The Decision That Outlasts the Award
In secure facility operations, choosing between self-performed facility services and subcontracting is not a philosophical debate. Rather, it is a risk-allocation choice. That choice sets response time, technical depth, compliance exposure, and how defensible the commercial model looks in a year-three audit.
It also quietly outlasts the contract award. If you pick a sourcing model on labor-rate math alone, you inherit it when readiness slips, when an incident report needs a single owner, and when the next renewal arrives.
What the Evidence Actually Says
On self-performed facility services, the published evidence does not support an absolute answer. Instead, it supports a capability-based one.
McKinsey’s facilities-management sourcing research identifies a consistent pattern: manufacturers commonly outsource soft services such as landscaping and janitorial, while they typically keep hard services such as utility-equipment maintenance in-house. McKinsey also documents a company that outsourced its indirect-procurement function, missed savings, and then brought it back in-house. After that, the company achieved additional cost reductions of more than 10 percent in just over a year.
GAO’s 2023 F-35 sustainment review reaches a parallel conclusion from the defense side. The program relied heavily on the contractor to lead sustainment, technical data and training gaps degraded readiness, and fleet mission-capable rates sat near 55 percent in March 2023. GAO concluded that DoD needed to reassess the future mix of government and contractor roles. The lesson also translates directly to secure-facility operations: when the mission depends on technical knowledge, documentation access, and real-time decision authority, overreliance on external control degrades responsiveness.
So the principle is consistent: keep control where failure is expensive. Buy flexibility where capacity is volatile. Govern the interface with measurable outcomes.
Self-Performed Facility Services, Subcontracting, or Hybrid?
Self-performed is strongest when services are mission-critical, technically sensitive, or dependent on retained site knowledge and direct response authority. Cleared, trained technicians produce the response time and audit defensibility that secure portfolios require. McKinsey explicitly notes that manufacturers usually keep utility-equipment maintenance in-house. In secure spaces, the same logic therefore applies to most hard services.
Subcontracted is the right commercial choice for standardized, lower-criticality, or variable-demand services where specialist scale and supplier competition outweigh the value of retained internal labor. McKinsey’s documented savings cases — a 15 percent reduction at a retailer, more than $150 million over three years at a global financial institution — came from category clarity, supplier consolidation, and sourcing discipline. Not from subcontracting alone.
Hybrid is usually the safest model in secure manufacturing and defense industrial-base portfolios. Critical hard services and incident response stay under direct control. Meanwhile, soft services and overflow flex through an integrated partner. Vendor consolidation in FM produces compounding benefit only when the integration runs through one governed operating model — not when it produces administrative consolidation without operational control.
Three Disciplines That Make Any Model Hold Up
However, the sourcing model is only half of a defensible decision. The other half is how you write the solicitation.
First, classify work by mission consequence rather than by trade name. If downtime affects production continuity, life safety, controlled environments, or classified operations, start from self-performed facility services or a hybrid with direct control.
Second, write outcome-based requirements. FAR 37.601 and 37.602 require measurable standards and methods for assessing performance. That means response-time bands, preventive-compliance targets, rework thresholds, audit documentation requirements, and escalation protocols — all defined before competition. A vague statement of work pushes risk into execution, where it costs more.
Third, build trust through transparency. McKinsey’s collaboration research consistently links open cost information and supplier-health visibility to durable supplier performance. In practice, you build trust through evidence rather than sentiment.
How IH Services Approaches Self-Performed Facility Services
R³ Secure FacilityOPS™ is a self-performed, Lean-disciplined, integrated operating system for secure spaces. The model exists because the F-35 lesson is the secure-facility lesson: when readiness depends on retained know-how and documentation, control cannot drift to a vendor stack.
That does not mean we self-perform every scope. Instead, we self-perform the scope that matters. For us, that’s cleared maintenance and government custodial services, and our own crews deliver both. We lay out the risk of splitting those across vendors in why fragmented facility vendors increase risk.
Finally — A Defensible Decision Is a Documented One
If you can explain, in plain language, why you self-perform, subcontract, or hybridize each scope — and tie each choice to an outcome the contract measures — your decision survives audit, renewal, and leadership change.
That is the only field guide secure-facility procurement actually needs.
Get the full research brief. The Secure Facility Buyer’s Field Guide: Self-Performed, Lean, Integrated synthesizes McKinsey, GAO, DOE, IFMA, CBRE, and Deloitte evidence on the three decisions defining secure facility-management sourcing today.
Download the research report (PDF)
Want to talk through your own sourcing model? Contact our team.
Questions Buyers Ask About Self-Performed Facility Services
When should a secure facility use self-performed facility services?
When the work is mission-critical, technically sensitive, or dependent on retained site knowledge and direct response authority. McKinsey notes manufacturers typically keep utility-equipment maintenance in-house; GAO’s F-35 review shows that gaps in technical data and control can undermine readiness when sustainment is overly contractor-led.
When is subcontracting the better commercial choice?
For standardized, lower-criticality, or variable-demand services where specialist scale and supplier competition outweigh the value of retained internal labor. McKinsey’s documented savings cases came from category clarity and supplier consolidation — not from outsourcing alone.
Is a hybrid model usually the safest choice for secure manufacturing?
Often yes. Hybrid models keep critical hard services and incident response under direct control while outsourcing soft services, overflow, or specialty tasks. McKinsey also notes that external integrators can help for a time when spend data are poor or suppliers are fragmented.
What should be in the solicitation regardless of model?
A defensible solicitation defines required outcomes, measurable standards, assessment methods, and incentives. FAR 37.601 and 37.602 are explicit on these elements. Federal buyers should also require reporting transparency, governance cadence, and savings-validation mechanisms to preserve discipline after award.