenance that ends just as the updates start. Platform rules and end-of-support dates arrive every year, often after the first.

Questions to ask before you sign

1. What exactly is included, item by item?
2. Who installs security updates on the server, and how quickly after a fix comes out?
3. When was a backup last restored, and who checked it?
4. What are the hours and response times, and what counts as urgent?
5. Is a bug fix included when the bug was in the original work? Is a change?
6. Whose name are the hosting, domain and app store accounts in?
7. What do you hand over if we end the contract?

Common questions

Is one year of free maintenance normal?

It is common, and it usually means bug fixes in what was built. Ask whether it also covers updates to what the system runs on. Those are the part that keeps arriving whether or not anything is broken.

Can a different company maintain a system someone else built?

Yes, once they understand it. That is a takeover. It starts with access, a look at how the system is built and released, and a list of what it runs on. Taking over software from another vendor covers what to check first.

Our system is only used inside the office. Do we still need maintenance?

Less, but not none. Internal systems still hold customer and staff data, and many are reachable from outside through remote access or an app. Updates and backups still matter.

What is the typical yearly maintenance fee for software?

The common rule of thumb is 15 to 25% of the build cost a year, for keeping the system running and changing.^⁠[2] A contract priced at the low end of that usually covers bug fixes, not upgrades or changes.

How we do it

We don’t sell a percentage. Looking after a system we know is Software Care, from RM1,500 a month: monitoring, health and backup checks, putting back what used to work, and a monthly report, with a reply by the next business day. It comes with Managed Delivery, included from RM19,000, or after a Custom Project we built. We don’t offer it for a system we haven’t worked on. Changes and upgrades go through Managed Delivery, one priority at a time.

For TCE Baby, that meant releases, QA, patches, infrastructure and support during the expos themselves, across more than 72 releases.

Before you sign a maintenance contract

Send us the quote or contract you have been given. For RM1,000, a Decision Review tells you in writing what it covers, what it leaves out and what to ask for before you sign.

You then pay for maintenance knowing what you are getting. And you don’t find out, on the day of the next urgent update, that nobody was meant to install it.