We outsource IT. What does our small business still need to do?

You can hire someone else to run IT. You still need someone inside the business to decide what people should access and whether the service meets your needs. The biggest gaps often sit between those two jobs.

An IT provider may be waiting for an instruction that nobody knows they need to send. Start by checking a few ordinary tasks together. You do not need a new compliance platform to do this.

A new employee starts

Imagine a small consulting firm hiring an account manager. The provider can create the account. It cannot reliably decide which client folders that person should see.

• Your job: Approve the access needed for the role. Identify any client information that should stay restricted.
• Provider’s job, if included: Create the account and apply the approved settings.
• Evidence: Keep the request and completion record together. Ask the manager to check that the access is right.

Do not use “same as the last person” without checking. The previous employee may have accumulated access over several years.

Someone leaves

The provider needs a clear instruction and timing. It also needs to know which services it manages. Your separately purchased proposal tool may not be on its list.

• Your job: Tell the provider when access must end. Cover business applications outside its contract.
• Provider’s job, if included: Remove the relevant access and address active sessions through the systems it manages.
• Evidence: Keep the notification and completion results. Note any service still awaiting action.

A closed help-desk ticket is not enough if one of the person’s accounts remains active. Ask what was covered rather than accepting a general “done.”

A file needs restoring

“We have backups” can mean different things. A provider might protect your server while a cloud project tool sits outside the backup service.

• Your job: Identify the information the business needs to recover. Agree how much lost work and downtime you can tolerate.
• Provider’s job, if included: Explain backup coverage and demonstrate recovery for the agreed services.
• Evidence: Keep the coverage list and a recovery test result. Record what was recovered and whether staff could use it.

If a service is excluded, make a deliberate decision about it. Do not leave the gap hidden behind the word “backup.”

An alert arrives after hours

Monitoring and responding are different services. An alert sent to an unattended inbox may not lead to any action.

• Your job: Name a decision-maker and backup contact. Agree what the provider may do without waiting for you.
• Provider’s job, if included: Explain who receives alerts and when someone responds.
• Evidence: Keep the agreed escalation process and a simple contact test result. For a real event, retain the response record.

A contact test checks that the route works. It does not prove the provider can detect every attack. Ask separately about detection coverage and response limits.

Write down the handoffs, not a giant policy

For each important service, record just four things: the task, who does it, what starts the work and what shows it finished. Use names or roles that someone can actually contact.

Check the provider’s service agreement against that list. Resolve gaps in writing. A friendly conversation may clarify intentions but does not necessarily change the purchased service.

Also agree how you will recover access to your accounts and records if you change providers. Do not wait until the relationship ends to discover who controls them.

Where compliance fits

These examples support basic oversight. They do not decide which laws or customer requirements apply to your business. Tell the provider about relevant obligations before assuming its standard package covers them.

If the provider gives you a SOC report, read the tasks it expects customers to perform. The report is useful evidence about its service, not proof that your side of the handoff works.

The NCSC’s small-business guide to managed IT providers recommends clear responsibilities and service boundaries. The Canadian Centre for Cyber Security’s managed-services guidance covers the customer’s role in access, incident response and recovery. The examples here are practical ways to check those handoffs.