Build or Buy? Deciding Between Internal IT and a Managed Service Provider
June 13, 2025
No Comments
In recent years, multinational companies have repeatedly faced multimillion-dollar fines for failing to notify regulators of data breaches within the legally mandated timeframe. In most of these cases, the IT team had already identified and contained the technical breach. However, legal was not informed in time, or the two groups misunderstood each other’s priorities. The result was delayed reporting, angry regulators and reputational damage.
This scenario plays out more often than many executives realize. On one side, IT departments are tasked with protecting systems, ensuring uptime, and preventing hackers from gaining access. On the other hand, Legal teams focus on interpreting regulations, preparing disclosures, and mitigating liability. Both groups are working toward the same ultimate goal: protecting the organization, but their approaches and languages are very different.
This article examines the reasons behind the IT-legal divide, the heightened stakes, and how risk managers can contribute to bridging this gap. By fostering collaboration between these two critical functions, companies can transform compliance from a reactive burden into a proactive driver of trust and resilience.
Despite working toward the same end goal—protecting the organization, IT and Legal often seem to operate in different universes. The reasons for this divide are rooted in priorities, language, and timeframes.
Until recently, the disconnect between IT and Legal might have been considered an internal inefficiency. Today, it is a material risk. The global regulatory landscape is expanding rapidly, and misalignment can have severe financial, reputational, and operational consequences.
Non-compliance can result in fines that stretch into the hundreds of millions. GDPR alone has issued fines exceeding $1.8 billion since 2018. Additionally, customers and investors are quick to lose trust if organizations appear secretive or unprepared.
An example of this is Marriott’s breach of the Starwood reservation system illustrates the cost of misalignment. While IT worked on remediation, the delay in communicating the incident compounded regulatory scrutiny, resulting in a $24 million fine from the UK’s Information Commissioner’s Office.
How To Bridge the Divide
If the gap between IT and Legal creates risk, the natural question is: how do organizations bridge it? The answer is not simply more meetings or another compliance checklist. It requires building shared understanding, embedding collaboration into governance, and giving both sides the tools to translate their priorities into a common risk management language.
Here are a few practical strategies that organizations can implement:
The first step in bridging the gap is to translate complex technical and legal concepts into terms that both sides can understand. Too often, IT describes vulnerabilities using acronyms and technical jargon, while Legal speaks in regulatory clauses that leave IT staff scratching their heads. A simple practice is to develop a cybersecurity–legal glossary that maps technical controls to legal obligations. By reframing security controls in legal terms, IT helps Legal understand risk in regulatory language. Likewise, Legal can break down obligations into operational terms that IT can act on.
Incident response is one of the most common points of failure between IT and Legal. IT teams move quickly to contain breaches, but without Legal in the loop, companies risk violating disclosure timelines or mishandling evidence. Leading organizations now ensure that Legal is not a bystander but an active participant in incident response. This means:
One of the simplest yet most powerful tools is a compliance mapping exercise that links IT controls directly to regulatory requirements. This prevents the all-too-common situation where IT deploys a control but Legal cannot explain how it satisfies regulatory language, or Legal drafts policies that IT cannot operationalize.
Visual matrices or dashboards that show these links allow both IT and Legal to reference the same “map” when preparing for audits or board presentations. This alignment reduces duplication of effort and ensures everyone is speaking from the same playbook.
Compliance should not be left to siloed teams. Many organizations are now establishing cross-functional cybersecurity governance committees that encompass leaders from IT, Legal, Compliance, and Risk Management.
These committees meet regularly to:
By institutionalizing this collaboration, organizations move beyond ad-hoc coordination and embed it into their governance framework. Over time, this prevents the silo mentality and creates shared ownership of compliance. Perhaps the most powerful bridge is the relationship between the Chief Information Security Officer (CISO) and the General Counsel (GC). When these two leaders are aligned, they can act as translators between their teams and as advocates to the board.
While culture and communication are the foundation, technology can support collaboration. Governance, Risk, and Compliance (GRC) platforms, regulatory mapping tools, and risk dashboards allow IT and Legal to see the same risks in a single pane of glass.
For example, a GRC dashboard might show:
By centralizing information, these platforms reduce misunderstandings and make compliance a shared, data-driven process. Importantly, though, technology cannot solve cultural divides, it only enables more effective collaboration.
Bridging the IT–Legal divide is not just the responsibility of those two departments. Risk management professionals are uniquely positioned to serve as translators and integrators across the enterprise.
Risk managers already operate at the intersection of operational, financial, and compliance risks. They possess the skillset to quantify abstract issues, such as “data breach exposure,” in terms of tangible business impact—lost revenue, regulatory fines, or shareholder lawsuits. This makes them natural mediators between IT’s technical concerns and Legal’s regulatory interpretations.
Risk managers also play a cultural role. By framing cybersecurity compliance as an enterprise risk rather than a narrow IT or Legal issue, they elevate the conversation to the boardroom. This shifts the narrative from “IT problem” or “legal obligation” to “business resilience and stakeholder trust.”
The gap between IT and Legal is real, with serious consequences if left unaddressed; it leads to missed regulatory deadlines, duplicated efforts, and avoidable fines. But it does not have to be this way.
By creating a shared vocabulary, embedding Legal into incident response, mapping controls to obligations, and building joint governance structures, organizations can transform compliance from a reactive burden into a proactive strength. Cybersecurity compliance is no longer just about avoiding fines; it is also about protecting critical assets. It is about demonstrating resilience, accountability, and leadership. Bridging the IT–Legal divide is the first step toward that goal.
