Who does the work: in-house staff, a managed service, or project vendors

Reference article · 9 min read

Every agency technology function eventually faces the same question: who does the work. A position goes vacant, a system needs watching outside business hours, or a project arrives with a deadline the current team cannot meet. Three answers exist: hire agency staff, contract a managed service provider to run a defined function, or engage vendors project by project. Most agencies use more than one of them.

The constraints pull against each other. In many jurisdictions, classification and compensation rules make public sector hiring slow, and authorized ranges for security, cloud, and data engineering roles can sit below what those skills command in the wider labor market. Contracting can solve the immediate problem, but a function operated outside the agency tends to take working knowledge with it, and an agency that cannot describe its own systems has difficulty writing a sound scope or holding a vendor accountable. The useful question is not which model is best in general. It is which work has to stay inside, and which model the agency can actually support.

Each section below states what the model is, where it fits, what it gives up, and where it is the weaker choice.

Hiring agency staff

What it is: an employee in an agency position, subject to the agency's classification, compensation, and civil service rules.

Where it fits: steady work the agency expects to need for years, work that turns on agency judgment or access to sensitive decisions, and work that cannot be specified precisely enough in advance to contract for it.

What it gives you: knowledge that stays with the agency, including the reasons a system was configured the way it was. An employee answers to agency management rather than to a scope of work, and absorbs the requests no statement of work anticipates. For predictable, continuous work held over a multi-year period, a filled position is often the lower cost per hour, though that comparison depends on salary and benefits, on the tools and training the agency has to supply, and on how fully the position is used.

What it costs: time and constraint. Classification, posting, screening, interviewing, and onboarding commonly run weeks to months. The authorized range may not attract candidates with the skills the work requires. One position cannot provide coverage outside business hours, a single specialist is a single point of failure during leave, and the knowledge concentrated in that person leaves at resignation unless the agency has required documentation all along. Skills also need continuing training that the agency has to fund.

Weaker fit: intermittent demand, a skill needed a few days a month, work that requires several specialties at once, or a position that recent recruitment experience suggests will not fill at the range available.

Contracting a managed service provider

What it is: a contract for an ongoing function operated to defined service levels. Common examples are help desk, network and server management, endpoint administration, and security monitoring.

Where it fits: continuous operations with outcomes the agency can describe and verify, coverage requirements beyond what the agency can staff, and functions that need several specialties where none of them is a full position.

What it gives you: coverage the agency cannot assemble alone, depth across specialties, and continuity of service when individual people leave the provider, since recruiting and backfill are the provider's responsibility. Providers can usually begin work sooner than a recruitment concludes, and they bring established tools and processes. Cost is predictable within the agreed scope. Whether tooling, licensing, and after-hours response are included varies by contract, so confirm what is in the fee rather than assuming.

What it costs: accountability reaches only as far as the service levels the agency defines and can measure from evidence it holds. Knowledge tends to migrate toward the provider over the term, which can make the next solicitation harder to write than the first. Scope boundaries produce disputes, and ticket-based measures can reward closing tickets rather than removing the causes. Transition at the end of the term is difficult when the contract did not require documentation, configuration, and administrative access to sit with the agency throughout. Staff changes at the provider still reach the agency as a loss of familiarity, even when service levels hold.

Weaker fit: work that turns on agency judgment, such as policy decisions, commitments of public funds, or decisions about retention and disclosure of records under applicable public records law. It is also a weak fit wherever no one inside has the time and technical depth to manage the contract.

Engaging vendors per project

What it is: a defined scope with defined deliverables and an end date. An implementation, a migration, an integration, an assessment.

Where it fits: bounded work with a recognizable finish, specialized expertise needed once or occasionally, and work funded from capital or grant sources whose period of performance matches a defined project. Grant terms vary, so confirm the period of performance and the allowable cost rules before planning around them.

What it gives you: concentrated expertise for the period it is needed, scope and price agreed before work starts, delivery risk carried by the vendor to the extent the contract assigns it, and the ability to compete each need on its own merits rather than carrying one provider across everything.

What it costs: each project carries a procurement cycle and a ramp-up in which a vendor learns an environment the previous vendor already learned. Nobody owns the system between projects unless someone is assigned, so integrations drift and maintenance slips. Hourly rates are usually higher than the hourly cost of an employee doing comparable work, although the comparison depends on how fully a position would be used. The reasoning behind design decisions leaves with the team that made them unless documentation and knowledge transfer are deliverables the agency reviews and accepts.

Weaker fit: continuous work such as monitoring, patching, and user support, and any project the agency cannot staff on its own side with someone empowered to make decisions.

How to decide

These are tests with observable answers. Run them in order and the model usually chooses itself.

Plot the demand, not the task. Look at a year of the work. Steady and roughly equal to a full position points to an employee. Steady but requiring more hours of coverage or more specialties than one position can hold points to a managed service. A spike with an end date points to a project.

Count the coverage window. If the requirement is response outside business hours or continuous monitoring, work out how many positions it takes to staff that rotation with leave and turnover accounted for. If the agency cannot fund and fill that number, the real choice is between a managed service and a reduced service expectation, not between a service and one hire.

