The right answer depends on the function, the organization’s priorities and the level of control, resilience and scalability required.