IT outsourcing: Strategy, risk and how to choose a partner

What should an IT outsourcing partner take responsibility for? The answer to that question has been changing rapidly throughout 2026 and may be a harder question to answer in 2027. The decision used to centre on what you were prepared to hand over. Now it needs to centre on what you expect the partner to own.

Throughout 2026, regulation has begun to change the obligations placed on managed service providers. AI has changed both services capabilities and design, with much of its true value depending on where you are in your organisation's transformation. Additionally, the cyber workforce is growing slowly at the very point that resilience, sovereignty and supply-chain risk are attracting greater scrutiny.

The old outsourcing scorecard is no longer enough. Cost, coverage and service levels still matter. Increasingly, though, I would want to know something else: can this partner evidence control, modernise what sits underneath the service, challenge my assumptions and help me operate through what changes next?

Underneath all of it sits one principle. You can outsource capability. You cannot outsource proactive accountability.

IT outsourcing means handing defined parts of your IT operation to an external provider, under a contract that sets out what they deliver and how it is measured. What you hand over is capability and risk as well as workload, which is why the choice deserves board-level attention.

Key takeaways

• Prepare for greater provider regulation. Medium and large managed service providers that meet the relevant definition are expected to come within the UK's NIS regulatory regime. Ask how ready they are now.
• Judge AI on governance and modernisation. The benefits are real but uneven, and the ability to scale them tends to depend on modernisation.
• Test cyber depth with evidence. Ask for accreditations, the people behind them and how 24/7 cover is staffed.
• Keep accountability and choose a partner who will challenge you. Whatever the model, accountability to your regulator and your customers stays with you.

This guide covers five areas: what has changed, identifying what to outsource and what to keep, the risks and how to manage them, the questions to ask a prospective partner, and how to govern the relationship once it is live.

What IT outsourcing means now

Outsourcing used to be a cost decision: move work to a provider who could do it more cheaply at scale. Today you judge the best partnerships on outcomes, resilience and the capability they bring; and providers themselves are changing shape. UK government research comparing the same firms between 2023 and 2025 found the share of managed service providers describing themselves around infrastructure management fell from 74% to 52%, while those positioning around applications and hosting rose from 17% to 33% (DSIT, 2025).

Four models often get used interchangeably. They differ in how much of the delivery your partner owns.

	Staff augmentation	Co-sourcing	Managed services	Full outsourcing
What it is	Skilled people added to your team.	Responsibilities shared by agreement.	Defined services run to agreed outcomes.	End-to-end IT run by one partner.
You keep	Direction, delivery and accountability.	Strategy and the services you choose to run.	Direction, requirements and governance.	Strategy, governance and the business relationship.
Partner provides / owns	Capacity and specialist skills.	Defined functions, such as 24/7 monitoring.	Day-to-day delivery, measured by SLAs and XLAs.	The full operation and how it fits together.
Fits when	You have a short-term gap or a project peak.	You want to keep key knowledge in-house and add depth around it.	You want consistent services and outcomes you can measure.	The estate is complex, you are merging, or the current model needs a reset.
In every model: accountability to your regulator and your customers stays with you.

Many organisations end up with a blend. The model matters less than being clear, function by function, about who owns what.

What's changed for buyers heading into 2027

If you last went to market three or four years ago, six shifts should shape your thinking this time.

1. Good practice becomes something your provider must evidence

This is the change I would put first. Many established providers already work to recognised security standards. What has changed is the expectation that qualifying providers can evidence how they manage the risk. The government's own factsheet notes that managed services are 'not currently regulated in the UK' and grounds the case for change in the 'unprecedented access' providers have to their clients' IT systems (DSIT, 2026a).

At the time of writing, the Cyber Security and Resilience Bill is progressing through its final parliamentary stages. As drafted, it would bring medium and large managed service providers within the UK's Network and Information Systems regulatory regime. They would be required to register with the Information Commission (formerly the Information Commissioner's Office), take appropriate and proportionate measures to manage risk to the services they provide, report significant incidents within 24 hours of becoming aware of them, with a full report within 72 hours, and alert customers likely to have been affected (Cyber Security and Resilience, Network and Information Systems Bill, 2026; DSIT, 2026c). The detail, including reporting thresholds, will follow in secondary legislation after Royal Assent (DSIT, 2026a).

Readiness is hard to judge from the outside. Government research found that only a quarter of UK managed service providers mention any accreditation in how they describe themselves (DSIT, 2025). That measure includes many small firms outside the Bill's scope and probably understates practice, but it shows readiness is something to ask about rather than assume.

