IT Outsourcing: What to Outsource First, Contract Clauses and an Exit Plan

The short version: Outsource the repeatable, measurable work first (help desk, device support, patching, monitoring, backup checks), and keep decisions and business knowledge in-house. Put scope, service levels, access, data ownership and exit terms in the contract before you sign. Write the exit plan on day one, because it is far easier to agree it while the relationship is new.

This guide is for owners and IT managers deciding how much IT to hand to an outside provider. After reading it you will have a suggested order of outsourcing, a clause checklist for the contract, and an exit-plan checklist you can attach to it.

In what order should you outsource IT?

The order below goes from work that is easiest to specify and measure to work that is hardest. It is a suggestion, not a rule. If you have no IT staff at all, you may take the first four steps together.

1. Help desk and end-user support. Tickets, password resets, new starter setups, device faults. High volume, easy to measure. See the help desk outsourcing guide.
2. Patching and device management. Operating system and application updates, device configuration and compliance reports. Predictable monthly cycle. See patch management compliance in APAC.
3. Monitoring and alert handling. Servers, network devices, internet links, backup jobs. Define who gets which alert and when.
4. Backup operation and restore testing. The provider runs the jobs and tests restores on a schedule. See managed backup service vs backup software. You set the recovery targets, see RTO vs RPO.
5. Microsoft 365 and identity administration. User lifecycle, licences, MFA, conditional access, mailbox and Teams settings. Needs tight access control.
6. Network and hardware maintenance. Switches, firewalls, Wi-Fi, vendor warranty and firmware work.
7. Security operations. Endpoint protection, email security, vulnerability scanning, log review.
8. Planning and advice. Roadmap, budget, vendor choices, risk register. See vCIO services.

Keep these in-house, even when everything else is outsourced:

1. Business decisions: which systems you buy, what risk you accept, who gets access.
2. Approval of changes that touch money, customer data or regulated processes.
3. Knowledge of your business applications: the provider supports the platform, your team owns the process.
4. Ownership of accounts: you should hold the global admin role, domain registrar login, cloud subscription ownership and licence agreements.

How do you decide what to outsource?

Run each IT task through these questions:

1. Is it repeatable? Repeatable work suits a provider's tools and runbooks.
2. Can it be measured? If you cannot write a target for it, you cannot enforce it.
3. Does it need your business judgement? If yes, keep the decision and outsource the execution.
4. What happens if it goes wrong? The higher the impact, the more you need written controls and audit rights.
5. Is the skill rare or only needed part-time? Rare skills are cheaper shared than hired.

What clauses should an IT outsourcing contract include?

Ask your lawyer to review the final text. This list is a checklist of topics to cover, not legal advice.

1. Scope of services: a named list of systems, sites, users and tasks, plus an explicit out-of-scope list.
2. Service hours and channels: when and how users reach the provider.
3. Service levels: response and resolution targets per priority, how they are measured, remedies for repeated misses. See what an SLA is and SLA vs OLA.
4. Roles and escalation: named contacts on both sides, and an escalation path with time limits.
5. Fees and what triggers extra charges: what is included, how projects, after-hours work and on-site visits are charged, and how changes in user count are handled. Link prices to a published price list, not to a verbal quote.
6. Term, renewal and notice: initial term, auto-renewal rules, and notice periods for each side.
7. Access and credentials: who holds admin accounts, how privileged access is granted and logged, and how it is removed.
8. Data ownership and location: your data stays yours; state where it is stored and processed, including backups.
9. Confidentiality and data protection: duties of the provider and its staff and subcontractors, and breach notification times.
10. Subcontractors: whether they are allowed, and your right to be told who they are.
11. Security obligations: minimum controls the provider applies to its own systems that touch yours, such as MFA, device encryption and staff screening.
12. Change control: which changes the provider may make on its own and which need your approval.
13. Reporting and review: monthly report contents, quarterly review meeting.
14. Business continuity: what the provider does if its own service fails.
15. Liability and insurance: limits, exclusions, and the cover the provider holds. Ask for the wording and have it checked.
16. Documentation: the provider keeps your network, configuration and runbook documents current and hands them over on request.
17. Termination rights and exit assistance: see the exit plan below.

What should an exit plan contain?

Attach it to the contract as a schedule.

1. Exit trigger list: termination for convenience, for cause, and expiry.
2. Handover period: a fixed number of days where the provider keeps running services while the next team takes over.
3. Data return: ticket history, knowledge base, asset list, configuration backups and documentation, in a readable format, within an agreed time.
4. Admin access transfer: a list of every account and role the provider holds, with a date by which each is removed and passwords rotated.
5. Licence and subscription transfer: who holds the Microsoft 365, security, backup and domain subscriptions, and how they move to you or to the next provider.
6. Provider tools removal: agents, remote access software and monitoring probes taken off your devices, with confirmation in writing.
7. Knowledge session: a number of hours of walkthrough for the incoming team.
8. Cost of exit assistance: stated up front, not negotiated afterwards.
9. Confidentiality after exit: deletion or return of your data, with a certificate of deletion.
10. Test the exit on paper: once a year, check that you could still find every item above.

Common mistakes

1. Outsourcing a mess. Document the current state first, or the provider spends the first months finding out what you have.
2. Not holding the admin accounts. If the provider created the tenant in its own name, moving later is painful.
3. Buying a vague scope ("all IT support") and arguing about it at the first project.
4. Writing SLAs with no measurement method.
5. Skipping the exit plan because it feels unfriendly.
6. Outsourcing decisions along with tasks. Keep approval of risk and spend with a named person on your side.

How to check it worked

1. After 90 days, compare the monthly report with the contract's service levels.
2. Count repeat tickets and escalations; they should fall as the knowledge base grows.
3. Check that you can see, in writing, who holds each admin role.
4. Ask your internal staff what time they got back, and what they now spend it on.
5. Review the exit schedule once a year.

For picking the provider itself, use the MSP selection scorecard and how to choose a managed IT services provider in Hong Kong.

FAQ

What are IT outsourcing services?

They are IT tasks run by an external provider under a contract, such as the help desk, device and network support, backup, monitoring and security.

What is the IT outsourcing process?

A common sequence: list the tasks and measure current effort, choose which to outsource, shortlist providers, run a pilot, sign a contract with service levels and exit terms, hand over documentation and access, and review after 30 and 90 days.

What are some IT outsourcing examples?

Examples are an outsourced help desk, remotely managed patching and monitoring, managed backup with restore tests, and Microsoft 365 administration. Each is a task you can describe and measure.

What are IT outsourcing companies?

IT outsourcing companies are providers that run IT tasks for other businesses under a contract, such as managed service providers. Compare them on written scope, service levels and exit terms, using the MSP selection scorecard.

To see how a full managed arrangement is structured, read about our managed services.

Brocent publishes its managed IT support plans with per-user monthly prices for Hong Kong, Singapore, mainland China and the United States, so you can compare before you talk to anyone: see the plans and pricing.