If you have 25 employees you probably don’t need a 5-person IT department. You may not need a one-person IT department, either. But you still have email accounts to manage, laptops to configure, employees to onboard and offboard, passwords to protect, data to back up, cybersecurity threats to worry about, software licenses to track and a half-dozen people asking why Teams is doing that weird thing again.

Small organizations have an interesting IT problem: they’re too small to staff every technology specialty internally, but they’re definitely not too small to need those specialties.

So what should you handle yourself, and what makes sense to outsource?

Keep the Things That Require Knowing Your Organization

Some technology decisions are really business decisions in disguise. Which applications should you use? How should employees collaborate? What information is particularly sensitive? Which technology investments are actually worth making? Those decisions need input from people who understand your organization, your staff and your priorities.

You don’t necessarily need someone internally who knows how to configure every Microsoft 365 security setting. But someone inside the organization should understand why you’re using Microsoft 365, what employees need from it and what you’re trying to accomplish. Think of it this way: you should own the destination. You don’t necessarily have to drive the bus.

Outsource the Things That Require Specialized Expertise

Cybersecurity is probably the clearest example. A 25-person organization may not be able to justify hiring a full-time cybersecurity specialist. Yet someone still needs to configure multifactor authentication, protect administrator accounts, monitor security alerts, manage endpoint protection, review permissions, maintain backups and make sure there’s a plan for responding to an incident.

The same applies to areas such as cloud administration, network configuration and data protection. These aren’t necessarily full-time jobs in a smaller organization, but when they need to be done, they need to be done correctly.

That’s exactly where outsourcing makes sense.

Outsource the Things That Happen Occasionally

Consider employee onboarding. If you are a growing organization, you might hire someone every few months. That doesn’t justify having a dedicated employee sitting around waiting to create accounts and configure laptops. But when Monday morning arrives and your new program director can’t log in, access SharePoint or connect to the printer, suddenly IT becomes extremely important.

Offboarding is even more critical. Accounts need to be disabled, company data secured, devices recovered and access to third-party applications removed promptly.

Backup and disaster recovery, security reviews, hardware replacements, software migrations and major Microsoft 365 changes fall into a similar category. You may not need these services every day, but you need access to someone who knows what they’re doing when you do.

Be Careful About Outsourcing Everything

This is where traditional managed IT services can sometimes be awkward for smaller organizations. A full-service Managed Service Provider (MSP) may bundle help desk, cybersecurity, monitoring, backups, Microsoft 365 administration, strategic consulting and other services into one monthly package.

That’s great if you need all of it. But what if you don’t?

Maybe your office manager handles basic onboarding perfectly well. Perhaps your employees rarely need help desk support. Maybe you’re comfortable managing your applications but would really like someone else handling cybersecurity, backups and Microsoft 365 administration.

Paying for services you don’t need simply because they’re part of a package doesn’t make much sense. And neither does trying to do everything yourself because the only alternative seems to be buying the whole package.

Think À La Carte, Not All-or-Nothing

For a smaller organization, the ideal IT model may look less like outsourcing the entire department and more like assembling one: Keep the things your staff handles well. Bring in outside expertise for the things they don’t. And change that mix as the organization grows.

That’s the thinking behind CGNET’s Custom Service Provider approach. Rather than requiring a small organization to purchase a traditional all-inclusive managed services package, we let customers choose the IT services they actually need—whether that’s cybersecurity, backup and disaster recovery, Microsoft 365 administration, onboarding and offboarding, help desk support, or occasional strategic guidance.

If six months from now you need something else, add it. If you don’t need a particular service any longer, drop it.

It’s not especially complicated.

Which, when it comes to IT, is kind of refreshing.

For over forty-three years, CGNET has provided state-of-the-art IT services to organizations of all sizes, across the globe. We’ve done it all, from IT and cybersecurity assessments to cloud services management to generative AI user training. Want to learn more about who we are and how we might be able to help you? If so, check out our website or send us a message!