Once the relevant provisions commence, incident handling, reporting and customer notification will become regulated duties, and contracts will need to reflect them. Selection is the moment to see whether a provider can already show how it is preparing to meet them.

2. AI value scales with modernisation

AI is changing how IT services are run, from triage and automation to monitoring and remediation. The benefits are real but uneven, and the ability to scale them tends to depend on modernisation. In Whitelane Research's 2026 UK and Ireland study, the share of organisations reporting significant business benefit from AI they had developed rose from 5% to 16% in a year (Whitelane Research, 2026). Gartner, meanwhile, predicts that over 40% of agentic AI projects will be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls (Gartner, 2025).

My read is that the transition takes investment and expertise. By modernisation I mean practical foundations: data that is accurate and well governed, platforms that are current and supported, and processes standard enough to automate. These are the conditions for AI to work safely at scale, and the efficiencies tend to follow once they are in place. Choose the partner with a credible modernisation path and the governance to match.

So, look at the tools each candidate already uses in delivery: how it monitors, automates, triages and resolves issues today. Providers are at different stages, and the tooling they run now is a better guide to what they can bring you than a roadmap slide. Also a great outsourcing partner will be able to support you with your data and AI transformation.

3. Cyber depth needs testing

UK cyber security employment grew by just 3% in the latest government analysis, the slowest growth since the study began in 2018 (DSIT, 2026b). With the workforce growing that slowly, test the depth, experience and resilience of a provider's cyber team rather than assume it is there. That depth is among the most important things you are buying, and among the easiest to overstate in a proposal.

4. Resilience depends on what sits beneath your provider

Many organisations and managed services depend on a concentrated set of large cloud and technology platforms. In financial services, regulators began directly overseeing AWS, Google Cloud, Microsoft and Oracle as designated critical third parties in July 2026, while making clear that firms 'remain responsible for managing their own third-party arrangements' (Bank of England, 2026). Whatever your sector, ask how your partner plans for disruption in the layers beneath it, and how that plan protects you.

5. Sovereignty is a real question, in proportion

Forrester predicts that more than half of European companies adopting AI will reduce their dependence on US hyperscalers because of sovereignty concerns (Forrester, 2026). Practice is moving more slowly: only 6% of organisations in Whitelane's study reported major changes to platforms or sourcing because of sovereignty, while 35% are still assessing the implications. Treat sovereignty as a question every partner should answer clearly, particularly for regulated and public sector data, rather than a reason to rebuild everything.

6. Quantum readiness now has a timetable

The National Cyber Security Centre asks organisations to complete discovery and planning for post-quantum cryptography by 2028, and notes that where managed service providers deliver most of your IT, they should be carrying out that assessment for the services they provide (NCSC, 2025). It is a modest ask today. Find out whether your partner has started.

What to outsource, and what to keep

I would not start by asking what can be outsourced. Almost anything can. Start with what cannot safely become someone else's institutional knowledge: architecture direction, risk appetite, data decisions, business priorities and supplier accountability. Delivery can move. Judgement needs an owner. Organisations planning to reduce their reliance on external providers say the same: 62% give keeping key knowledge in-house as their reason (Whitelane Research, 2026).

Service area	What is typically included	Common reasons to outsource	What to keep in-house
Service desk	First to third line support, request fulfilment, user experience measurement	Extended hours, consistency, experience-based measures	Knowledge of your business processes and priority users
Infrastructure and network	Servers, storage, network and connectivity operations, patching	Scale, 24/7 monitoring, ageing estate	Architecture direction and investment decisions
Cloud	Platform operations, migration, optimisation and governance	Skills, cost governance, modernisation	Cloud strategy, data classification and residency decisions
Cybersecurity	Monitoring, detection and response, vulnerability management, assurance	Scarce skills, round-the-clock coverage, regulatory evidence	Risk appetite, ownership of security policy, board reporting
Workplace services	Devices, collaboration tools, endpoint security	Hybrid working at scale, user experience	Policy on how people work and what they need
Service integration	Coordinating multiple suppliers to agreed service levels	Complex, multi-supplier estates	Commercial relationships and final accountability
Full stack	End-to-end IT operation through one partner	Mergers, rapid growth, resetting an underperforming model	Strategy, governance and the business relationship

Why organisations outsource now

The rationale is changing too. Access to emerging technology, principally AI, is the most cited driver among organisations increasing their use of outsourcing, at 70% (Whitelane Research, 2026). Yet among organisations scaling back, the main reason given is keeping key knowledge in-house. That apparent contradiction is useful. The real choice is which capabilities benefit from external scale and expertise, and which knowledge you cannot afford to lose.

