The share of the IT budget in the overall expenses of French companies increases every year, but the results do not always follow. Between aging machine parks, poorly calibrated maintenance contracts, and European regulations tightening cybersecurity requirements, simply “keeping IT running” is no longer enough. The issue is no longer technical: it is structural.
Cyber Resilience Act: the new regulatory constraint that changes the game for IT services
The Cyber Resilience Act (EU Regulation 2024/2847), which came into force on December 10, 2024, imposes mandatory cybersecurity requirements on all products containing digital elements sold in the European Union. Hardware, software, connected objects: the coverage is broad.
Starting from September 11, 2026, manufacturers must report any actively exploited vulnerability and any serious incident affecting the security of their products within 24 hours. These reports go through centralized platforms managed by ENISA and national CSIRTs.
For a company that outsources all or part of its IT services, this regulation has direct consequences. The IT provider becomes a link in the compliance chain. A business software deployed without monitoring vulnerabilities exposes the client company to regulatory risk, not just technical.
Outsourcing contracts signed before this deadline deserve careful re-reading. Vulnerability management and incident notification must be explicitly included, or else the company may find itself with a provider that has no contractual obligation to report an exploited flaw in a tool it administers. Among the IT services of Digiterio, this regulatory dimension is part of the structural work areas for companies that want to align their IT systems with the new European obligations.
IT Outsourcing: What Contracts Don’t Always Say
Outsourcing IT management seems simple on paper. A provider takes care of maintenance, technical support, and sometimes cloud hosting. In practice, the quality of service depends on what is written (or not) in the contract.
Contractual Gray Areas to Check
- Data reversibility: in case of a change of provider, within what timeframe and in what format can data be retrieved? Some contracts specify nothing, creating a de facto dependency.
- The exact scope of support: a maintenance contract may cover hardware but exclude critical software updates, or include a limited number of interventions per month without clearly stating this cap.
- The location of hosted data: with GDPR and changes to the US Cloud Act, knowing whether servers are in France, the EU, or elsewhere is not a detail. Field feedback varies on the actual transparency of providers on this issue.
- Service Level Agreements (SLAs): an announced increase in availability rate means nothing without contractual penalties for non-compliance.
A well-negotiated outsourcing contract protects as much as a good firewall. A vague contract exposes the company to hidden costs and a gradual loss of control over its own information system.
Internal IT Department or External Provider: Decide Based on Size and Stakes
The question arises systematically: should one recruit an internal IT manager or entrust management to a provider? The answer depends less on the size of the company than on the criticality of the IT system in its operations.
A small to medium-sized enterprise whose core business relies on a web application needs internal IT expertise more than a consulting firm of 200 people using only a cloud office suite. The criticality of the IT system determines the model, not the number of employees.
What Internalization Brings (and What It Costs)
An internal IT manager knows the business processes, the users, and the specific constraints. This proximity speeds up incident resolution and allows for anticipating changes. However, salary costs, ongoing training, and technological monitoring weigh heavily on smaller structures.
What Outsourcing Allows (and What It Masks)
An external provider pools its skills across multiple clients. They generally have a broader technical scope (security, cloud, network). The risk: a superficial knowledge of the client’s business and response times that depend on the provider’s overall workload. Outsourcing works when the specifications are precise and the follow-up is regular.
IT Process Automation: Separating Real Gains from Marketing Speak
Automation has become an omnipresent selling point in IT service offerings. Automated deployment of updates, ticket management by artificial intelligence, self-service cloud provisioning: the promises are numerous.
Real gains exist, but they are conditional. Automating a poorly defined process amounts to industrializing a malfunction. Before deploying an automation tool, it is necessary to map existing flows, identify truly repetitive tasks, and measure the time actually lost.
Some cases where automation produces measurable results:
- Managing access rights during employee arrivals and departures, which often takes several hours in manual processing.
- Deploying security patches across a fleet of workstations, where the delay between the publication of a patch and its application is a direct risk factor.
- Proactive monitoring of servers and network equipment, which allows for detecting an anomaly before it becomes a failure.
The available data does not allow for generalizing a productivity gain rate. Results depend on the technical context, team maturity, and the quality of integration. A provider that announces a percentage reduction in costs without prior audit deserves some caution.
Choosing an IT provider commits the company for several years. Technical criteria matter, but the ability to support regulatory changes (such as the Cyber Resilience Act), contractual transparency, and the quality of human follow-up make the difference between a service that works and a service that protects.
