Due Diligence – How to Successfully Outsource Your IT Needs

1. Due Diligence – How to Successfully Outsource Your IT Needs Small and medium sized businesses are almost always constrained by budgets when it comes to specific business needs – especially when it comes to IT. An experienced and qualified network administrator can easily demand a salary over $120k, and in a small business environment will not always be engaged enough to earn that salary. In these cases, it is common for the small business owner to outsource their IT needs to reduce costs. But how do you know if the company you hire is qualified for the job you need them to do? And how do you know if you are getting value for money? Doing your due diligence on the people who have access to your systems and data is more important than ever. The first step in deciding if and how to outsource your IT needs is, like most other business decisions, weighing the risks vs. benefits of doing so. The following benefits and risks might help you decide on what to look at. Benefit #1: Saving Money This is the most compelling reason to outsource IT services. Outsourcing helps to control capital outlay. Businesses that choose not to outsource will have a fixed expense for this service every month, while those who choose to outsource convert that fixed expense into a variable one. This allows for capital to be used in other areas, which is especially important in the first months and years of a business. Benefit #2: Controlling Expenses Businesses that choose to perform IT operations themselves must pass on the expense associated with these activities to their clients and customers. Outsourcing IT services to a company that specializes in business networking and support services alleviates some of this expense, allowing the business to gain an advantage in competitive pricing of services. Benefit #3: Focus on Core Operations Outsourcing IT services allows business managers to concentrate on core goals and objectives. While some managers may have to split their time and energy between growing the business and managing other operations like IT, outsourcing can help to alleviate this conflict. Managers who can spend more time on core business objectives will always be more successful. Benefit #4: Level the Playing Field Many small businesses are not able to afford the resources necessary to implement IT systems and services like those of larger businesses. Large businesses have the resources to maintain cutting edge systems and services themselves. Outsourcing creates a more equitable playing field between small firms and large enterprises. Risk #1: Potential Downtime Relying on outside services runs the risk of downtime during critical systems failures, leading to loss of productivity. Without a favourable service level agreement (SLA), it may take several days for an

2. IT contractor to devote the attention needed to restore your system. This can leave staff idle and lead to lost revenue. Risk #2: Losing the Personal Touch A full-time IT and network administrator will get to know your system intimately and will be able to recognize when something is amiss. This can help to identify a problem before it becomes a catastrophe, saving your business a costly headache. Outsourcing cannot provide the personal touch that comes with an in-house expert Risk #3: Standards and Security Policies Anyone considering outsourcing their IT needs must undertake a risk assessment that includes a thorough investigation of the potential provider’s security protocols. Opening up your data and networks to a company whose employees have not been properly vetted is a disaster waiting to happen and is the epitome of an insider threat risk. Your due diligence must include thorough scrutiny of how the service provider manages their employees, and a list of exactly who will have access to your systems. Risk #4: Administrator Privileges Many IT services and network protocols require elevated privileges to complete. Giving anyone administrator rights to your system should be a carefully considered decision. You also need to ensure you have at least one person on staff, probably a senior manager, that also keeps administrator access in order to revoke someone else’s privileges if necessary. Even if that is all they know how to do, it is important that you retain that minimum amount of control. Whether you decide to outsource your IT services or not, it is important to note that you and your staff are still responsible for maintaining due diligence when using the internet and accessing sensitive data. Outsourcing does not mean that we can forget about security because someone else is managing the system. A robust cyber awareness training program and policies are still essential in protecting your systems and data. Also remember that if you do outsource, you still call the shots. If you have concerns about a managed providers services, access levels, security policies, staff, or anything else, don’t hesitate to question them. It’s your business on the line at the end of the day. Read more at https://silocompliance.com/q1-due-diligence-how-to-successfully-outsource-your-it- needs/