Should You Outsource Your IT Support?

The Benefits and Risks of Using a Managed IT Support Provider

Technology is essential to most businesses.

Employees rely on computers, email, Microsoft 365, cloud applications, internet connections and business software throughout the working day.

When something stops working, productivity can quickly come to a standstill.

This leaves business owners with an important decision:

Should you manage IT internally, employ your own IT team or outsource your IT support to a managed service provider?

There is no single answer that is right for every organisation. However, outsourcing IT support can give small and medium-sized businesses access to a wider range of skills, technology and support than they may be able to maintain internally.

The important thing is choosing the right provider and understanding exactly what is included in the service.

What does outsourcing IT support mean?

Outsourcing IT support means using an external company to manage some or all of your business technology.

The provider is often known as a managed service provider, or MSP.

Depending on the agreement, an outsourced IT provider may be responsible for:

• Supporting employees
• Managing computers and laptops
• Creating and removing user accounts
• Managing Microsoft 365
• Installing applications
• Monitoring devices
• Managing software updates
• Protecting the network
• Monitoring backups
• Managing firewalls
• Supporting remote workers
• Providing cyber security services
• Planning future IT improvements

Some businesses outsource their entire IT operation. Others use an external provider to support an existing internal IT employee or team.

UK government business guidance identifies IT management and support as a specialist function businesses may choose to outsource, allowing smaller organisations to access skills without employing permanent staff for every requirement.

Why do businesses outsource IT support?

Many businesses first contact an IT provider because something has gone wrong.

Perhaps the server has failed, emails have stopped working or employees are repeatedly experiencing the same technical problem.

However, outsourced IT support should not only be about reacting to problems.

A good provider should also help prevent issues, improve security and plan for the future.

Common reasons for outsourcing include:

• The business has outgrown informal IT support
• Employees are losing time dealing with technical problems
• Nobody is responsible for cyber security
• The existing IT employee needs additional support
• The business cannot justify employing a full internal team
• Systems are becoming more complicated
• IT problems are affecting customer service
• The business needs support outside normal working hours
• Microsoft 365 is not being properly managed
• Backups and updates are not being monitored
• The organisation is preparing for growth

Outsourcing can turn IT from an occasional emergency into a planned and managed business service.

Access to a wider IT team

One of the main benefits of outsourcing is access to a broader range of knowledge.

A single internal IT employee may be very capable, but no one person can specialise in every area of technology.

Modern business IT can include:

• Microsoft 365
• Windows and macOS
• Servers
• Cloud services
• Networking
• Cyber security
• Backups
• VoIP telephone systems
• Mobile devices
• Compliance
• Business applications

An outsourced provider can have different people specialising in different areas.

A support engineer may resolve an employee’s computer problem, while a Microsoft 365 specialist reviews email security and a network engineer investigates a firewall issue.

This can be particularly useful when the business experiences an unusual or complex problem.

More predictable IT costs

Employing an internal IT team involves more than paying salaries.

The business may also need to consider:

• Recruitment costs
• Employer National Insurance
• Pensions
• Training
• Holidays
• Sickness cover
• Management time
• Specialist software
• Monitoring systems
• Security tools

• Out-of-hours cover

  An outsourced service is normally charged as a monthly fee, often based on the number of users, devices or sites being supported.

This can make IT costs easier to predict.

However, businesses should check exactly what the monthly fee includes.

Some providers include projects, site visits and security services. Others charge separately for anything outside basic remote support.

The cheapest monthly price may not represent the best value if the business is regularly charged additional fees.

Support when your usual IT contact is unavailable

Relying on one person can create a problem when they are:

• On holiday
• Off sick
• Attending training
• Working on another urgent issue
• Outside normal working hours

Technology problems do not always wait until the right person is available.

An outsourced IT provider should have a team capable of continuing the service when individual engineers are unavailable.

This can improve continuity and reduce the risk of an important issue being left unresolved because one person is away.

