Managed Services
Managed services are IT functions delivered by external providers under contractual arrangements that transfer operational responsibility while retaining organisational accountability. The arrangement shifts execution from internal staff to specialists who maintain, monitor, and operate specific technology domains on the organisation’s behalf. This differs from consulting engagements or staff augmentation, where external personnel work under direct organisational supervision.
The managed services model addresses a fundamental constraint facing mission-driven organisations: the breadth of IT capability required exceeds what internal teams can sustain. A five-person IT department cannot maintain deep expertise across infrastructure, security, applications, networking, and end-user support while simultaneously driving strategic initiatives. Managed services allow organisations to purchase operational capacity without building permanent headcount, converting fixed staffing costs into variable service fees that scale with actual requirements.
- Managed Service
- An IT function delivered by an external provider who assumes operational responsibility for defined outcomes, measured against service level agreements, with the organisation retaining accountability for governance and strategic direction.
- Managed Service Provider (MSP)
- An organisation that delivers managed services, typically across multiple clients, achieving efficiency through standardisation, tooling investment, and specialised expertise that individual clients cannot economically replicate.
- Service Scope
- The boundary defining which activities, systems, and responsibilities fall within the managed service arrangement versus those retained by the organisation or allocated to other providers.
- Operational Responsibility
- Day-to-day execution of IT activities including monitoring, maintenance, incident response, and routine changes within the service scope.
- Accountability
- Answerability for outcomes, decisions, and compliance that remains with the organisation regardless of who performs operational activities.
Service Delivery Models
The relationship between organisations and managed service providers follows several structural patterns, each creating different dynamics for control, cost, and capability access.
Dedicated delivery assigns specific provider personnel and infrastructure exclusively to one organisation. The provider maintains a team that works only on that organisation’s systems, develops deep familiarity with the environment, and provides continuity of knowledge. This model carries higher costs because the organisation bears the full expense of dedicated resources regardless of utilisation. Dedicated models suit organisations with complex environments, sensitive data requirements, or regulatory constraints that preclude shared infrastructure.
Shared delivery pools provider resources across multiple clients, with work allocated based on demand and expertise matching rather than fixed assignment. The provider achieves efficiency by spreading specialist skills across a client base, reducing per-client costs. Individual organisations benefit from access to broader expertise than dedicated models provide at equivalent price points. The trade-off involves less environmental familiarity, potential competition for resources during peak demand, and standardised approaches that may not accommodate unusual requirements.
Hybrid delivery combines dedicated elements for specific functions with shared resources for others. An organisation might retain dedicated security analysts who understand sensitive programme data while using shared infrastructure support for commodity server management. This model balances cost efficiency against requirements for specialisation, deep knowledge, or data sensitivity.
+------------------------------------------------------------------+| SERVICE DELIVERY MODELS |+------------------------------------------------------------------+
DEDICATED MODEL+------------------+ +------------------+| Organisation | | Provider || | | || +------------+ | | +------------+ || | Systems |<-+-----+->| Team A | || | | | | | (dedicated)| || +------------+ | | +------------+ || | | |+------------------+ +------------------+
SHARED MODEL+------------------+ +------------------+| Org A | | Provider || +------------+ | | +------------+ || | Systems |<-+--+--+->| Shared | || +------------+ | | | | Pool | |+------------------+ | | | | | | | | Analysts | |+------------------+ | | | Engineers | || Org B | | | | Admins | || +------------+ | | | +------------+ || | Systems |<-+--+ | || +------------+ | +------------------++------------------+
HYBRID MODEL+------------------+ +------------------+| Organisation | | Provider || | | || +------------+ | | +------------+ || | Sensitive |<-+-----+->| Dedicated | || | Systems | | | | Security | || +------------+ | | +------------+ || | | || +------------+ | | +------------+ || | Standard |<-+-----+->| Shared | || | Infra | | | | Infra Pool | || +------------+ | | +------------+ |+------------------+ +------------------+Figure 1: Service delivery model structures showing resource allocation patterns
Build Versus Buy Analysis
The decision between internal capability development and managed service procurement requires structured analysis across multiple dimensions. Raw cost comparison between internal and external delivery rarely captures the complete picture; the analysis must incorporate capability requirements, organisational context, and strategic alignment.
