In-House vs Outsourced IT: How Dubai Companies Should Decide

You do not have to choose between all in-house and all outsourced. Keep ownership and decisions inside the business, outsource the work that is routine, specialist or needed outside office hours, and choose a co-managed split if you already employ IT staff you want to keep. Whichever model you pick, the contract has to say who does what, how the provider gets into your systems and how you leave. Our IT outsourcing in Dubai page shows what a provider can take over end to end.

What are the three ways to run IT?

Every arrangement is a version of one of these three models. They differ in who your staff call first and who holds the skills.

• Fully in-house. You employ the people who run support, devices, Microsoft 365, networks, servers, security and backups. You set priorities every day and the knowledge stays in the building. The weak points are depth and cover: a small team cannot hold every skill, and nobody watches the systems when they are off.
• Fully outsourced. A provider runs the day-to-day work under a written agreement, and your staff call the provider first. You get a wider set of skills and cover outside office hours without hiring for them. The weak point is distance: a provider learns your systems faster than your business, so someone inside still has to own the relationship.
• Co-managed. Your IT staff stay, and a provider takes an agreed share of the work. A typical split leaves users, local devices and business applications with your team, and gives security monitoring, out-of-hours cover and the deeper Microsoft 365 and Azure work to the provider. Our co-managed IT services page shows how we write that split for each system.

None of the three moves the accountability. The US Cybersecurity and Infrastructure Security Agency (CISA) says it plainly in its guidance for customers of managed service providers: outsourcing IT services does not absolve executives of risk management responsibilities.

Which questions decide the right model for your company?

CISA suggests that small businesses settle three things before signing: which tasks the provider takes on, which the business keeps and which are shared. These questions help you answer them:

• Who covers nights, weekends and leave? If one or two people run your IT, a resignation or a long leave stops everything only they know. A provider, alone or alongside your team, removes that single point of failure.
• How many skills do you need, compared with how many people you can employ? Identity and access, security monitoring, Microsoft 365, backup, networks and servers are separate skills, and a team of two cannot be senior in all of them. Our guide to L1, L2 and L3 support shows where each kind of work sits.
• How much of the work depends on knowing your business? Line-of-business systems, internal processes and approving changes need people who know how the company runs. That work usually stays inside.
• Who has to produce evidence? If customers, insurers or a regulator ask for patch, backup and access records, decide which side writes them each month.
• How fast must someone respond when the business stops? Write the answer in minutes and test each model against it.
• Do you want to direct priorities yourself? If so, keep an in-house lead even if most of the work goes out.

As a rough guide, no IT staff and no plan to hire points to fully outsourced. One to a few stretched IT staff points to co-managed. A large team that already covers every skill and every hour may only need outside specialists for projects.

What should stay in-house whatever model you choose?

Ownership, decisions and your own copies. A provider can run your systems, but the keys and the accountability should stay with you.

• The keys to your Microsoft 365 tenant. Keep emergency access accounts that the business controls, not the provider. Microsoft recommends creating two or more of them, as cloud-only accounts on the onmicrosoft.com domain.
• Domains and DNS. The registrar and DNS accounts should be in the company's name, with the provider added as a user rather than as the owner.
• Your own logs and backups. CISA advises small businesses to keep logs of all provider activity and offsite backups of critical data, separate from the vendor's storage.
• The decisions. Which risks you accept, which changes go ahead, who gets admin rights and what you spend.
• A named owner for the provider. CISA says organisations should identify the people responsible for monitoring and managing the provider's day-to-day activity. That person reads the monthly report and approves changes.
• The records. The asset register, network documentation and password vault should live in systems you own, kept current by whoever does the work.

How should an outside provider get into your systems?

With the least access that does the job, for the shortest time, and with multi-factor authentication (MFA). CISA's guidance is to give a provider only the minimum necessary rights for the shortest necessary duration. A joint advisory from CISA, the UK National Cyber Security Centre (NCSC) and their partners adds that contracts should require MFA on all provider accounts used to access customer environments.

For Microsoft 365, ask your partner to use granular delegated admin privileges (GDAP). Microsoft describes GDAP as granular, time-bound access that the customer must explicitly grant. A provider that wants permanent Global Administrator rights for everyday work is asking for more than the job needs. Review the provider accounts every quarter and disable the ones nobody uses.

What should an IT outsourcing contract include?

The NCSC's guide to choosing a managed service provider says the contract should clearly set out what is and is not included, and calls a matrix of responsibilities good practice. Check for these clauses before you sign:

• Scope and responsibilities. Every system, with who does the work, who approves and who is told. Anything not listed is out of scope until agreed in writing.
• Service levels. Response and resolution targets for each priority, with misses reported in writing. CISA asks for service levels that separate operational IT services from security services.
• Incident notification. How and when the provider tells you about an incident, including one on its own systems.
• Logs. Which logs are kept, for how long and how you get them. The NCSC says any log retention period your business needs should be written into the contract.
• Backups. What is backed up, how often, where the copies sit, who can reach them and how often a restore is tested.
• Patching. The provider's patch policy in days. The NCSC recommends patching within 14 days of release when an update fixes a critical or high-risk vulnerability.
• Subcontractors. Named in advance, with the provider responsible for what they do.
• End of life. Who tracks support end dates for your hardware and software and warns you in time.
• Reporting. A monthly report on patch status, backup results, security alerts and missed targets.
• Term and exit. Notice period, renewal terms and everything the provider hands back when the contract ends.

How do you plan the exit before you sign?

Write the exit into the contract on day one, while both sides are on good terms. The exit pack should include every admin credential and service account, the asset register, network and configuration documents, the ticket history, the backup and monitoring setup, and written confirmation that the provider's access is removed and your data returned or deleted.

Then check the access yourself. The joint CISA and NCSC advisory warns that disabling provider accounts can be overlooked when a contract terminates. Our guide to switching IT provider in Dubai covers the handover week by week.

Which GR service fits each model?

If you have no IT staff, our managed IT services run your IT from the helpdesk and devices to Microsoft 365, security and backups, delivered remotely. If you have a team, the co-managed split above applies. On every GR IT AMC and GR Managed IT package, a P1 incident gets a 5 minute response, 24/7. To find the model that fits, tell us how your IT runs today.