Skip to content
Six in ten IT leaders (60%) base their confidence in their security on reports their IT provider produces or on its verbal assurance, and almost a third (31%) have found that something the provider said was in place was not working correctly. The findings come from new research by DNA IT Solutions and technology news provider TechCentral.
The survey of IT leaders and practitioners found that satisfaction with day-to-day service is relatively high, with 63% likely to recommend their provider. Confidence in security rests on narrower foundations.
The findings suggest the market for managed IT services is moving from relationships built on trust to relationships built on evidence with independent checks likely to become a normal part of the arrangement.
Commenting on the survey’s findings, Michael Rooney, Chief Technology Officer at DNA IT Solutions, said:
“Good providers have nothing to fear from being asked to show their work. The market is moving from trust to evidence, and our aim is to give IT leaders and their boards a clear, practical basis for holding any provider to account, including us.”
Confidence rests largely on the provider’s own word
When told their systems are secure, only 27% of respondents point to an independent assessment. Fewer than half (48%) have independently checked that their security tools are active and up to date.
That leaves the party responsible for the work also describing how well it was done, with no independent way of knowing what a report leaves out. Controls can fail quietly; a backup routine can show as completed in every monthly report while nobody has checked that a restore actually works.
Control of access, and the ability to leave
Forty-eight per cent of respondents do not know how many people at their provider hold full administrative access to their systems. That level of access can change settings, create users or switch off security protections. A technician who left the provider months ago could still hold an active account.
Leaving a provider would also be difficult for most. Fifty-nine per cent do not believe they could switch without significant disruption, which limits a business’s options if service falls short or the relationship ends.
Regulation puts oversight with the business
For organisations in scope, EU rules on cybersecurity and operational resilience make the business responsible for overseeing the providers it relies on. NIS2, which covers organisations in critical sectors and DORA, which applies to financial entities, set those expectations. These regulations place oversight duties on management bodies, making provider oversight a board matter as well as an IT one.
The conversation has some way to go. Fifty-seven per cent of respondents say their provider has never explained how it helps them meet those obligations, and 37% have never looked into whether their contract gives them recourse. A business could find a gap in its provider’s work without knowing what its contract allows it to do about it.
Businesses are already looking for a second view
Fifty-five per cent of respondents have sought a second opinion on their provider’s security advice, and 77% would consider independent verification of their provider’s work at a fixed annual cost. Building that kind of check into a regular governance cycle would add evidence while keeping the trust that already exists.
Organisations shouldn’t need regulation like NIS2 to force them to take security and operational responsibility seriously, according to Michael Rooney.
“Whether an organisation is regulated or not, it should operate to the same high standards: regularly checking its systems, validating its backups, testing its recovery capabilities and taking ownership of its overall security posture. These tasks should simply be part of good IT practice,” he said.
The report, Accountable Outsourcing, also includes a five-part governance framework and an appendix of eight questions any business can put to its provider.
It is available free at https://www.dnait.ie/accountable-outsourcing-request
Ends