Capability assessment identifies what the organisation needs to accomplish and at what performance level. For infrastructure monitoring, this might specify: 24/7 coverage, 15-minute response to critical alerts, capacity to monitor 200 servers and 50 network devices, and expertise across Linux, Windows, and network platforms. Documenting capability requirements in measurable terms enables meaningful comparison between build and buy options.
Internal delivery cost includes personnel (salaries, benefits, training, recruitment), tooling (licences, infrastructure to run tools, maintenance), and management overhead (supervision, coordination, performance management). A realistic internal monitoring capability requires 2.5 full-time equivalent staff to provide 24/7 coverage with appropriate expertise, accounting for leave, training time, and turnover buffer.
Consider a worked example for infrastructure monitoring:
Personnel costs for 2.5 FTE at £45,000 average salary plus 25% overhead yields £140,625 annually. Monitoring tooling (assuming open source with commercial support) runs £8,000 per year. Training and certification costs £4,000. Recruitment costs amortised over average 3-year tenure adds £5,000. Management overhead at 10% of a senior IT manager’s time contributes £7,500. Total internal delivery cost reaches approximately £165,000 annually.
External delivery cost for equivalent scope from managed service providers in the UK market ranges from £90,000 to £150,000 annually depending on service level requirements and delivery model. The lower end reflects shared delivery with standard response times; the upper end approaches dedicated resources with premium SLAs.
The cost comparison alone suggests potential savings from managed services, but the analysis must incorporate additional factors that alter the effective value of each option.
Hidden internal costs include recruitment risk (failed hires, extended vacancies), knowledge concentration (critical dependency on individuals), and opportunity cost (IT leadership time spent on operational supervision rather than strategic work). These factors add 15-30% to the nominal internal delivery cost.
Hidden external costs include transition and migration (typically 10-20% of first-year contract value), governance overhead (contract management, performance monitoring, relationship management), and integration complexity (connecting provider tools and processes with internal systems).
+------------------------------------------------------------------+| BUILD VS BUY COST STRUCTURE |+------------------------------------------------------------------+| || INTERNAL (BUILD) EXTERNAL (BUY) || +------------------------+ +------------------------+ || | | | | || | Personnel | | Service Fees | || | - Salaries | | - Base contract | || | - Benefits (25%) | | - Variable charges | || | - Training | | | || | - Recruitment | +------------------------+ || | | | || +------------------------+ | || | | || v v || +------------------------+ +------------------------+ || | Tooling | | Transition Costs | || | - Licences | | - Migration | || | - Infrastructure | | - Knowledge transfer | || | - Maintenance | | - Parallel running | || +------------------------+ +------------------------+ || | | || v v || +------------------------+ +------------------------+ || | Hidden Costs | | Governance Overhead | || | - Recruitment risk | | - Contract mgmt | || | - Knowledge conc. | | - Performance review | || | - Opportunity cost | | - Relationship mgmt | || | - Coverage gaps | | - Integration work | || +------------------------+ +------------------------+ || | | || +----------------+----------------+ || | || v || +--------------------+ || | Total Cost of | || | Ownership (TCO) | || +--------------------+ |+------------------------------------------------------------------+Figure 2: Cost structure comparison showing visible and hidden costs for build versus buy decisions
Strategic fit evaluates whether the capability represents a core competency the organisation should develop or a commodity function better sourced externally. Mission-driven organisations benefit from preserving internal capacity for activities that directly support programme delivery or require deep organisational knowledge. Infrastructure monitoring, while essential, rarely constitutes strategic differentiation; security operations for organisations handling sensitive protection data might warrant internal capability despite higher costs.
