Outsourcing changes where work is performed and how you control it. A capable provider can improve reliability and access to skills; a poorly defined arrangement can leave you paying for a service you cannot evaluate, recover, or replace.
Compare the provider with your realistic in-house alternative. A team dependent on one employee, an untested backup, or an undocumented spreadsheet already carries risk. The decision is which operating arrangement best meets the need, and what evidence supports that judgment.
Describe the service you are actually buying
Write the outcome, service hours, covered locations, expected volumes, and exclusions before comparing quotations. “IT support” might mean an email help desk, endpoint management, incident response, or all three. State who handles identity administration, restores, after-hours emergencies, supplier coordination, and changes outside the standard service.
Retain an internal owner with authority to set priorities, review performance, and approve changes. The provider cannot resolve conflicting business priorities on your behalf without a decision rule. Keep enough internal knowledge to judge whether the service is working and to brief a replacement if necessary.
For technology suppliers, NIST’s cybersecurity supply-chain quick-start guide recommends identifying suppliers, assessing their criticality, and communicating responsibilities and requirements. Its scope is cybersecurity, not every commercial outsourcing risk. Use criticality to set the depth of review: access to privileged systems or sensitive data deserves more scrutiny than a readily replaceable low-impact service.
Turn broad worries into testable risks
A useful risk statement names a cause, an event, and a business consequence. “Vendor risk” is too vague. “Only the provider holds the administrator credentials; if its service is unavailable, we cannot restore access” gives you something to investigate and improve.
On a small screen, scroll the table sideways to read all columns.
| Risk | What to examine | A useful control or test |
|---|---|---|
| Service quality or coverage gap | Actual hours, severity definitions, exclusions, and backlog reporting. | Walk through a realistic urgent case and the escalation route. |
| Privileged access or data exposure | Which accounts and data the provider and subcontractors can reach. | Review least-privilege access, authentication, logs, and account removal. |
| Concentration or dependency | Shared hosting, critical subcontractors, and a single specialist. | Test a fallback that does not depend on the same failed component. |
| Unexpected cost | Volume limits, change rates, minimum terms, and transition charges. | Price a normal month, a busy month, and an exit scenario. |
| Loss of knowledge or portability | Who maintains documentation, exports, configurations, and credentials. | Have your team use a sample export and follow a recovery runbook. |
Record the evidence, its date, the remaining gap, an owner, and a due date. A certificate or assurance report can inform the review, but check its scope, service coverage, time period, and exceptions. Do not treat a logo on a sales page as proof that your particular workflow has been tested.
Use simple likelihood and impact descriptions if they help discussion. Avoid treating a multiplied score as an objective probability or letting several low scores cancel one unacceptable dependency. A service that cannot be restored within your tolerance may fail the decision even when the price is attractive.
Download a provider risk register and review worksheet (plain text). It includes a fictional entry and a blank record to copy for each risk.
Worked example: compare the whole first-year cost
Fictional USD example: a provider quotes $1,800 per month. The first year also needs $3,000 of transition work, six hours of retained management each month valued at $50 per hour, and a $2,400 allowance for separately priced changes.
The modeled first-year cost is ($1,800 × 12) + $3,000 + (6 × $50 × 12) + $2,400 = $30,600. Of this, $3,600 is the assigned value of internal management time; it is not necessarily an additional cash payment. The $2,400 is a planning allowance, not a known invoice.
Compare that figure with an in-house estimate covering the same scope and service hours. Include relevant recruitment, coverage, tools, training, and transition costs without double-counting existing costs that continue under either choice. Keep first-year setup separate from recurring years. Test higher demand and a provider change, because a low base retainer may not describe either situation well.
Review operation, incidents, and contract terms together
Ask the people who would deliver the work to demonstrate a normal request and a difficult exception. Get sample reports with definitions and inspect how unresolved work appears. A response-time promise may mean only an acknowledgment; establish separately when investigation starts, who communicates progress, and what restoration commitment is actually offered.
For technology services, agree incident contacts, information-sharing arrangements, access to relevant evidence, and recovery responsibilities. NIST SP 1305 explicitly includes suppliers in incident planning, response, and recovery and addresses requirements throughout the supplier relationship. Rehearse a scenario with your provider instead of assuming that separate plans will fit together.
Have the appropriate commercial and legal reviewers check the actual agreement against the operating promises, including liability limits, subcontracting, changes, termination, and treatment of data. Requirements differ by jurisdiction, sector, and the data involved. A service credit may compensate for a missed contractual measure while doing little to repair the disruption itself.
Make the exit usable before you need it
Specify export formats, supporting documentation, transition assistance, time limits, and charges. Test whether an export includes the relationships and attachments needed to use the records elsewhere. A folder full of files may not reproduce permissions, workflows, audit history, or a working service.
Keep organizational control of critical domains, accounts, and recovery contacts where the service model permits. Document how access will be transferred and then revoked, and how deletion or return of data will be evidenced subject to applicable retention obligations. Plan for overlap, final reconciliation, and a failed transition—not just the date the contract ends.
Review the arrangement periodically and after a material service or ownership change. Update the risk register when volumes, access, subcontractors, or business dependence change. An outsourcing decision is a continuing operating responsibility, even when day-to-day delivery happens elsewhere.