Outsourcing IT Management: The Complete Guide

With “ Managed Services ,” an external provider takes over the management of (part of) your IT at a fixed price and with fixed quality agreements. This includes monitoring, patching, backups, security, and troubleshooting. The difference from hiring temporary staff: the provider is responsible for the results and therefore delivers more than just hours of work.

• You need 24/7 availability, and your team is too small to handle an on-call schedule.
• Knowledge is fragile because it is held by only one or two people.
• Your platform has become more complex— for example, due to Kubernetes or multiple clouds—and requires expertise that you don't have in-house.
• Your team doesn't have time to focus on improvement because most of its work consists of routine management and troubleshooting.
• You must be able to demonstrate compliance with standards such as BIO, ISO 27001, or NIS2.

Outsourcing is less cost-effective if your management is closely intertwined with specific business processes that require a great deal of internal knowledge, or if your team is large enough and that knowledge is widely distributed.

There are 168 hours in a week. A full-time employee works about 36 to 40 of those hours, excluding vacation, sick leave, and training. To have one person available for every hour of the week, you therefore need more than four FTEs. In practice, you plan for five to six people per area of expertise, so that no one is on call every week and expertise isn’t concentrated in a single person.

Add to that: on-call and shift differential pay, training and certification, monitoring and logging tools, and the time it takes to recruit. Compare that amount to the monthly fee charged by a partner for the same level of service.

• Response time: how quickly the partner responds to a report.
• Resolution time or recovery time: how quickly the service is back up and running. More important than response time, but harder to define precisely.
• Availability: the percentage of time the service is operational, measured over an agreed-upon period.
• Priorities: the classification of incidents (for example, P1 through P4), with specific response times for each priority.
• Service window: the hours during which appointments are available, such as business hours or 24/7.

Please note: Availability depends on the entire platform, including applications, the network, and vendors. A partner can only guarantee what it manages. Agree on whether scheduled maintenance counts toward availability.

NIS2 is the European directive on cybersecurity. In the Netherlands, the Cybersecurity Act (Cbw)—which implements NIS2—has been in effect since August 15, 2026. Two points are important to consider when outsourcing:

• You remain responsible. If your organization is subject to NIS2, you must also manage the risks in your supply chain, including those related to your management partner. Include security and incident reporting requirements in the contract.
• Management partners are also included in this category. Providers of managed (security) services are listed as a separate category in NIS2. Ask a partner how they comply with these requirements.

This is not legal advice. Have your legal counsel or compliance officer review how this applies to your organization.

1. Take stock of: systems, dependencies, documentation, access, and current issues.
2. Health Check: Identify risks that must be resolved before the transfer.
3. Make arrangements with the current party or your own team regarding the transfer.
4. Set up monitoring and access for the new partner.
5. A phased transition, for example, starting with monitoring, then incidents, and then changes.
6. Evaluate after the first few months and adjust the agreements.

Common mistakes: not allowing enough time for the handover, documentation that doesn’t match reality, failing to make arrangements with the departing party, and forgetting which tasks were handled “automatically” by someone else.