Risk profile compares the risks of each approach. Internal delivery concentrates risk in personnel availability and capability development; external delivery introduces provider dependency and potential service discontinuity. The risk assessment must consider the organisation’s ability to manage each risk type given its scale and maturity.
Service Categories
Managed services span the full technology stack, with each category carrying distinct characteristics for scope definition, performance measurement, and provider market dynamics.
Infrastructure managed services cover server, network, and storage operations including provisioning, patching, monitoring, capacity management, and incident response for infrastructure components. Providers in this space range from global hyperscalers offering managed versions of their cloud platforms to regional specialists providing hands-on support for on-premises and hybrid environments. The infrastructure category represents the most mature managed services market with well-established service definitions and competitive pricing.
Security managed services include managed detection and response (MDR), security operations centre (SOC) services, vulnerability management, and security device administration. The security category demands higher trust levels than infrastructure services because providers gain visibility into sensitive data and security controls. Provider selection requires careful assessment of security practices, personnel vetting, and data handling. Security managed services suit organisations lacking the scale to maintain 24/7 security monitoring internally but facing threat environments that demand continuous coverage.
Application managed services cover specific business applications including maintenance, configuration, user administration, integration management, and enhancement development. The ERP system, CRM platform, or grants management application receives ongoing support from specialists who understand the application deeply. Application managed services often originate from the software vendor or implementation partner and may represent the only practical way to access expertise for specialised systems.
Service desk managed services provide end-user support functions including incident logging, first-line troubleshooting, request handling, and escalation to specialist teams. This category offers significant efficiency potential because provider scale enables extended coverage hours and specialised tooling that individual organisations cannot justify. The trade-off involves reduced organisational knowledge; external service desk staff lack familiarity with internal systems, processes, and culture.
Cloud managed services focus specifically on public cloud platform operations including account management, resource provisioning, cost optimisation, security configuration, and cloud-native application support. Providers range from cloud vendor professional services to independent specialists offering multi-cloud expertise. This category has grown substantially as organisations adopt cloud infrastructure without developing internal cloud engineering capability.
| Category | Typical Scope | Provider Types | Contract Range (Annual) |
|---|---|---|---|
| Infrastructure | Servers, network, storage, patching | MSPs, cloud providers, regional specialists | £40,000-£200,000 |
| Security | SIEM, MDR, vulnerability management | MSSPs, specialist security firms | £60,000-£250,000 |
| Application | ERP, CRM, programme systems | Vendors, implementation partners | £30,000-£150,000 |
| Service Desk | L1/L2 support, request handling | MSPs, specialist providers | £50,000-£180,000 |
| Cloud | Platform operations, optimisation | Cloud specialists, MSPs | £35,000-£120,000 |
Governance Architecture
Effective governance ensures managed services deliver expected outcomes while maintaining organisational control over technology direction and risk exposure. The governance structure must balance oversight requirements against operational efficiency; excessive governance creates friction and delays that undermine managed service benefits.
Retained functions represent activities that remain with the organisation regardless of what operational work transfers to providers. These include strategic direction (technology roadmap, architecture decisions, vendor strategy), policy authority (security policy, acceptable use, data handling requirements), financial control (budget approval, contract authorisation), risk acceptance (decisions about risk tolerance and treatment), and relationship management (executive sponsorship, escalation handling).
Delegated functions transfer to providers with defined parameters and oversight. Operational execution (day-to-day activities within service scope), tactical decisions (implementation approaches within policy constraints), resource management (staffing, tooling, and process decisions for service delivery), and routine changes (pre-approved change types) fall into this category.
