Outsourcing government IT services to a number of smaller companies, rather than the monolithic contracts of the past, has become common practice, but ensuring all those contractors are secure is an ongoing challenge.