Outsourcing changes who performs the work. It does not change who is accountable. Under the FCA's SYSC provisions on outsourcing and operational risk, your firm retains full responsibility for the services you deliver, regardless of how much technology sits with a third party. Regulators have been explicit that firms cannot delegate away their obligations.

What this means in practice is that your IT provider becomes part of your regulatory surface area. You will need documented due diligence on us, a contract with meaningful service levels and exit provisions, oversight arrangements that are actually exercised, and an understanding of our own resilience and sub-contractor chain.

We are used to this. We expect to complete supplier due diligence questionnaires, provide documentation for your outsourcing register, and attend governance meetings where technology risk is on the agenda. We would far rather your compliance function has a clear, evidenced view of what we do than treat oversight as an inconvenience.

The PS21/3 transition period ended on 31 March 2025, and firms are now in what regulators describe as the ongoing operational phase. Important business services, impact tolerances, mapping and scenario testing all need reviewing at least annually — and more often after any material change.

Our role is to make the technology half of that credible. We help you map which systems, suppliers and data flows actually underpin each important business service, which is frequently more tangled than firms expect. We then align backup and recovery design to your stated impact tolerances, so the technical reality matches the number on the page.

From there, we run disaster recovery and failover testing on a scheduled basis and document the outcomes, including where something did not work as intended — because a self-assessment with no identified vulnerabilities tends to attract more questions, not fewer. We also maintain the monitoring, incident records and change history that evidence resilience continuously, rather than as an annual exercise.

Ask for evidence, not adjectives. The certifications that carry genuine weight in this sector are ISO 27001 for information security management, Cyber Essentials and Cyber Essentials Plus for baseline technical controls, and relevant Microsoft partner designations for the platforms you actually run.

Beyond badges, ask harder questions. Are engineers who access your systems background-checked, and to what level? How is privileged access to your tenant controlled and logged on the provider's side? When was their own incident response plan last tested? Do they carry appropriate professional indemnity and cyber liability cover?

A provider that answers these comfortably has been asked them before, which is itself a useful signal. One that deflects to general reassurance has not.

Record-keeping obligations vary considerably depending on your permissions and activities. Firms subject to MiFID II communications requirements face particular demands around capturing and retaining relevant telephone and electronic communications, with retention periods that can extend well beyond five years where a regulator requires it. UK GDPR pulls in the opposite direction, requiring that personal data is not kept longer than necessary.

Reconciling those two pressures is a design decision, not a default setting. We implement retention and archiving that reflects your specific obligations: immutable archiving where records must be tamper-evident, defensible deletion where data has served its purpose, and search and retrieval that works quickly under pressure rather than in theory.

We also make sure the practical side holds up. Archives should be searchable by non-technical compliance staff, and coverage should extend to the channels your people genuinely use — including Teams and mobile — rather than email alone.

Speed matters, and so does sequence. Our managed SOC monitors continuously, so suspicious activity — an impossible-travel login, unusual mailbox rules, credential exposure, endpoint compromise — is surfaced and triaged rather than sitting in a queue until Monday.

On confirmation of an incident, we move to containment: isolating affected devices, revoking sessions and tokens, forcing credential resets, and closing the route in. In parallel we preserve evidence properly, because premature clean-up frequently destroys the forensic trail you later need for your own investigation and for the regulator.

We then support your reporting obligations rather than making those calls for you. Personal data breaches meeting the threshold generally require notification to the ICO within 72 hours, and material incidents may trigger FCA notification requirements. Those are decisions for your compliance and legal teams — our job is to give them accurate, timely technical facts to decide on, along with a written timeline, root cause analysis and remediation plan.

Specialist support for regulated firms in the UK broadly sits between £70 and £150 per user per month, with most established financial services firms landing somewhere in the middle. The spread is wide because the label covers very different things.

The main cost drivers are security depth (a managed SOC costs meaningfully more than endpoint protection alone), support hours (24/7 versus business hours), compliance workload (documentation, evidence packs and audit support take real time), infrastructure complexity, and the balance of on-site and remote cover.

Be cautious of quotes at the bottom end of the general SME market. They are typically priced for organisations without regulatory obligations, and the gap tends to reveal itself as out-of-scope charges precisely when you need something most. Our pricing is a fixed monthly fee with the scope defined clearly in advance, so budgeting is predictable and your finance director is not managing a variable line item.

Yes — and it is one of the areas where we differ from most London-focused providers. Northern Star already acts as the European IT arm for multinational organisations, delivering local support in line with corporate IT standards and procedures set by a head office elsewhere.

For financial services firms, this matters more than it might for other sectors. Fragmented arrangements across jurisdictions create inconsistent security controls, patchy evidence and gaps in oversight that are genuinely difficult to explain to a regulator. A single provider applying one standard across every location removes that problem.

Practically, we combine a central service desk with scheduled on-site embedded days at satellite offices, so overseas teams receive the same support as your London headquarters. Your account manager coordinates across locations and joins your internal IT calls, keeping visibility and control with you.

Yes. Plenty of financial services firms have a capable IT manager or small internal team who are simply stretched too thin — covering user support, security monitoring, project work, supplier management and compliance evidence with far too few hours in the week.

A co-managed arrangement lets you decide the split. Some clients keep strategy and business-facing systems in-house while we take first-line support, out-of-hours cover and security monitoring. Others retain day-to-day support internally and bring us in for the specialist layer: SOC services, cloud architecture, migrations or resilience testing.

This is often the sensible route where internal knowledge of bespoke or sector-specific applications is hard to replace. It also provides genuine continuity cover, so annual leave or a resignation does not leave your firm exposed. We are equally comfortable reporting into an internal IT lead as working with your board.

Switching is generally less disruptive than firms fear, provided it is planned rather than rushed. Most Northern Star clients are onboarded within two to four weeks, and a well-run transition should not require downtime beyond agreed maintenance windows.

The process starts with a full audit of your environment: systems, licences, suppliers, security posture, documentation and — importantly — the undocumented arrangements that inevitably exist. We then agree a transition plan with defined milestones and a clear cutover date, running in parallel with your incumbent wherever possible so nothing depends on their goodwill during handover.

For regulated firms, the transition itself needs evidencing: administrative credentials transferred and rotated securely, the outgoing provider's access removed and confirmed, and the whole handover documented for your outsourcing records. We handle contract notice periods, data extraction and supplier novation as part of the process, and your account manager remains the single point of contact throughout.