For several years now, IT has become more than central to the smooth running and growth of companies and public bodies, whatever their size. Yet the day-to-day management of information systems is no easy matter, and turning to IT outsourcing has become common practice, one that offers a number of benefits, but also risks that need to be assessed before committing. This article focuses on that second aspect.
What is IT outsourcing?
IT outsourcing means entrusting an external provider with the management of all or part of your information system. It covers a broad spectrum of services, ranging from simple data hosting to the complete external management of the client's information system.
For most of our clients, the aim of this outsourcing is to refocus on their core business and to reap the benefits the model offers: IT expertise, cost reduction, access to the latest technology, productivity gains and improved security of their IT system.
That said, the exercise is not without risk, and we set out below some of those risks so that you can raise them in your negotiations with your provider.
The risks inherent in subcontracting
IT outsourcing is a service that is not immune to what might be called the "usual and classic" risks of subcontracting, namely:
- the adequacy of the provider's technical, financial and human resources required to perform the services properly. The provider must be able to supply everything needed to reassure its client on these points;
- the delivery of unsuitable services stemming from a poor understanding of the requirement and a failure to advise. Setting out the requirement is an essential step in any service contract. The point here is to be as precise as possible about your expectations and your constraints, and to pay particular attention to the solutions put forward by the provider;
- a lack of transparency about how the service is organised, and in particular about compliance with security constraints where subcontracting is cascaded. Sufficient guarantees must be given so that the services can be performed in line with the security requirements set;
- dependency on the provider where its offer includes no portability of the services proposed and no exit and transition services. This aspect must be addressed before the contract is signed and must form an integral part of the provider's offer, so that you are not caught out and can avoid any operational difficulty at the end of the contractual relationship.
Taken together, these points of attention allow for upfront analysis and thought when choosing a provider, in line with your requirement, your strategy over time and the objectives you want to reach. We advise our clients to give them as much weight as the financial and technical terms, and to frame them within their contracts.
Risks specific to IT outsourcing services
Outsourcing the management of all or part of your information system creates further risks specific to this type of service which, if left unchecked, can cause you to lose control of it and seriously affect your business. These potential failings can be grouped as follows:
- Data security : a lack of clarity about how data is managed and where it is located can aggravate the risk of a breach of confidentiality of that data. The client must be able to satisfy itself that every hosting location meets its security requirements and the applicable legal and regulatory obligations. The risk of sensitive information being disclosed must be capable of assessment at all times, so that the right decisions can be taken with full knowledge of the facts;
- Personal data : failure to comply with the General Data Protection Regulation (GDPR) carries very heavy penalties (more than €100m in fines imposed in France by the CNIL in 2022). Responsibilities must therefore be allocated, and it must be checked that the specific legal obligations can be met by the provider in the outsourced environment;
- Remote intervention : performing outsourcing services remotely can expose the information system to various types of vulnerability that may considerably affect it and have serious consequences for the organisation. By way of example, we can list intrusion by unauthorised persons, abuse of rights by an engineer who accesses, downloads or alters sensitive data, or the difficulty of ensuring that interventions are traceable. These situations can be kept under control by reviewing and analysing the technical and organisational security arrangements and measures on offer;
- Shared hosting : this consists in hosting several services on a single server in order to rationalise resources. In most cases the services concerned are websites, email services or databases. This co-hosting in a less well controlled environment increases the risk of losing the availability, integrity or confidentiality of the services. Here too, the solutions put in place in the event of an attack or to prevent incidents, along with the exit arrangements, must be clearly defined in order to limit these drawbacks;
- The provider's technical choices : during the life of the contract it is sometimes necessary to develop the information system in order to add new functionality, adapt to new regulations or address obsolescence. In such cases the provider's technical choices may be ill-suited to the client's needs. The contract must make it possible to validate those choices and the adjustments required.
Conclusion
There is no denying that IT outsourcing brings benefits to an organisation's productivity and structural growth. However, and as we have sought to highlight throughout this article, this outsourcing process is not free of risks, and those risks need to be limited throughout the discussions with the provider in order to give such a project every chance of success.
On that note, our Contract Management team, which is regularly called on for this kind of subject, is here to share its expertise and its support solutions with you.