Strategy
The comparison is rarely like for like. Here is the arithmetic and the coverage question that usually settles it.
An internal hire carries salary, employer contributions, benefits, equipment, training, tooling licences and the cost of the vacancy when they leave. A managed agreement carries a monthly fee and the cost of the things it excludes. Comparing a salary against a monthly fee alone will mislead you in both directions depending on which you started with.
One internal person is one person. They take holidays, they get sick, and they cannot hold deep knowledge of networking, identity, security and the three applications your business actually runs on. The question is not who is cheaper but what happens in the week they are away and something breaks.
Many organisations past roughly forty staff end up with an internal person who owns the floor, the applications and the relationships, and a provider who owns infrastructure, security, escalation and out of hours. That splits the work along the line where each side is genuinely better, and it removes the single point of failure.
More
PHIPA sets out specific circumstances that make reporting to the Information and Privacy Commissioner mandatory, plus an annual filing most clinics do not know about.
Read the note: When an Ontario clinic must report a privacy breach
The shared responsibility model puts availability on Microsoft and your data on you. Most Ontario businesses we assess have no third party backup of mail, SharePoint or OneDrive.
Read the note: Microsoft does not back up your Microsoft 365 data
A short read on what the federal privacy law expects from a commercial organisation, and the breach reporting obligation that catches people out.