+-------------------------------------------------------------------+| GOVERNANCE ARCHITECTURE |+-------------------------------------------------------------------+| || ORGANISATION (RETAINED) || +-------------------------------------------------------------+ || | | || | +----------------+ +----------------+ +----------------+ | || | | Strategic | | Policy | | Financial | | || | | Direction | | Authority | | Control | | || | | - Roadmap | | - Security | | - Budget | | || | | - Architecture | | - Data | | - Contracts | | || | | - Priorities | | - Compliance | | - Approvals | | || | +----------------+ +----------------+ +----------------+ | || | | || | +----------------+ +----------------+ | || | | Risk | | Relationship | | || | | Acceptance | | Management | | || | | - Tolerance | | - Escalation | | || | | - Treatment | | - Reviews | | || | +----------------+ +----------------+ | || +-------------------------------------------------------------+ || | || | Governance interface || | - SLAs || | - Policies || | - Reporting || v || PROVIDER (DELEGATED) || +-------------------------------------------------------------+ || | | || | +----------------+ +----------------+ +----------------+ | || | | Operational | | Tactical | | Resource | | || | | Execution | | Decisions | | Management | | || | | - Monitoring | | - Implementation| | - Staffing | | || | | - Response | | - Methods | | - Tooling | | || | | - Maintenance | | - Scheduling | | - Training | | || | +----------------+ +----------------+ +----------------+ | || | | || +-------------------------------------------------------------+ |+-------------------------------------------------------------------+Figure 3: Governance architecture showing retained and delegated functions with governance interface
Governance interface mechanisms connect organisational oversight with provider operations. Service level agreements establish measurable commitments and consequences. Reporting requirements define what visibility the organisation receives into service delivery. Change authority specifies which changes providers can implement autonomously versus which require organisational approval. Escalation procedures establish how issues that exceed provider authority or capability reach organisational decision-makers.
Governance forums provide structured opportunities for oversight and direction. Operational reviews occur weekly or fortnightly, examining incident volumes, service level performance, and immediate concerns. Service reviews occur monthly, addressing trend analysis, improvement initiatives, and resource adequacy. Strategic reviews occur quarterly, covering contract performance, roadmap alignment, and relationship health. Executive reviews occur annually, encompassing contract renewal considerations, strategic fit assessment, and major investment decisions.
A governance calendar for managed infrastructure services might allocate 4 hours weekly for operational reviews (participated by IT operations staff and provider service delivery manager), 2 hours monthly for service reviews (IT manager and provider account manager), 3 hours quarterly for strategic reviews (IT director and provider senior leadership), and a half-day annually for executive review (senior leadership and provider executives).
Transition Planning
Moving from internal delivery to managed services requires structured transition that transfers knowledge, establishes working relationships, and validates service capability before full operational handover. Poorly executed transitions create service disruption, knowledge loss, and relationship damage that compromise the engagement from its inception.
Discovery and documentation captures the current state before transition begins. This phase produces complete documentation of systems within scope, including architecture, configuration, dependencies, and known issues. It identifies institutional knowledge held by current staff, particularly undocumented procedures, workarounds, and historical context. The discovery output provides the foundation for provider preparation and creates organisational documentation that should exist regardless of service model.
Knowledge transfer moves understanding from current operators to provider personnel through structured sessions covering system architecture, operational procedures, incident patterns, and stakeholder relationships. Knowledge transfer requires active participation from current staff, which may conflict with their interests if the transition eliminates their roles. Organisations must address this dynamic directly, potentially through retention incentives, transition bonuses, or alternative role placement.
Parallel operation runs provider delivery alongside existing operations before full cutover. The parallel period validates provider capability, identifies gaps in knowledge transfer, and allows refinement of operational interfaces. Duration varies by complexity: straightforward infrastructure monitoring might parallel for 2-4 weeks, while complex security operations warrant 6-12 weeks. The parallel period costs more than direct cutover but substantially reduces transition risk.
Cutover and stabilisation transfers operational responsibility to the provider with organisational support available for escalation and knowledge gaps. The stabilisation period, typically 4-8 weeks following cutover, expects higher incident volumes and longer resolution times as provider staff encounter novel situations. Governance intensity increases during stabilisation, with daily check-ins reducing to the steady-state cadence as performance stabilises.