Before signing an agreement, ask the provider about its staffing levels, escalation process and out-of-hours arrangements.

Faster response to IT problems

When employees experience repeated technical problems, they often develop their own workarounds.

They may restart the computer, use a personal email account, save information locally or ask a colleague for help.

These workarounds can waste time and sometimes create security or data-protection risks.

A managed IT provider gives employees a defined way to request support.

Depending on the service, they may be able to contact the provider by:

• Telephone
• Email
• Support portal
• Desktop application
• Microsoft Teams
• Automated device alert

The provider can record the issue, assign it to the correct person and track it until it has been resolved.

Over time, support records can also highlight recurring problems that need a permanent solution.

Proactive monitoring

Traditional IT support often works on a break-and-fix basis.

The business waits for something to stop working and then pays somebody to repair it.

Managed IT support should be more proactive.

Monitoring systems can identify issues such as:

• Low disk space
• Failed backups
• Missing security updates
• Antivirus problems
• Offline devices
• Failing hardware
• Server warnings
• Expiring certificates
• Unusual network activity
• Devices that have stopped reporting

Finding these warning signs early can help the provider resolve problems before they develop into major disruption.

For example, identifying that a server is running out of storage is much better than waiting until it can no longer save information or run an important application.

Improved cyber security

Cyber security is one of the main reasons businesses consider outsourcing their IT.

Small and medium-sized organisations may not have the internal resources to monitor security alerts, review vulnerabilities and keep up with new threats.

A managed provider may help with:

• Multifactor authentication
• Microsoft Defender
• Endpoint protection
• Email security
• Firewall management
• Software updates
• Device encryption
• Security monitoring
• Backup protection
• Administrator access
• Employee security training
• Incident response

However, outsourcing IT does not automatically make a business secure.

The quality of the protection depends on the provider’s knowledge, procedures, tools and the services included in the contract.

The National Cyber Security Centre recommends that organisations choose providers that clearly explain their services, responsibilities and approach to security incidents. It also highlights the importance of open communication and a swift response when an incident occurs.

Microsoft 365 management

Many businesses purchase Microsoft 365 licences but do not properly manage the security and administration behind them.

Microsoft 365 management can include:

• Creating and removing users
• Managing licences
• Configuring multifactor authentication
• Protecting administrator accounts
• Managing email security
• Reviewing suspicious logins
• Managing SharePoint permissions
• Configuring Microsoft Teams
• Managing mobile access
• Applying retention policies
• Monitoring security alerts
• Protecting business devices through Intune

An outsourced provider can help ensure Microsoft 365 is treated as a business system rather than simply a collection of email accounts.

This is especially important when employees join or leave the organisation.

A proper process should make sure that access is provided promptly to new employees and removed from people who no longer work for the business.

Supporting business growth

Technology that works for a company with five employees may not be suitable when it grows to 25, 50 or 100 employees.

As the business grows, it may need:

• More structured user access
• Better cyber security
• Improved file storage
• More reliable internet connectivity
• Additional Microsoft 365 services
• Formal onboarding and offboarding
• Device-management policies
• More advanced backups
• Multiple office connectivity
• Better reporting

An outsourced IT provider should help the business plan for these changes.

This could include creating an IT roadmap that identifies systems approaching the end of their supported life, future projects and likely areas of investment.

Without planning, businesses can find themselves making rushed technology decisions only after something has failed.

Can you outsource only part of your IT?

Outsourcing does not have to mean replacing the internal IT team.

Many businesses use a co-managed IT arrangement.

In this model, the internal team and external provider share responsibilities.

For example, an internal IT manager may handle:

• Day-to-day business systems
• Internal projects
• Relationships with employees
• Application knowledge
• Technology strategy

The outsourced provider may handle:

• First-line employee support
• Out-of-hours support
• Cyber security monitoring
• Microsoft 365
• Network management
• Holiday cover
• Specialist projects

This gives the internal team additional capacity and specialist support without removing their knowledge of the business.

