Short answer: yes, the rule allows it. The Safeguards Rule lets your Qualified Individual work for you, an affiliate or a service provider, and that includes your managed IT provider. Plenty of businesses do exactly this.
The real question is whether it's a good idea.
The problem: checking your own work
A QI's job is to oversee and enforce your security program: to decide whether the controls are good enough, test them, and report honestly to ownership about what's working and what isn't.
When your IT provider is also your QI, the company that set up your firewall, manages your MFA and patches your servers is the one deciding whether all of that is adequate. It's the same reason companies don't let their bookkeeper audit their own books. It isn't that anyone is dishonest. Independent review simply catches things that self-review misses.
It also creates an awkward incentive. A QI who finds a serious gap has to report it to your owners. When the gap is in the QI's own work, that report is much harder to write.
If you do use your IT provider as QI
Make sure the rule's conditions for an outside QI are met:
- You keep responsibility. The rule is clear that compliance stays with your business.
- Designate a senior person on your staff to direct and oversee the QI.
- Require the provider to maintain its own security program that protects you. Put it in the contract.
Then add a few protections the rule doesn't spell out:
- Get the annual written report directly, and read it.
- Have penetration tests done by a third party, not by the provider being tested.
- Ask who inside the IT company is actually named as your QI, and what their security background is.
The alternative: an independent QI
An independent QI oversees your IT provider instead of replacing it. Your IT company keeps doing the work. The QI sets the program, verifies the controls, reviews vendors and reports to ownership. When a gap turns up, fixing it is simply the next item on the list, with no conflict of interest. See what a QI does.
That's the model we use at DesignatedQI. Get in touch and we'll look at your current setup.