Costs
MSP or in-house IT for security: costs and trade-offs for Canadian small businesses
How a Canadian small business can compare a managed service provider with an in-house IT hire for security, including wage data, payroll costs and contract points.
What to take away
- You stay legally responsible for your data whichever route you pick. Under Canadian federal guidance, the organization is the data owner and keeps accountability for incident response even when a provider carries out some of the steps.
- An in-house hire has a visible costa wage plus employer payroll contributions. An MSP's cost is a contract, so compare what the contract actually covers.
- One person cannot cover every shift, holiday and skill. A provider spreads that coverage, but adds a supplier you must vet.
- Whichever route you choose, the same foundations applyunique passwords, multi-factor authentication, updates, tested backups, training and a written incident plan.
What are you actually comparing?
A managed service provider (MSP) is an outside company that can remotely manage or host all or part of your IT, monitor and patch security devices and systems, and take actions to prevent compromises. The Canadian Centre for Cyber Security describes such services as often offered on demand, so cost and complexity can scale to the organization's needs. An in-house option means one or more employees who run the same work inside the business.
The comparison is rarely all or nothing. Many small firms keep a generalist employee for day-to-day support and buy specialist monitoring from a provider. Others have no IT employee at all and treat the provider as the whole department. Decide which work you need done, then price each route against that list.
A useful starting list comes from the Cyber Centre's foundational actions for small organizations: unique passwords of at least 12 characters with multi-factor authentication, timely security updates, a backup schedule with tested recovery, anti-malware and a firewall, staff training, and an incident response plan. If you do not know who owns each item today, that gap matters more than the in-house versus MSP choice.
What does an in-house hire cost?
Start with the wage. Job Bank, the federal government's labour market site, reports hourly wages for computer network technicians (NOC 22220) in Canada of $21.00 at the low end, $36.00 at the median and $55.00 at the high end. The figures use Statistics Canada Labour Force Survey data for 2023 and 2024 and were updated on November 19, 2025. Job Bank describes the median as the point where half of workers earn more and half earn less.
As an illustration, $36.00 an hour over a 37.5 hour week for 52 weeks comes to about $70,200 a year before anything else. That is arithmetic on the median, not a quote: your own pay will depend on the city, the skills you need and the competition for candidates.
Then add the employer's side. The Canada Revenue Agency lists the 2026 Canada Pension Plan contribution rate at 5.95 percent for the employer, on pensionable earnings up to $74,600 with a basic exemption of $3,500. The maximum annual employer contribution is $4,230.45. Employment Insurance premiums, vacation pay, benefits, equipment, training and certifications come on top, and each has its own rules for your province. Use the CRA's payroll pages and your accountant to price these for a real offer.
Also price the risks that a payroll line does not show. One employee cannot be on call every night and weekend. When that person is sick, on leave or leaves the company, the knowledge goes too. Keep documentation current, and keep admin credentials and recovery details in a place the business controls.
What does an MSP cost?
Public, official price data for MSP contracts does not exist in the way it does for wages, and the Cyber Centre's small-organization guidance gives no dollar figures. Treat any price list you find as the provider's own claim and ask each bidder to price the same scope in writing.
The drivers are consistent across most quotes:
- Scope.Help desk only, patching and monitoring, or a full security service with incident response.
- Size.The number of users, devices, servers and cloud accounts under management.
- Hours.Business-hours support versus round-the-clock monitoring.
- Extras.Projects such as migrations, onboarding and audits, and whether they sit inside or outside the monthly fee.
- Exit terms.Contract length, notice periods and the cost of moving to another provider.
Compare quotes on what happens when something goes wrong, not on the monthly line alone. A cheaper contract that charges separately for every incident call may cost more in a bad month than a broader one.
What should a provider contract say?
The Cyber Centre's guidance on consuming managed services is a ready-made checklist. Its main points for a buyer:
- Responsibilities.Define your security requirements before signing and agree roles and escalation paths. You remain accountable for incident response and for establishing and testing a disaster recovery plan, even if the provider handles part of it.
- Service levels.The service agreement should specify turnaround times, communication channels, escalation, performance metrics and penalties for missed turnarounds. Set the maximum downtime you can tolerate and the data loss you can accept per incident type, since that decides how often backups run.
- Incident reporting.Ask how fast the provider will tell you about incidents affecting your data, confirm an emergency contact, and clarify which logs you receive and how.
- Access control.Least privilege, audit trails of administrator actions, separate admin accounts and two-factor authentication. The page notes that two passwords, or a password and a PIN, do not count as true two-factor authentication.
- Data location.For sensitive data, the Cyber Centre recommends data centres in Canada for non-government organizations, and asks you to confirm where backups, copies and logs are stored.
- Assurance.Ask for third-party evidence such as ISO 27001 certification or a SOC report, and ask who the provider's own suppliers are.
- Exit.Discuss data portability before signing, who owns the data at the end of the contract, what moving to another provider costs, and what happens if the provider goes bankrupt.
The Cyber Centre also warns that MSPs are attractive targets because they have access to many client systems. A strong provider limits and logs its own access to your systems. Our vendor risk assessment guide covers the supplier questions in more depth.
Does outsourcing change your privacy duties?
No. Under the federal private-sector privacy law (PIPEDA), the Office of the Privacy Commissioner of Canada says that when you hand personal information to a service provider you generally remain responsible for reporting, notifying and record-keeping for breaches that occur there, and your contracts should cover these obligations.
The reporting trigger is a breach involving personal information under your control that creates a real risk of significant harm. The Office says to assess two factors, the sensitivity of the information and the probability of misuse. Notify affected people as soon as feasible, and keep a record of every breach, whether or not it meets the reporting threshold, for two years. In practice, this means your MSP contract should say how quickly the provider tells you about a breach and what information it gives you. Without that, your own incident response process starts late.
How to choose
Ask five questions, in this order:
- Which tasks must happen outside business hours?Monitoring and incident response at night usually favour a provider.
- How much work is routine?Steady daily support for a few dozen staff can justify an employee. Occasional projects rarely do.
- Who can evaluate the work?If nobody in the business can read a security report, a provider's output is hard to check. A part-time adviser or a named internal owner helps either way.
- What is the cost of a bad week?Price the downtime to your business, then compare it with the service levels each option offers.
- How reversible is the choice?A one-year contract with clear exit terms is easier to leave than a multi-year lock-in. Hiring is also reversible, but slowly.
A hybrid is often the practical answer for a firm of this size: an internal owner for access decisions and vendor oversight, with a provider for monitoring, patching and out-of-hours coverage. Whoever does the work, test that backup and recovery works, and turn on multi-factor authentication for every account that supports it. The security foundations controls page lists the baseline either route should deliver.
