Four models of IT outsourcing
"IT outsourcing" can mean very different arrangements. They differ mainly in who monitors your systems, who acts during an outage and who is accountable for the result:
| Model | Who monitors systems | Who acts during an outage | Typical use |
|---|---|---|---|
| Fully managed IT (MSP) | The provider, continuously | The provider, under the SLA | Companies without IT staff that need reliable operations |
| Co-managed IT | The provider and your IT person | Whoever the responsibility matrix names | Companies with one system administrator or a small team |
| Ad-hoc support (break-fix) | Nobody | A technician, when available | Very small, non-critical cloud environments |
| In-house IT team | Your employees | Your employees, when available | Larger companies with a lot of specific on-site work |
No model is best for everyone. The key difference is between proactive and reactive work. A managed service provider is paid to keep systems running; a break-fix technician is paid to repair them once they stop. With the first, preventing problems is in the provider's interest. With the second, it is not.
What decides the right model
- Sites and countries. One office with a cloud environment is a very different job from warehouses and branches in several countries, where the network and identities must be managed as one and someone has to turn up on site.
- Criticality and support hours. If production or logistics stops during an outage, you need continuous monitoring, guaranteed resolution times and clear out-of-hours coverage. Ad-hoc support does not provide that.
- Your own people. Without IT staff, fully managed IT is usually the right choice. With a single system administrator, the biggest risk is dependence on one person, so co-managed IT works well: your colleague stays and the partner adds depth, security and cover.
- Regulation. Entities under NIS2, financial firms under DORA and anyone processing large volumes of personal data need a provider that can demonstrate its security measures and put them into the contract.
Compare the cost of each model separately with the managed IT services cost calculator. This guide focuses on choosing the model and judging the quality of the provider.
What a good managed service provider delivers
Judge providers on evidence, not promises. These are the questions to ask an MSP:
- An SLA with response and resolution times. A response time only tells you when someone picks up. What matters is how quickly the problem is fixed, by priority and with clear consequences when targets are missed. Before you ask for an availability percentage, use the SLA and uptime calculator to see how much downtime it actually allows.
- A security baseline as standard. MFA for all accounts, EDR on devices and servers, regular patching, backups with regular restore tests and continuous monitoring. Ask when a restore was last tested.
- Reporting. A monthly review of tickets, SLA performance, patch status and recommendations shows whether the provider really manages your environment.
- Escalation and expertise. A named contact, a technical lead and partnerships with the vendors you use, such as Microsoft and Fortinet.
Cybersecurity is not just a technical topic but a management responsibility. A good partner helps you understand risks and decide on them, not just install tools. The same applies to new technology: before you roll out AI tools, have the partner review access rights, data and security, because such tools can see everything a user has access to.
Ownership, the IT support contract and regulation
The most common mistake in IT outsourcing is losing control of your own environment. Admin accounts, passwords, domains, licences and cloud tenants must be in your company's name, and you must hold the emergency access yourself. The documentation of the environment (asset inventory, network diagrams, configurations) must be available to you at all times, not only when the contract ends.
An MSP has access to e-mail, files and systems containing personal data, so under the GDPR it acts as a processor. The data processing agreement under Article 28 GDPR must, among other things, state that the provider engages further processors only with your written authorisation and that, at your choice, it returns or deletes the data when the services end.
The NIS2 Directive (EU) 2022/2555 lists supply chain security, including the relationships with direct suppliers and service providers, among the required risk-management measures, and expects entities to consider the quality of their suppliers' cybersecurity practices. The directive notes that managed security service providers have themselves been targets of cyberattacks and, because they are closely integrated into their customers' operations, pose a particular risk, so it calls for increased diligence when selecting one. It also lists managed service providers as a sector of high criticality (Annex I), so medium-sized and large providers usually fall under NIS2 themselves.
The IT support contract should also cover the scope and what is billed separately, the notice period, an exit plan and the provider's obligation to support the transition to another provider.
Sites in several countries
For companies with sites in Slovenia, Croatia, Serbia and elsewhere in the Balkans, the key question is who will turn up when a switch fails in the warehouse. Ask for named contractors in each country, support in the local language and unified management of the network and identities from one point.
Humanfrog, for example, maintains the network of a company with sites in every Balkan country: its Fortinet network with SD-WAN is connected to a central point we manage, so monitoring, security policies and changes are consistent across all sites. For the logistics company Alfa SP, which operates in Slovenia, Croatia and Serbia, we have managed the IT environment for five years, with 40 active users at six sites: we moved e-mail and documents to Microsoft 365, set up access management, automated backups and central monitoring, and migrated the servers to the cloud.
If you are opening a subsidiary in another Balkan country, also read the guide to IT for Balkan subsidiaries.
Switching IT provider without downtime
If you are unhappy with your current provider, do not terminate the contract until you have an inventory of the environment, all admin credentials and the documentation. Plan the switch within the notice period, with an overlap:
- Days 1–30: inventory, access taken over in the company's name, monitoring tools deployed and a test restore from backup.
- Days 31–60: the new provider takes over user support and monitoring and closes the most urgent security gaps.
- Days 61–90: old access removed, recovery plan tested, responsibility matrix confirmed. Only then does the previous provider's engagement end.
Red flags when choosing: the provider wants accounts registered in its own name, the SLA says nothing about resolution time, there is no documentation, on-site work in other countries is "by arrangement", or a low price is quoted before anyone knows your environment.
The tool above generates a recommendation, a weighted checklist and a transition plan for your situation. If you would like to review your IT environment and the right managed IT model with an expert, talk to us.