In my experience, something specific usually triggers the decision: capability you cannot build fast enough, 24/7 resilience that is hard to staff, regulatory pressure to evidence controls, a multi-supplier estate where nobody owns the joins, a merger or divestment, or an incumbent that has stopped improving.

The risks, and how to manage them

Outsourcing changes who performs the work. It does not remove your accountability for the outcome. Build these risks into the contract and governance from day one, rather than discovering them at renewal.

Risk	What it looks like	How to manage it	Contractual safeguard
Loss of control and visibility	Decisions made without you; reporting that describes activity rather than outcomes	Retain a client-side team with defined roles, such as service owner, supplier manager, architect and security lead; agree what you will see and when	Reporting obligations, audit rights, named governance roles
Lock-in and dependency	Knowledge, tooling and data that only the provider can operate	Insist on documentation and knowledge transfer as part of the service	Exit plan from day one, data return, tooling and IP terms
Security, data protection and sovereignty	Unclear access to your systems; uncertainty over where data is held and who can reach it	Assess controls with evidence, not questionnaires alone; classify data and its residency needs	Security schedule, breach notification terms, data location commitments
Service drift	Service levels met on paper while users experience something else	Measure experience alongside service levels; review trends, not single months	SLAs and XLAs with improvement mechanisms and remedies
Regulatory and supply-chain obligations	Your regulator asks for evidence your provider cannot produce	Map obligations by sector: the Cyber Security and Resilience Bill, UK GDPR, and for financial services, operational resilience and third-party rules (DORA and NIS2 where you operate in the EU)	Regulatory cooperation, incident reporting and audit clauses
Disruption beneath your provider	An outage at a platform your provider depends on becomes your outage	Ask how the partner designs for recovery across the layers it relies on	Resilience and recovery commitments, tested and reported

How to choose a partner: The questions to ask

Many proposals look competent on paper. These questions find the differences that only show up after go-live.

Start with outcomes, not services

Before you talk to any provider, define what better looks like: the services your organisation cannot afford to lose, the user experience you expect, and the risks you need reduced. A partner can only be measured against outcomes you have named.

Sector and regulatory experience

Sector knowledge should change how a partner works, not just appear in its case studies. Ask how its service would differ for your sector, which regulatory obligations it already supports for customers like you, and how it handles audits and regulator requests.

Assurance you can verify

Of the quarter of managed service providers that mention any accreditation, the most common are Cyber Essentials, mentioned by 19% of all providers, and ISO/IEC 27001, mentioned by 14% (DSIT, 2025). Ask for current certificates and their scope, recent independent audit results and access to a trust centre or equivalent evidence. A certificate that covers one office is not the same as one that covers the service you are buying.

Real cyber depth

With the cyber workforce growing slowly, test this on its own. Ask who will protect you: the size and seniority of the security team, how 24/7 coverage is staffed, how detection leads to response, and how often recovery is exercised. Ask to meet the people, not just the account team.

Access to your systems

Your provider will hold privileged access to your estate. That access is the government's main reason for bringing managed service providers into regulation, and it cites Operation Cloud Hopper, a campaign that compromised providers to reach their customers (DSIT, 2026a). Ask how access is granted, limited, logged and reviewed; how staff with access are vetted; how the provider's remote management tools connect into your environment; and how it secures its own systems.

Will they challenge you?

The most common weakness organisations report in their providers is that they do not challenge them enough, cited by 43% (Whitelane Research, 2026). Ask for an example of where the partner disagreed with its customer, changed the plan and improved the outcome. A partner that always agrees with you may be easy to manage. It is not necessarily adding much value.

How do they use AI, and how is it governed?

Ask which AI and automation tools are used in service delivery today, and which are planned, and ask to see them working. Then ask how it is governed: what data it touches, where that data is processed, whether the tools operate inside your environment, whether your data is used to train any model, where a person stays in the loop, and how results are measured. A credible partner will be clear about what is live, what is in pilot and what depends on modernising your estate first.

Regulatory and quantum readiness

Ask whether the provider expects to come within scope as the Cyber Security and Resilience Bill takes effect, how its incident detection, reporting and customer notification will work, and what it is doing to prepare. Ask, too, whether it has begun post-quantum discovery for the services it provides, in line with NCSC's 2028 milestone.

Financial stability, scale and references

Check the provider's financial health, its ability to grow with you and its dependence on any single customer or supplier. Speak to references of a similar size and sector, ideally including one that has been through a difficult period with the provider.