+-------------------------------------------------------------------+| TRANSITION TIMELINE |+-------------------------------------------------------------------+| || Week: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 || | | | | | | | | | | | | | | || +---+---+---+ || | Discovery | || | & Docs | || +-----------+ || +---+---+---+---+ || | Knowledge | || | Transfer | || +---------------+ || +---+---+---+---+ || | Parallel | || | Operation | || +---------------+ || +---+ || |Cut| || +---+ || +---+---+ || | Stable| || +-------+ || || GOVERNANCE INTENSITY: || Daily -----> Daily -----> Daily -----> Daily --> Weekly || meetings meetings check-ins calls reviews || |+-------------------------------------------------------------------+Figure 4: Transition timeline showing phases and governance intensity
Transition costs typically reach 10-25% of first-year service fees, covering provider investment in learning the environment, parallel operation overhead, and organisational effort in documentation and knowledge transfer. These costs should be budgeted explicitly rather than absorbed into operational budgets where they obscure the true cost of transition.
Performance Management
Ongoing performance management ensures managed services continue delivering value after the initial transition period. The performance management framework must distinguish between service level compliance (meeting contractual commitments) and service quality (actual value delivered to the organisation).
Service level measurement tracks provider performance against contractual SLAs. Effective SLAs specify measurable targets, measurement methods, reporting frequency, and consequences for non-compliance. A server availability SLA might specify 99.9% uptime measured by provider monitoring systems, calculated monthly excluding planned maintenance windows, reported within 5 business days of month end, with service credits of 5% of monthly fees per 0.1% shortfall.
Service level targets require careful calibration. Targets that are too easy provide no assurance of quality; targets that are too aggressive either cost more to achieve or create gaming behaviours where providers optimise for metrics rather than outcomes. The 99.9% availability target allows 43 minutes of unplanned downtime monthly; this might be acceptable for internal collaboration tools but insufficient for externally-facing programme systems.
Quality assessment looks beyond SLA compliance to evaluate actual service value. An infrastructure provider might achieve 100% on all SLA metrics while delivering poor quality through slow response (just within SLA), unhelpful communication, resistance to non-standard requests, or failure to proactively identify issues. Quality assessment requires regular stakeholder feedback, trend analysis, and comparison against expectations rather than just contractual minimums.
Continuous improvement expectations should be embedded in managed service relationships. Providers who merely maintain current state without enhancing efficiency, capability, or value deliver diminishing returns as organisational needs evolve. Improvement mechanisms include contractual obligations to propose efficiency gains, shared savings arrangements where cost reductions benefit both parties, and innovation allowances that fund experimentation with new approaches.
Performance review cadence matches governance forums described earlier. Operational reviews examine recent SLA performance and immediate issues. Service reviews analyse trends, root causes, and improvement progress. Strategic reviews assess whether the service relationship continues delivering value aligned with organisational direction.
Exit Planning
Exit planning ensures the organisation can transition away from a managed service provider when necessary, whether due to provider performance failure, changed requirements, strategic decisions, or provider business discontinuity. Exit planning must begin at contract negotiation, not when exit becomes necessary.
Exit triggers define conditions that might initiate transition away from a provider. These include sustained SLA failure (specific thresholds and durations), material breach of contract terms, provider financial instability or acquisition, strategic decision to change service model, and contract expiration without renewal agreement. Documenting triggers in advance enables faster decision-making when circumstances arise.
Contractual exit provisions establish the framework for transition. Notice periods specify how much advance warning each party must provide; 90-180 days is typical for significant managed services. Transition assistance obligations require providers to support knowledge transfer, documentation, and handover activities for a defined period. Data return provisions specify formats, timelines, and completeness requirements for returning organisational data. These provisions must be negotiated at contract inception when the organisation has leverage; attempting to negotiate exit terms during an exit has obvious disadvantages.
Knowledge preservation maintains organisational understanding of systems within service scope. Regular documentation updates, retained access to provider knowledge bases, and periodic knowledge transfer sessions prevent the organisation from becoming entirely dependent on provider expertise. An organisation that cannot understand its own systems lacks the capability to evaluate provider performance or manage transitions.
