Short answer: a 10 to 50-person company rarely needs a full-time IT administrator, but outsourcing isn't a magic word either. You can outsource the work, not the responsibility. Your data, your users, your access rights and management's accountability stay with you even if an outside partner manages every laptop and server. So the right question isn't "in-house or outsourced", but who does what, how fast, and who checks.
In most SMEs, IT operations aren't the result of a deliberate decision; they just happened. A colleague "is good with computers", or there's a contractor someone knows who gets called when something breaks. As long as nothing breaks, it works. When ransomware hits, a laptop goes missing or a server goes down, it turns out nobody knows where the backups are, who has access to what, or who is responsible.
Signs your current setup isn't working
Before deciding between in-house and outsourced, check whether what you have now works. Warning signs:
- nobody can say where the backups are, or when a restore was last tested;
- passwords live with one person, or in a spreadsheet everyone can open;
- people who left months ago still have active accounts;
- updates happen "when someone gets round to it";
- the same problems keep coming back, and get fixed the same way every time;
- nobody knows how many licences you pay for, or who uses them.
If several of these sound familiar, the question isn't really in-house versus outsourced. It's that nobody owns IT operations. Fix that first, whichever model you choose. A new partner or a new hire can't solve a problem nobody has defined.
What IT operations means in an SME
IT operations isn't just "fixing computers". In a typical small or mid-sized company it covers:
- user management: logins, permissions, onboarding new staff and offboarding leavers;
- devices: setting up, updating and tracking laptops, phones and printers;
- updates and patches: operating systems, applications, firewall, router;
- backups: and, more importantly, testing the restore;
- network and internet: Wi-Fi, VPN, remote work;
- cloud services: Microsoft 365 or Google Workspace settings and licences;
- security: antivirus, multi-factor authentication, logging;
- helpdesk: when someone calls to say "it doesn't work".
That's a lot of different knowledge. Rare is the single person who's good at all of it and can still take a holiday.
Your own IT administrator: when it makes sense
An in-house person knows the company, is on site and works only for you. It makes sense when:
- the company is big enough that there's a steady full-time workload;
- there's a lot of on-site work: production lines, warehouses, several sites, many devices;
- you run specialised in-house systems few people know;
- you need fast, physical presence, and delays cost money.
The downside: one person is one person. If they're on holiday, ill or leave, the knowledge goes with them. Eurostat found that 57.5% of EU companies looking for IT specialists in 2023 had trouble filling the vacancy, and 53.4% of small ones. Finding and keeping a good administrator isn't easy for an SME.
A managed service provider: when it makes sense
An outside partner, a managed service provider (MSP), gives you a team rather than a person: several specialisms, cover for absences and a predictable monthly fee. It makes sense when:
- the company is smaller, without a full-time job's worth of steady IT work;
- your systems are standard: a cloud office suite, a few applications, laptops;
- you need broader knowledge than one person can bring: network, security, cloud, backup;
- you want predictable costs on a monthly fee.
Prices vary widely by country, company size and what's included. When comparing offers, the monthly fee isn't the most important number; what's in it, and what isn't, matters more.
How to compare costs
Don't compare an in-house administrator and an MSP on salary versus monthly fee. The real cost of your own person includes:
- salary and employer's contributions;
- recruitment and onboarding time;
- training, because technology keeps changing;
- devices and licences for management tools;
- cover for holidays and sick leave, which nobody usually plans for.
Next to an MSP's monthly fee, write down what counts as extra work: site visits, projects, setting up new devices, out-of-hours fixes. Two offers are only comparable if they price the same task list.
There's a third item that never appears on an invoice: the cost of downtime. If email or invoicing is down for half a day, that can cost more than a month of IT support. That's why response time isn't a convenience; it's money.
Remote or on-site?
Most operations work can be done remotely today: cloud services, updates, user management and backup monitoring. On-site presence is mainly needed for network equipment, printers, rolling out new machines and physical faults. Ask how quickly the partner can get to you when they must, and whether it's included in the fee.
The mixed setup
In most SMEs the best answer is somewhere in between:
- one internal owner, not necessarily a full-time IT person, who knows the company, makes decisions and keeps in touch;
- an MSP for day-to-day work, updates, backups and security;
- specialists as needed for projects: migrations, new system rollouts, security assessments.
The point is that decisions and knowledge stay in the company, while capacity stays flexible.
