What happens if our outsourced IT provider becomes unavailable?

If an outsourced IT provider becomes unavailable, the impact depends on the reason for the disruption and how much operational control remains with the business. A short-term interruption may affect support requests and routine administration, while insolvency, a serious cyber incident or the loss of key personnel can create wider problems involving access, suppliers, compliance and service continuity.

The first step is to establish which services are affected and which remain under the organisation’s direct control. This should include connectivity, cloud platforms, user accounts, endpoint management, telephony, line-of-business applications, domain registration, software subscriptions and third-party suppliers. Separating provider-managed services from independently managed services helps the business prioritise action rather than treating every technology issue as one problem.

A resilient outsourcing arrangement should address the following areas before an incident occurs:

• Contractual continuity: The agreement should explain what happens if the provider stops trading, loses access to its own systems or can no longer deliver the contracted services. It should set out notification duties, cooperation requirements and the practical steps for transferring responsibility.
• Ownership and portability: The business should retain ownership of its data, configurations, licences where applicable and business records. The contract should specify usable formats and procedures for retrieving this information without depending on the provider’s proprietary tools.
• Third-party relationships: Responsibility for cloud platforms, internet services, software vendors and hardware suppliers should be clear. Where accounts are held in the provider’s name, the business should understand the risks of losing access or being unable to renew a service.
• Financial and legal protections: Businesses should review termination rights, data-processing terms, insurance requirements, subcontracting arrangements and the provider’s obligations if it enters administration or changes ownership. Legal advice may be appropriate for significant or regulated environments.
• Alternative support arrangements: A named fallback provider or internal escalation route can reduce dependence on one organisation. The alternative should be assessed in advance, particularly if it would need privileged access or specialist knowledge.

Access governance is also important. Administrative accounts should be linked to the business rather than controlled exclusively by an individual supplier employee. Appropriate internal stakeholders should know how access is approved, revoked and audited. Credentials should not be exchanged through informal channels, and privileged access should be reviewed when the provider relationship changes. This protects the organisation from both accidental lockout and unauthorised continued access.

Businesses should maintain a current record of key suppliers, contract owners, renewal dates, service dependencies and escalation contacts. This is different from keeping technical documentation: it gives decision-makers the commercial and operational information needed to appoint replacements, prevent subscription lapses and communicate with affected parties. The record should be reviewed when services, staff or suppliers change.

If unavailability occurs, a sensible response is to:

1. Confirm whether the issue is a local service interruption, a provider-wide incident, a security event or a permanent loss of service.
2. Identify the systems that are business-critical and determine whether the organisation still has legitimate administrative control over them.
3. Contact relevant platform, connectivity and software suppliers directly where the contract permits it.
4. Protect accounts and information by reviewing privileged access, suspending unnecessary access and preserving relevant records.
5. Activate the agreed fallback support arrangement and give the replacement team a controlled, prioritised view of the environment.
6. Record decisions, communications and changes so that the organisation can demonstrate appropriate governance and improve its continuity plan afterwards.

The response should be proportionate to the cause. If the provider is temporarily unreachable, changing suppliers immediately may create unnecessary risk. If there are signs of insolvency, unauthorised access or a security compromise, the business may need to involve legal, financial and cyber-security specialists while preserving evidence and protecting regulated or personal information.

Outsourcing does not remove the customer’s responsibility for understanding its technology dependencies. Before appointing a provider, a business should test whether it could identify critical services, regain control of important accounts and engage alternative expertise if the relationship ended unexpectedly. An outsourced IT services partner should support that resilience through clear governance, transparent service ownership and an exit process that remains practical even under pressure.