The responsibilities should be clearly documented so employees know who to contact and tasks do not fall between the two teams.

What are the risks of outsourcing IT?

Outsourcing can provide considerable benefits, but it also introduces risks that need to be managed.

An IT provider may have privileged access to:

• Employee computers
• Microsoft 365
• Business files
• Email accounts
• Servers
• Backups
• Firewalls
• Cloud services

This level of access means the provider must be carefully selected.

The NCSC explains that when an MSP administers cloud services, it becomes another participant in the shared-responsibility model and may retain highly privileged access.

Businesses should therefore ask how the provider protects its own systems and administrative accounts.

This may include:

• Multifactor authentication
• Individual engineer accounts
• Restricted administrator permissions
• Security monitoring
• Staff background checks
• Password-management systems
• Access logging
• Cyber insurance
• Incident response procedures
• Secure remote-access tools

You should not hand over control of important business systems without understanding how that access will be secured.

Losing internal knowledge

An external provider will not initially understand your organisation as well as someone who works inside the business.

They may not know:

• Which applications are most important
• Which employees have unusual requirements
• When the busiest periods occur
• Which systems cannot tolerate downtime
• How different departments work
• Which older applications have special requirements

A good provider should take time to document the environment and understand the business.

The relationship should improve as the provider gains knowledge and maintains accurate technical documentation.

Businesses should also retain access to their own information.

Important passwords, licences, system documentation and configuration details should not exist only inside the provider’s systems.

Becoming too dependent on one provider

An outsourced provider may manage a large part of your technology.

This can make changing providers difficult if systems have not been properly documented or the business does not control its own accounts.

The business should remain the owner of:

• Its domain names
• Microsoft 365 tenant
• Cloud subscriptions
• Software licences
• Administrator accounts
• Business data
• Backup information
• Technical documentation

The provider may administer these systems, but ownership should remain clear.

You should also understand what happens when the contract ends.

The provider should have a documented exit process covering the transfer of passwords, documentation, licences, backups and administrative access.

Data protection responsibilities

An IT provider may access or process personal information while supporting your systems.

This can include employee information, customer records, emails and files.

The Information Commissioner’s Office states that when an organisation uses a processor to process personal data on its behalf, there must be a written contract covering that processing.

The agreement should clearly explain matters such as:

• How personal information is used
• Confidentiality requirements
• Security measures
• Use of subcontractors
• Assistance with data breaches
• What happens to data when the contract ends

ICO guidance also states that processor contracts must include appropriate security obligations and provisions for returning or deleting personal data at the end of the arrangement.

Outsourcing a system does not mean outsourcing all responsibility for the information held within it.

The business still needs to carry out appropriate checks and manage the supplier relationship.

Will outsourced support understand our business?

A common concern is that an outsourced helpdesk will treat every customer in exactly the same way.

This can happen when the service is based entirely on volume and engineers have little opportunity to learn about individual organisations.

A good provider should understand:

• What your business does
• Which systems are critical
• Who your key contacts are
• Which employees require priority support
• Your opening hours
• Your security requirements
• Your future plans
• The impact of downtime

The service should feel like an extension of your business rather than an anonymous call centre.

This requires good account management, documentation and regular communication.

What should be included in an IT support agreement?

The contract or service agreement should clearly explain what the provider will and will not do.

It may include:

• Supported users and devices
• Support hours
• Response targets
• Remote support
• Site visits
• Server management
• Microsoft 365 management
• Network support
• Cyber security services
• Backup monitoring
• Software updates
• Third-party application support
• Projects and installations
• Reporting
• Account management
• Data-protection terms
• Exit arrangements

Pay particular attention to the difference between a response time and a resolution time.

A provider may promise to respond to an issue within a certain period, but this does not necessarily mean the problem will be resolved within that time.

