10.1 Sourcing Models & Commercial Considerations
Key Takeaways
- Sourcing strategy establishes how organizational capabilities, human resources, and technical assets across the Service Value System (SVS) are acquired, integrated, and governed.
- CDS names two common sourcing models, insourcing and outsourcing; outsourcing is further subdivided by vendor location into onshoring (same country), nearshoring (different country, minimal time-zone difference), and offshoring (different country, several time zones away).
- Organizations can contractually delegate operational execution and technical risk to external suppliers, but the customer organization permanently retains ultimate governance, legal compliance, and business accountability.
- Commodity services should leverage standardized, commercial offerings to maximize economies of scale, whereas core strategic differentiators warrant internal capability development and direct control.
- The organizational resources that remain after work is shifted to a vendor are called the retained organization, and effective commercial governance aligns customer SLAs with internal OLAs and external underpinning contracts through the Supplier Management practice.
10.1 Sourcing Models & Commercial Considerations
Quick Summary: Sourcing in ITIL 4 Create, Deliver and Support (CDS) is a strategic capability that shapes how value is co-created across the Service Value System (SVS). CDS names two common sourcing models — insourcing and outsourcing — and subdivides outsourcing by vendor location into onshoring, nearshoring, and offshoring. Weighed against commercial criteria such as CapEx versus OpEx, core competency versus commodity, risk transfer, and regulatory compliance, these choices determine delivery capability while ultimate business and governance accountability always remains with the customer organization.
Every digital enterprise must determine which capabilities to develop internally and which to acquire from external partners. Modern digital delivery rarely relies on a single entity; it functions as a collaborative network of internal engineering teams, cloud providers, and specialized service partners.
Sourcing Strategy Across the Service Value System
Sourcing decisions directly impact all activities within the ITIL Service Value Chain:
- Plan: Aligns the service portfolio with organizational capital constraints, risk tolerance, and time-to-market priorities.
- Design and Transition: Determines whether service architectures, UX design, and validation testing are executed by internal teams or specialized design agencies.
- Obtain/Build: Governs the acquisition of commercial off-the-shelf software, cloud infrastructure, or external development contracts.
- Deliver and Support: Decides whether frontline service desks, infrastructure monitoring, and field services are managed internally or through managed service providers.
Strategic sourcing evaluates holistic business outcomes rather than isolated labor rates. An offshore contract with low hourly rates that degrades user experience or slows release cadences ultimately destroys value.
What a Sourcing Model Actually Is
CDS is precise here, and the definition is broader than most candidates expect. A sourcing model is a component of an overall sourcing strategy. It describes topics such as:
- the conditions under which the organization will source a service component, or a specific type of component
- the roles and responsibilities of the vendor
- the degree of oversight the organization requires over vendor resources
- vendor assessment criteria — service levels, warranties and guarantees; geographic coverage; time to deliver
- general management policies — payment terms; use of preferred suppliers and an exception management process; use of RFI, RFQ, or RFP techniques; standard terms and conditions when engaging vendors
- financial management policies — capitalization of payments made for service components; acceptable price ranges or pricing models; tax reporting
An organization does not have one sourcing model — it may have many, reflecting line of business, budget accountability, the type of service component (one model for contractors, another for computing equipment, another for infrastructure), and its reporting, auditing, and compliance requirements. Within each line of business, those differences significantly change who is accountable and who is responsible for the work.
The Two Common Sourcing Models
CDS names two common sourcing models. Learn these first, because everything else in this topic is a subdivision or a market variant:
| Sourcing Model | Definition |
|---|---|
| Insourcing | The organization's existing resources are leveraged to create, deliver, and support service components. |
| Outsourcing | The organization transfers responsibility for the delivery of specific outputs, outcomes, functions, or entire products or services to a vendor — for example, using a local data centre vendor for computing and storage, or a recruitment agency to source candidates or contractors. |
The Retained Organization
When work is outsourced, the organizational resources that remain after the work has been shifted to a vendor are referred to as the retained organization. This term matters: the retained organization is what governs the vendor, and it is the entity that later staffs a retained service integration function.
Vendor Location: Onshoring, Nearshoring, and Offshoring
Outsourcing models are further subdivided based on the location of the vendors or their resources. There are three categories, and CDS scenarios distinguish them by time zone, not by distance or cost:
| Category | Definition | Worked Example |
|---|---|---|
| Onshoring | Vendors are in the same country. | A German organization contracting a Munich-based managed service provider. |
| Nearshoring | Vendors are located in a different country or continent, but there is a minimal difference in time zone. | A UK-based organization using a vendor in continental Europe. |
| Offshoring | Vendors are located in a different country or continent, often several time zones away. | A US-based organization using a vendor in India. |
[!WARNING] Exam Trap: Nearshoring vs. Offshoring Both involve a different country, so candidates guess. The single discriminator is the time-zone gap: minimal difference means nearshoring; several time zones means offshoring. A different continent on its own does not settle it.
[!NOTE] Where this categorization breaks down. CDS explicitly warns that vendor-location categories might not apply to many technology vendors or providers of cloud computing services (IaaS, SaaS, and similar), because the physical location of vendor resources is not always publicized. Do not force an onshore/nearshore/offshore label onto a hyperscale cloud contract.
Market Variants You Will Still Encounter
Two further arrangements appear constantly in real organizations and in exam scenario wording. They are not additional CDS sourcing models — they are ways of combining insourcing and outsourcing — but you should recognize them:
- Co-sourcing (blended delivery): internal teams and external providers work as one integrated unit, through staff augmentation or blended Agile squads. Strengths are elastic access to specialized talent, shared risk, and knowledge transfer back into the retained organization; the trade-off is coordination overhead and dual-reporting friction.