Alternative provider identification keeps awareness of market alternatives current. Annual market scans, relationship maintenance with potential alternative providers, and participation in peer networks that share provider experiences ensure the organisation can identify alternatives quickly when needed. The managed services market evolves continuously; providers that represented best options three years ago may no longer be competitive or appropriate.
Exit cost estimation provides realistic understanding of transition implications. Exit costs include transition assistance fees from the departing provider, new provider onboarding costs, internal effort for management and knowledge transfer, potential service disruption during transition, and parallel operation costs if service continuity is critical. Exit costs for significant managed services typically range from 6-12 months of service fees.
+-------------------------------------------------------------------+| EXIT PLANNING COMPONENTS |+-------------------------------------------------------------------+| || CONTRACT INCEPTION || +------------------------------------------------------------+ || | - Notice period requirements (90-180 days) | || | - Transition assistance obligations | || | - Data return provisions (format, timeline) | || | - Intellectual property clarity | || | - Termination fee structure | || +------------------------------------------------------------+ || | || v || ONGOING MAINTENANCE || +------------------------------------------------------------+ || | - Documentation currency (quarterly review) | || | - Knowledge preservation sessions (annual) | || | - Market awareness (annual scan) | || | - Exit cost estimation (annual update) | || | - Alternative provider relationships | || +------------------------------------------------------------+ || | || v || EXIT EXECUTION (when triggered) || +------------------------------------------------------------+ || | - Formal notice to provider | || | - Alternative provider selection | || | - Transition project initiation | || | - Knowledge transfer execution | || | - Data migration and validation | || | - Cutover and stabilisation | || +------------------------------------------------------------+ || |+-------------------------------------------------------------------+Figure 5: Exit planning components across contract lifecycle
Risk Considerations
Managed services introduce risk categories distinct from internal delivery, requiring deliberate assessment and mitigation strategies.
Provider dependency risk arises when organisational capability to operate technology independently erodes. Over time, internal knowledge of systems within service scope diminishes as staff turnover occurs and attention shifts elsewhere. The organisation becomes unable to operate without the provider, reducing negotiating power and creating vulnerability to provider performance degradation or business failure. Mitigation includes knowledge preservation activities, documentation requirements, and periodic capability assessment to ensure the organisation retains understanding of critical systems.
Data and privacy risk increases when external parties access organisational data in the course of service delivery. Infrastructure providers may access data on managed systems during troubleshooting. Security providers necessarily have visibility into security events and potentially sensitive communications. Application providers may access data within managed applications. These access rights must be contractually bounded, technically controlled where possible, and subject to provider security assessment. For organisations handling protection data, beneficiary information, or other sensitive categories, managed service arrangements require particular scrutiny of data handling practices.
Service continuity risk encompasses scenarios where the provider cannot deliver services: business failure, acquisition leading to service changes, key personnel departure, or major operational failure. Mitigation includes provider financial and operational due diligence, contractual provisions for continuity scenarios, escrow arrangements for critical code or configurations, and maintained relationships with alternative providers.
Compliance risk arises when provider activities affect organisational compliance obligations. A managed infrastructure provider’s patching practices affect the organisation’s compliance with security standards. A managed application provider’s data handling affects GDPR compliance. The organisation remains accountable for compliance regardless of who performs operational activities. Mitigation requires clear compliance requirements in contracts, provider compliance attestations and audits, and monitoring of provider compliance performance.
Integration risk emerges from the interfaces between managed services and retained capabilities. Incidents may span both provider and internal responsibilities, requiring coordination. Changes to internal systems may affect provider-managed components and vice versa. Process handoffs create potential for gaps, delays, and misunderstandings. Mitigation includes clear interface definitions, integration testing during transition, and established protocols for cross-boundary activities.
Implementation Considerations
Organisational context significantly affects appropriate managed services strategy. Resource constraints, risk tolerance, regulatory environment, and operational complexity all influence which services to manage externally and how to structure those relationships.