Some issues depend on hardware suppliers, software developers, internet providers or other third parties.

The provider should explain how urgent issues are prioritised and escalated.

Questions to ask an outsourced IT provider

Before selecting a provider, ask questions such as:

• What is included in the monthly price?
• Which services cost extra?
• What are your support hours?
• Do you provide emergency or out-of-hours support?
• Where is your support team based?
• How many engineers do you have?
• How do you protect administrator accounts?
• Do you monitor backups and security alerts?
• How do you manage Microsoft 365?
• Are software updates included?
• How are support requests prioritised?
• Will we have a regular account review?
• Who owns our licences and accounts?
• What cyber security standards do you follow?
• Do you use subcontractors?
• What happens if we decide to leave?
• How will our data and documentation be returned?

The provider should be able to answer these questions clearly.

Complicated answers, unclear charges or reluctance to discuss security should be treated with caution.

Is outsourced IT support cheaper?

Outsourcing can be less expensive than employing a complete internal IT team, particularly for a small or medium-sized business.

However, cost should not be the only consideration.

A very cheap service may offer:

• Limited support hours
• Long response times
• Minimal proactive work
• No cyber security monitoring
• Additional charges for common tasks
• Little understanding of the business
• Limited access to senior engineers

The real value should be judged by the provider’s ability to reduce downtime, protect the business and help employees work effectively.

A slightly higher monthly fee may represent better value if it includes security tools, monitoring, account management and a more responsive service.

When should you keep IT support in-house?

Internal IT may be more suitable when:

• The organisation is large enough to employ a complete team
• Technology is central to the company’s product
• Systems require constant on-site attention
• The business has highly specialist applications
• Internal knowledge is particularly important
• Regulatory requirements demand greater direct control
• The organisation already has mature IT and security departments

Even in these situations, the internal team may still outsource selected services such as 24/7 security monitoring, specialist projects or holiday cover.

The decision does not always need to be entirely internal or entirely outsourced.

Signs your business may need outsourced IT support

It may be time to consider outsourcing when:

• Employees regularly wait for technical problems to be resolved
• The owner has become the unofficial IT department
• Nobody checks whether backups are working
• Microsoft 365 has never been reviewed
• Employees share passwords
• Old computers are still being used
• Software updates are repeatedly postponed
• There is no cyber security plan
• IT costs are unpredictable
• Important knowledge is held by one person
• The business is planning to grow
• Technical problems are affecting customers
• There is no support when the usual IT person is unavailable

These are signs that technology is no longer being managed in a structured way.

Should you outsource your IT support?

For many small and medium-sized businesses, outsourcing IT support can be a sensible choice.

It can provide:

• Access to a wider team
• More predictable costs
• Better continuity
• Faster support
• Proactive monitoring
• Improved cyber security
• Better Microsoft 365 management
• Support for future growth

However, outsourcing should not mean handing over responsibility and forgetting about IT.

The relationship works best when the provider and business communicate regularly, responsibilities are clearly defined and both parties understand the organisation’s priorities.

The provider should protect your systems, explain its recommendations and help you make informed decisions.

How can Hamilton Group help?

At Hamilton Group, we provide managed IT support and cyber security services for businesses that want reliable technology without the cost and complexity of building a complete internal IT department.

We can help with:

• Day-to-day employee support
• Microsoft 365 management
• Computer and laptop management
• Server support
• Network and firewall management
• Software updates
• Backup monitoring
• Cyber security
• 24/7 security monitoring
• Cloud services
• VoIP telephone systems
• IT projects
• Technology planning
• Co-managed IT support

We take time to understand how your organisation works and which systems are most important.

Our aim is not simply to fix problems when they happen.

We help businesses reduce downtime, improve security and make better use of their technology.

If you are considering outsourcing your IT support, Hamilton Group can review your current setup and explain the options available.

Call us on 0330 043 0069 or book an appointment with one of our experts.