What responsibilities should an outsourced IT department retain in-house?

The business should retain decisions that require commercial judgement, organisational authority or acceptance of risk, while the outsourced IT department retains responsibility for operating and maintaining the technology environment. This distinction prevents technical tasks from being confused with accountability: an IT provider can recommend, configure and manage a control, but the business remains responsible for deciding what it needs, what it can tolerate and which obligations it must meet.

Responsibilities the outsourced IT department should retain

• Technical monitoring and maintenance: monitoring infrastructure, identifying faults, applying approved updates, maintaining endpoint protection and keeping systems in a supported condition.
• Service desk and technical support: receiving and categorising incidents, resolving faults, assisting users with technical issues and escalating problems that require specialist investigation.
• Configuration and change implementation: preparing technical changes, testing them where appropriate, recording what was changed and managing the implementation in accordance with the agreed approval process.
• Backup operation and recovery administration: managing backup jobs, checking that they complete as expected, investigating failures and carrying out recovery procedures when authorised. The provider should also maintain evidence that backup and recovery activities have been performed.
• Security operations: reviewing alerts, investigating suspicious activity, managing technical security controls and preserving relevant evidence. The provider should have a defined process for escalating incidents that may involve legal, regulatory, financial or reputational consequences.
• Technical documentation: keeping accurate records of systems, configurations, dependencies, licences, privileged accounts and recovery procedures. Documentation should be updated as part of the work rather than recreated when a problem occurs.
• Technical supplier coordination: liaising with internet, hosting, software and hardware suppliers on faults or technical matters, while keeping the business informed where the issue affects cost, risk, service availability or contractual commitments.

These responsibilities should be supported by defined procedures and retained evidence. For example, it should be possible to establish who made a change, which account was used, what was altered, whether it was tested and how it could be reversed. This is particularly important where the provider has privileged access to business systems.

Responsibilities the business should retain

• Business priorities: deciding which systems and processes are most important, which projects take precedence and how technology supports operational objectives.
• Risk appetite: deciding whether a known risk is acceptable, requires treatment or should prevent a proposed change. The provider can explain the technical consequences, but should not silently make that decision on the organisation’s behalf.
• Budget and commercial approval: approving purchases, renewals, upgrades, consultancy work and changes to the service scope. The provider may recommend an option, but the business should control expenditure and understand any ongoing commitment.
• Data ownership: determining what data the organisation holds, how sensitive it is, who may access it and how long it should be retained. Technical controls can enforce those decisions, but they do not establish the organisation’s policy.
• Compliance accountability: identifying the laws, contractual terms, industry requirements and internal policies that apply to the organisation. An outsourced provider can supply technical evidence and advice, but accountability normally remains with the relevant business leaders.
• People and employment decisions: approving user access based on employment status and job responsibilities, authorising joiners, movers and leavers, and deciding how suspected misuse should be handled. IT should implement the instruction and preserve appropriate records; it should not independently determine an employee’s authority.
• Operational ownership: confirming which teams own each system, approving business process changes and deciding whether a temporary workaround is acceptable. Technical teams may restore a service, but the business determines whether the restored service is fit for use.

Security and continuity decisions need a clear split

During a security incident, the outsourced department should perform technical triage, contain affected accounts or devices when authorised, collect relevant information and explain the likely impact. The business should decide whether to notify customers, insurers, regulators, employees or other stakeholders, and should appoint the person with authority to coordinate the wider response. Legal advice and communications decisions should not be left to a technical support process.

A similar principle applies to continuity and recovery. The provider can maintain recovery procedures, test technical restoration and identify dependencies. Business leaders should define the priority of services, the acceptable operational disruption and the order in which functions need to return. Without those decisions, a technically successful recovery may restore the wrong system first or fail to meet the organisation’s practical needs.

Use approval rights rather than shared ambiguity

Responsibility is easier to manage when the arrangement identifies different types of authority. Routine, pre-approved maintenance can usually be carried out under an agreed procedure. Material changes should require approval from an authorised business representative. Emergency actions may need to happen before approval is available, but the conditions for taking them, the people who may authorise them and the records required afterwards should be specified in advance.

The same approach should be used for access. The provider may administer accounts and privileges, but the business should confirm who needs access and why. Privileged access should be limited to the work required, reviewed periodically and removed when it is no longer justified. The provider should be able to show what access it has used, while the business retains authority over the underlying business need.

Check the arrangement regularly

The division of responsibility should be reviewed when the organisation adds a location, adopts a new cloud service, changes its regulatory position, appoints an internal IT contact or changes a critical business process. A useful review asks:

• Who owns each system and related data?
• Who approves access, expenditure and significant changes?
• Who decides whether a risk or outage is acceptable?
• Who leads business decisions during a security or continuity event?
• What evidence must the outsourced department provide?
• What happens if the provider is unavailable, changes its scope or no longer holds the required information?

The strongest model is therefore not one in which the provider makes every technology decision, nor one in which the business attempts to perform technical operations without the necessary expertise. It is a controlled division: the outsourced IT department operates the technology and supplies informed advice, while the organisation retains authority over priorities, risk, data, people, compliance and commercial commitments.