Limited IT Capacity
Organisations with minimal IT function gain the most immediate benefit from managed services because the alternative is either foregoing capability or placing unsustainable burden on non-specialist staff. For a charity with one IT person handling everything from password resets to infrastructure, managed services for infrastructure monitoring, backup management, and security operations provide 24/7 coverage and specialist expertise that no single generalist can provide.
The challenge lies in governance capacity. The same resource constraints that make managed services attractive also limit ability to effectively oversee providers. A pragmatic approach focuses managed service arrangements on well-defined, commodity functions with clear SLAs and minimal customisation. Infrastructure monitoring with standard service levels requires less governance overhead than bespoke security operations with complex escalation requirements.
Start with a single managed service for the highest-risk or highest-burden function. Infrastructure monitoring often represents a practical starting point: clear scope, measurable outcomes, mature provider market, and significant reduction in overnight and weekend burden for internal staff. Once governance patterns establish and the relationship matures, consider additional services.
Provider selection should emphasise providers experienced with smaller clients. Enterprise-focused MSPs may lack the flexibility and attention that smaller organisations require. Regional providers or those with specific mission-driven sector experience often deliver better fit.
Established IT Functions
Organisations with dedicated IT departments face different considerations. Internal capability exists for many functions, so the build-versus-buy analysis becomes more nuanced. The opportunity cost calculation must consider what internal staff would work on if operational burden transferred to providers.
Managed services for established IT functions typically target two scenarios: commodity operations where internal delivery is cost-inefficient (infrastructure monitoring, backup operations, routine security functions), and specialist capabilities where internal skill development is impractical (advanced security operations, niche application expertise, emerging technology areas).
Governance mechanisms integrate with existing IT service management processes. The service desk receives escalations from providers. Change management processes incorporate provider-initiated changes. Incident management spans both internal and external resolution. Integration work during transition ensures seamless process flow rather than creating parallel systems.
The provider market for mid-scale organisations includes options beyond pure managed services. Co-managed arrangements where providers augment internal teams without taking full responsibility offer flexibility for organisations wanting to maintain capability while accessing additional capacity. These arrangements require clear responsibility boundaries to avoid confusion about who owns outcomes.
Federated Structures
Organisations with autonomous country offices or regional entities face particular complexity. Central IT may not have authority to mandate managed service arrangements for federated units. Local units may have relationships with regional providers that serve their context better than centrally-selected global providers.
Managed service strategy in federated environments must balance standardisation benefits (volume pricing, consistent governance, reduced complexity) against local requirements (regional data residency, local language support, time zone coverage). A central framework establishing minimum standards and approved provider categories while allowing local selection within those parameters often represents a practical compromise.
Governance responsibilities distribute across levels. Central IT might manage the overall provider relationship framework, conduct periodic provider assessments, and handle escalations that exceed local capability. Local units manage day-to-day provider relationships, local service reviews, and operational issues within their scope.
Field and Remote Operations
Organisations with significant field presence require managed services adapted to challenging operational contexts. Standard assumptions about connectivity, access, and support availability break down in remote field locations. Providers must accommodate intermittent communication, delayed response to on-site needs, and security considerations for staff in high-risk environments.
Few managed service providers specialise in field contexts. General MSPs may lack experience with satellite connectivity challenges, solar-powered infrastructure, or operations in unstable environments. Provider selection must explicitly assess field capability through reference checks with organisations operating in similar contexts.
Some functions suit managed service delivery regardless of field complexity: cloud infrastructure management, security monitoring for centrally-hosted systems, and application support for cloud-based platforms. Functions requiring physical presence or real-time coordination with field staff present greater challenges and may warrant alternative approaches such as regional support arrangements or enhanced internal capability for field-specific support.
Provider access considerations
Managed service providers require access to organisational systems and data. For organisations operating in high-risk environments, provider access introduces security considerations beyond standard commercial risk. Personnel vetting, access restrictions, communication security, and data handling practices require enhanced scrutiny when organisational systems contain location data for staff in dangerous areas, protection information for vulnerable populations, or other sensitive material.