- Multi-sourcing (ecosystem delivery): the organization contracts several specialized best-of-breed suppliers for distinct components. Strengths are best-of-breed capability, reduced single-vendor dependence, and commercial leverage; the trade-off is integration complexity and cross-supplier finger-pointing — which is precisely the problem that service integration and management exists to solve (section 10.3).
| Arrangement | Operational Control | Financial Structure | Capability Retention | Primary Risk |
|---|---|---|---|---|
| Insourcing | Maximum / direct | Fixed capital and payroll | Complete | Skill stagnation; capacity constraints |
| Outsourcing | Indirect / contractual | Predictable recurring OpEx | Low / skills drain | Vendor lock-in; loss of agility |
| Co-sourcing | Shared / collaborative | Variable / blended rates | Moderate / knowledge transfer | Management friction; cultural silos |
| Multi-sourcing | Orchestrated / layered | Multiple supplier contracts | Domain-specific | Finger-pointing; integration breakdown |
Outsourcing Considerations
Many organizations outsource to reduce short-term operational costs, only to find that they have become constrained, are unable to pivot their business model, or are spending more in the long term. Outsourcing may lead to higher costs over time, because the organization has to bear higher costs to increase the scope of services and to manage the quality of deliverables — and it may incur travel costs if work is sent offshore.
A holistic approach reduces the likelihood of these negative impacts. CDS says it is important to consider:
- whether it is important to retain knowledge and skills that might potentially be sent offshore
- the enterprise risk management impacts of sending work offshore: which risks are mitigated, worsened, or created as a result
- whether the industry or scope of work supports outsourcing at all
- the cultural or language differences between the organization and the vendor
- whether and how much management overhead will be added by outsourcing the work
Commercial Considerations and Sourcing Criteria
Selecting an optimal sourcing model requires evaluating five commercial dimensions:
- Strategic Alignment and Speed to Market: If immediate deployment is required to capture market share, commercial SaaS or co-sourced squads deliver value faster than recruiting and training internal staff.
- Financial Architecture (CapEx vs. OpEx): Insourcing on-premises infrastructure demands substantial Capital Expenditures (CapEx)—upfront cash outlays depreciated over years. Sourcing through cloud and managed services shifts spending to Operational Expenditures (OpEx)—recurring, consumption-metered costs that scale dynamically with business volume.
- Core Competencies vs. Commodity Services:
- Core Competencies: Capabilities providing unique competitive advantage and market differentiation (e.g., proprietary fraud detection engines). These must be insourced or tightly co-sourced.
- Commodity Services: Standardized utility functions common across industries (e.g., email, payroll processing, network transit). These should be outsourced or procured via commercial services to leverage market scale.
- Risk Transfer vs. Accountability Retention: Organizations outsource operational execution to transfer specific risks (such as hardware failures or staffing gaps). However, ultimate accountability can never be outsourced. Legal authorities and customers hold the customer organization strictly accountable for regulatory compliance, security breaches, and service failures.
- Regulatory and Compliance Mandates: Statutory rules (e.g., GDPR, HIPAA, PCI-DSS) often impose strict data sovereignty and security auditing requirements that constrain offshore outsourcing.
Supplier Management Integration and Contracting
Sourcing success depends on disciplined execution of the ITIL 4 Supplier Management practice:
- Supplier Categorization (Tiering): Categorizing suppliers into Strategic (high value, high risk, joint governance), Tactical (significant commercial impact, performance-managed), Operational (routine operational delivery), and Commodity (standardized, interchangeable utilities).
- Contractual Alignment: Customer-facing Service Level Agreements (SLAs) must be supported by internal Operational Level Agreements (OLAs) and external Underpinning Contracts (UCs). A mismatch between customer SLAs and vendor UCs creates unrecoverable delivery failures.
- Exit Strategies: Every commercial contract must include sunset clauses, data portability provisions, transition assistance windows, and termination for convenience.
Critical Exam Traps & Practical Takeaways
[!WARNING] Exam Trap: Outsourcing Accountability
You can outsource operational tasks, maintenance, and technical execution, but you can NEVER outsource governance, legal compliance, and ultimate accountability. Regulators hold the customer organization liable regardless of vendor contract indemnifications.
[!IMPORTANT] Exam Trap: Outsourcing Core Competencies
Never outsource capabilities that form the foundation of your competitive advantage to cut short-term labor costs. Outsource commodity utilities; retain and protect core differentiating capabilities.
An enterprise considers outsourcing its customer database operations to an offshore managed service provider. The Chief Information Security Officer emphasizes that regardless of contractual indemnification clauses, the enterprise remains subject to regulatory fines if consumer data is compromised. How does ITIL 4 CDS characterize this governance principle?
A healthcare software enterprise needs to decide whether to insource or outsource the development of its proprietary diagnostic AI engine versus its internal employee payroll processing system. Based on ITIL 4 sourcing criteria regarding core competencies and commodity services, what is the most appropriate sourcing recommendation?
An organization transitions from managing its own physical data center hardware to contracting with multiple specialized cloud and SaaS vendors. Financially, how does this sourcing transition reshape the organization's cost structure?
A retail organization engages seven distinct specialized vendors for cloud infrastructure, network connectivity, database hosting, application maintenance, cybersecurity monitoring, logistics software, and customer support. However, during outages, each vendor claims their own component is operating normally and blames other suppliers for system downtime. What fundamental sourcing challenge is this organization experiencing?
A German manufacturer contracts an application support vendor whose delivery centre sits in a different country on another continent, roughly seven time zones away, meaning the vendor's working day barely overlaps with the manufacturer's. How does ITIL 4 CDS categorize this sourcing arrangement?