What stays with you when you outsource
This is what most people get wrong. Under the cloud shared responsibility model, as Microsoft describes it, the customer always remains responsible for data, user accounts, devices and access management, whatever the type of service. Microsoft makes sure its servers run, not who can read your email.
The same is true of an MSP. They can do the work, but:
- your data is your responsibility, even if they back it up;
- you decide who gets which permissions;
- management's accountability can't be handed over.
The last point matters especially if your company falls under the NIS2 directive. Hungary's Cybersecurity Act, for example, which implements NIS2, keeps the responsibility with company leadership even when operations or security tasks are done by an outside partner. If you're in scope, choosing and overseeing your MSP is itself part of compliance.
What to ask an MSP
The UK National Cyber Security Centre (NCSC) guide for SMEs recommends writing specific expectations into the agreement. Its examples: a response within one hour for urgent issues, within one working day for minor ones, and critical security patches installed within 14 days.
Beyond that, ask:
- What's in the monthly fee, and what counts as extra work?
- Who can access your systems, and how? Do they use multi-factor authentication on their side too?
- How do they back up, where to, and how often do they test the restore?
- What happens in an incident: who notifies whom, and how fast?
- What do you get if you switch: passwords, documentation, configurations, access?
- Do you get regular reports: updates, backups, incidents?
What goes in the contract
Access in your name. The domain, cloud accounts and admin rights should belong to the company, not the MSP. If you switch, you shouldn't have to "ask back" for your own systems.
Documentation. What runs where, with what settings, and who has access. It's your property and part of the contract.
An exit plan. What the MSP hands over when the contract ends, in what format and by when.
Measurable terms. Response times, patch deadlines, reports. What isn't written down can't be enforced.
Where most small companies stand
According to Eurostat, only 29.35% of small EU companies carried out an IT risk assessment in 2024, against 75.62% of large ones. Most small companies don't know exactly what their biggest risk is. One of a good partner's first jobs is to find out: what you have, where it is, who can access it, and what would happen if it stopped tomorrow. ENISA, the EU cybersecurity agency, publishes practical guidance for SMEs that's a good starting point for this.
Common mistakes
The contractor someone knows, with nothing on paper. It works while everything's fine. When it isn't, it turns out nothing is written down and they hold every password.
Comparing monthly fees only. A cheap offer often means backups, security or site visits are extra.
No internal owner. If nobody in the company understands what the MSP does, nobody can check it.
Nobody has tested the backup. A backup is only worth something if you can restore from it. Test it regularly.
A leaver's account stays active. User management is boring, but it's one of the most common security gaps.
Nobody reads the report. If the MSP sends a monthly report on updates and backups, someone has to read it and ask when something is red.
How to switch if things are messy now
- Take stock: devices, accounts, systems, backups, who has access to what.
- Recover access: the domain, cloud accounts and admin rights should be in the company's name.
- Write down your expectations: response times, backup, security, reporting.
- Get two or three offers, and ask each the same questions.
- Plan a handover period when both the old and new partner are reachable.
- Name an internal owner, and review the agreement yearly.
If you'd like us to review your IT operations and access rights, or help you find the right setup, have a look at our infrastructure and IT outsourcing services.
FAQ
Does an SME need its own IT administrator?
A 10 to 50-person company on standard systems rarely does. It makes sense when there's a steady full-time workload, a lot of on-site work, or specialised in-house systems.
What response times should we ask an MSP for?
The NCSC guide gives as examples a response within one hour for urgent issues, within one working day for minor ones, and 14 days for critical security patches.
If we outsource IT operations, who is responsible?
Data, access rights and management's accountability stay with you. Under NIS2 implementations such as Hungary's Cybersecurity Act, leadership's responsibility can't be handed to an outside partner.
What should be in an MSP contract?
Response times, backup and restore, access rights, reporting, documentation and an exit plan. The domain, cloud accounts and admin rights should be in the company's name.
How many small companies assess their IT risks?
According to Eurostat, 29.35% of small EU companies carried out an IT risk assessment in 2024, against 75.62% of large ones.
Sources
- NCSC – Choosing a managed service provider (MSP)
- Microsoft Learn – Shared responsibility in the cloud
- NKI – Guide to the scope of Hungary's Cybersecurity Act (in Hungarian)
- Eurostat – ICT security in enterprises
- Eurostat – ICT specialists – statistics on hard-to-fill vacancies in enterprises
- ENISA – Cybersecurity for SMEs
