I used to work at a CPA firm with an in-house IT department, and I could usually install approved hardware utilities and software updates myself, such as Logitech tools, Adobe PDF software, and Elgato applications. I recently moved to a smaller firm that uses an external IT provider, and now I have to wait for them to approve or install nearly everything. That can be especially frustrating when I work on weekends and a required update prevents something from functioning.
Is this level of restriction and delay typical for companies using an external IT provider? Is the difference mainly because outsourced IT follows stricter security policies, or was my previous employer simply more relaxed about local administrator access and software downloads?
4 Answers
The restriction itself is normal and is mostly about security, not whether IT is internal or external. Giving everyone administrator access means a convincing malicious download, fake update, or infected driver could compromise the computer and potentially the entire company. Financial firms are especially attractive targets, so limiting installs is generally the responsible approach.
That said, users should not have to wait indefinitely for common tools. IT can maintain an approved software catalog, automatically deploy updates, or use an on-demand elevation system for vetted applications. Your old company may have had approved download sources or simply been much more permissive without you seeing the risks.
There is always a tradeoff between convenience and control, but preventing users from installing arbitrary software is now a fairly standard security measure. Attackers hide malware in fake installers, advertisements, browser extensions, drivers, and even seemingly legitimate software packages. IT also has to track vulnerabilities, patching, authentication, and company data—not just make peripherals work.
The restriction is reasonable; the weak point may be the process around it. Common hardware and productivity software should be tested and available through a managed catalog, and critical updates should not depend on someone noticing a ticket during the workweek.
Your previous IT department may simply have been lax. Many smaller organizations leave users as local administrators because it is convenient, even though that creates substantial risk. A good setup would let employees request approved applications, install them without full admin access, and have routine patches happen automatically outside working hours.
I would raise specific examples with whoever manages the IT relationship: missing Adobe software, required device utilities, weekend work, and how long approvals take. Ask whether those applications can be placed on an approved list rather than arguing for unrestricted downloads.
An external provider usually works according to the service agreement and its priority rules. If your firm only pays for basic support, weekend requests or routine software installs may wait until normal business hours. An in-house team may have been more responsive because they knew the staff personally, worked during busy season, or had more freedom to make exceptions.
This does not automatically mean the provider is bad, but the firm should ask about response times, weekend coverage, and a faster process for standard software. The business may need to pay for a higher support tier or better endpoint management if delays are affecting work.
That makes sense. I mostly used Logitech software, so there may have been approved sources or policies I never knew about. I was probably comparing two very different security setups.