Test whether the work can be specified. Can you describe the outcome precisely enough that a third party could be held to it, and verify the result from evidence the agency holds independently? If yes, a contract is viable. If the work depends on shifting priorities, unwritten context, or judgment calls each week, it belongs to employees.

Separate decisions from execution. Anything that sets policy, commits funds, grants access to systems or data, or determines what happens to a record needs an accountable employee. A contractor can prepare the analysis and carry out the decision. Owning the decision is different.

Check fillability against evidence, not hope. Review what comparable recruitments at your range produced: applications received, qualified candidates, offers declined, and time to fill. Repeated unsuccessful recruitment at the same range is evidence about the market, and the response is to change the range, the classification, the location requirement, or the model.

Name the contract owner and the hours. Every outsourced function needs someone inside who reads the reports, verifies the service levels, reviews invoices, and pushes back. Estimate the hours that takes and confirm they exist in someone's week. If no one has that time, the agency will not know whether it is receiving what it bought.

Decide what stays inside regardless of model. Architecture and design authority, data ownership, security accountability, and vendor management keep the agency a capable customer. These roles can be thin, but they cannot be absent.

Compare total cost over the same period, including exit. For hiring, count salary, benefits, recruitment, tools, training, and the cost of vacancy. For a managed service, count the fee, onboarding, agency management time, and the cost and duration of transition at the end of the term. For projects, count price, procurement time, agency staff time, ramp-up on each engagement, and who supports the result between projects. Hourly rates alone will mislead you.

Ask what each choice costs to undo. A model that is hard to reverse is not disqualified, but it has to be entered on terms that keep reversal possible: agency-held credentials, agency-owned documentation, and defined transition assistance.

What this means for your solicitation

For a managed service, scope by function and outcome rather than by task list. Specify service levels with a measurement method and reporting the agency can verify independently. Require that documentation and configuration live in agency-owned systems, keep an agency-held administrative account, and put transition assistance in the base contract with a stated duration and level of effort. Say who at the agency holds the contract.

For project work, scope by testable deliverables tied to acceptance criteria. Make documentation and knowledge transfer deliverables rather than courtesies, confirm in writing that the agency owns the code, data, and configuration, and name the agency staff who will work alongside the vendor from the start. Decide before award who supports the result afterward and how that support is funded.

If hiring is the preference and recruitment is the obstacle, the options usually worth examining are reclassifying the position, revisiting the range through the agency's compensation process, recruiting for remote or hybrid work where policy allows, establishing a qualified on-call list for surge capacity, and staff augmentation directed by agency managers while a recruitment continues. Availability of each depends on the agency's civil service and purchasing rules.

Most agencies end up with a mix of all three, which is reasonable when it is chosen. The problem is a mix nobody chose, assembled one vacancy and one emergency at a time, in which no one can say which functions the agency still controls. Review the mix as a whole on a set schedule rather than at each renewal in isolation.

HQT provides software development, cloud engineering, and cybersecurity services, and can be engaged either for defined projects or as an ongoing service.

Frequently asked questions

Is a managed service cheaper than hiring staff?

It depends on the coverage required and how long the need lasts. For a function that needs only business hours support and is expected to continue for years, a filled position is often cheaper per hour once it is filled. A managed service tends to compare better where the requirement is coverage outside business hours or several specialties at once, because neither is realistic for a single position. Compare fully loaded salary, tools, and training against the fee plus the internal time spent managing the contract, over the same span of years.

If we outsource operations, what should we keep in-house?

Keep the roles that make the agency a capable customer: someone who owns the architecture and the data, someone accountable for security posture and audit response, and someone who manages vendors and contracts. Those people do not have to perform the daily work, but they need enough technical depth to read reports critically and push back on what they are told. Agencies that retain none of these roles tend to accept whatever the provider proposes, because they have no independent basis for judging it.

Do we need a separate solicitation to contract with a managed service provider?

That depends on your agency's purchasing policy and thresholds, the estimated total value of the contract including option years, and whether a cooperative or statewide contract exists whose scope actually covers the services and which your agency is authorized to use. Ongoing managed services can reach a value that requires a formal solicitation and, in many jurisdictions, approval by the governing body. Ask your purchasing office early, because the route you use determines the calendar.

How is staff augmentation different from engaging a project vendor?

Staff augmentation places contracted people under the direction of agency managers, working on whatever the agency assigns. A project vendor takes responsibility for a defined outcome and manages its own team. Augmentation keeps control and knowledge closer to the agency but requires agency supervision and does not transfer delivery risk, which is why it is often used while a recruitment is underway. Some jurisdictions limit how contracted personnel may be used or how long an arrangement can run, so check your civil service and purchasing rules first.

How do we keep knowledge from leaving with a project vendor?

Make documentation, architecture diagrams, runbooks, and knowledge transfer sessions contract deliverables tied to acceptance and payment rather than favors requested at closeout. Assign agency staff to work alongside the vendor throughout the project, not only during testing. Confirm in the contract that the agency owns the source code, configuration, and data, and keep them in agency-controlled repositories while the work is underway.