Commercial clarity and exit terms

Understand what is included, how change is priced, how the service is expected to evolve over the term and how improvement is recognised. Agree the exit plan before you sign: data return, knowledge transfer, a realistic handover period, and who owns the licences and configuration of the monitoring and automation tools that run your service.

A checklist for your next RFP

1. What outcomes will you be measured against, and how will we see them?
2. Which of our regulatory obligations do you already support for comparable customers?
3. What certifications cover the specific service we are buying, and can we see the evidence?
4. Who is in your security team, how is 24/7 coverage staffed and when was recovery last tested?
5. How is your access to our systems granted, limited, logged and reviewed, and how do you secure your own environment?
6. Tell us about a time you challenged a customer's plan. What happened?
7. Which AI and automation tools do you use in delivery today, what is planned, and how is it governed?
8. Do you expect to be in scope of the Cyber Security and Resilience Bill, and how are you preparing?
9. Have you started post-quantum discovery for the services you provide?
10. How do you plan for disruption in the platforms you depend on?
11. What does exit look like, what will you hand back to us, and who owns the tooling?

Governing the relationship after go-live

The contract sets the terms. Your governance determines whether the service improves over the term.

Structure. Agree a rhythm that matches the stakes: operational service reviews monthly, a steering group quarterly, and a clear escalation route that both sides use early rather than late.

Measure experience as well as service. Service level agreements (SLAs) tell you whether a ticket was closed on time. Experience level agreements (XLAs) ask whether the people using the service could get on with their work. Keep XLAs simple: a handful of measures that reflect how people work, agreed with the people who use the service. In my view the strongest arrangements use both: SLAs to protect the basics, XLAs to steer improvement.

Build in improvement. Ask for an innovation roadmap you review together. It should show how the service will modernise over the term, including where automation and AI will be introduced and what each step depends on.

Plan for change and exit from day one. Regulation, your organisation and the technology will all move during the contract. Review the exit plan annually so it stays usable and treat renewal as a decision rather than a default.

Frequently Asked Questions

What is the difference between IT outsourcing and managed services?

IT outsourcing is the broad practice of using an external provider for IT work. Managed services are one form of it, in which the provider runs defined services to agreed outcomes and service levels, while you keep direction and governance.

How much does IT outsourcing cost?

It depends on scope, service levels, hours of cover, the complexity of your estate and the commercial model. Common models include per user or per device pricing, fixed service charges and outcome-linked elements. The most useful comparison is total value over the term, including transition, modernisation and exit, rather than the monthly figure alone.

What are the biggest risks of outsourcing IT?

Loss of visibility, dependency on a single provider, security and data protection gaps, service that meets targets but not user needs, and regulatory evidence your provider cannot produce. You can manage each through governance and contract design, as set out above.

How long does transition to an outsourced provider take?

It depends on scope and the state of your current documentation. Most transitions move through due diligence, knowledge transfer, a period of parallel running and then steady state. Ask any provider for a phased plan with clear exit criteria for each stage, how users will be protected from disruption during cutover, and how its service management will connect to yours, so tickets and data do not fall between systems.

What happens to our IT team?

In the UK, the Transfer of Undertakings (Protection of Employment) Regulations 2006, known as TUPE, may apply when activities move to an outsourced provider, are brought back in-house or transfer between providers. Where it applies, employees assigned to the transferring activity generally transfer to the new employer with their employment rights protected (Acas, n.d.). Applicability depends on the circumstances, so involve HR and legal advisers early, and talk to your team before uncertainty does the talking for you.

Can we outsource part of our IT rather than all of it?

Yes. Many organisations co-source or outsource selected functions, such as the service desk or security monitoring, while keeping strategy and key knowledge in-house.

How do SLAs differ from XLAs?

SLAs measure whether the provider did what was agreed, such as response and resolution times. XLAs measure the experience of the people using the service. SLAs protect the basics; XLAs show whether the service helps people work.

Will the Cyber Security and Resilience Bill affect my IT provider?

If your provider is a medium or large managed service provider that meets the definition of a relevant managed service provider, it is expected to come within the UK's NIS regulatory regime once the relevant provisions commence. Many providers already follow recognised security practice. The change is that registering with the Information Commission, managing risk to their services and reporting significant incidents will become legal duties a regulator can check. Ask your provider now how it is preparing, and what that will mean for your contract.

A final thought

The partner you choose in 2027 will be operating in a different environment by the end of the contract: more regulated, more automated and more dependent on technology you do not directly control.

So don't choose only for the service you need today. Choose for the operating environment you're heading into and keep hold of the accountability that was always yours.

And choose a partner prepared to tell you what you need to hear, not simply what you asked to buy.

Contact OneAdvanced about your IT strategy.