Co-managed IT: how an outside team works as an extension of yours
Organizations with their own IT staff rarely want to hand everything to an outside provider, and they rarely have enough people to cover everything themselves. Co-managed IT sits between those two options: your team keeps ownership and the work it does best, and a managed provider takes defined functions off its plate. The model works well when the split is written down. It fails when both sides assume the other is watching. This post explains how co-managed IT works, how to divide responsibilities, and what it looks like week to week.
What is co-managed IT?
Co-managed IT is an arrangement in which an organization’s internal IT team and an outside managed service provider share responsibility for running the environment, with each side owning specific, documented functions. The internal team usually keeps strategy, business applications, and user relationships. The provider usually takes on functions that need round-the-clock coverage, specialized tools, or depth the team cannot hire for.
Common functions handed to the provider in a co-managed model include 24×7 Security Operations Center (SOC) monitoring through services such as VSO’s Managed SOC Services, patching and endpoint management, backup and recovery operations, after-hours service desk coverage, and cloud infrastructure management.
When does co-managed IT make sense?
Co-managed IT makes sense when you have a capable internal team that cannot cover every function at the depth your environment needs. Typical triggers include a security monitoring requirement nobody can staff overnight, a cloud migration that outpaces the team’s experience, a key person leaving, or growth that adds sites and users faster than you can hire.
It is usually the wrong model in two cases. If you have no internal IT staff at all, a fully managed arrangement is simpler. If your team has capacity and only needs extra hands on a short project, staff augmentation may fit better, because the provider in a co-managed model owns outcomes rather than hours.
How should responsibilities be divided?
Divide responsibilities task by task in a written matrix that names who is responsible, who approves, who is consulted, and who is informed for each function. A general statement such as “the provider handles security” is where co-managed arrangements break.
The Cybersecurity and Infrastructure Security Agency (CISA) makes the same point to organizations using managed providers. Its risk considerations for managed service provider customers advises customers to “define roles and responsibilities in a vendor agreement” using a shared responsibility model, and reminds them that outsourcing IT services “does not absolve” the organization of its risk management duties.
A sample of how the split often looks:
| Function | Internal team | Managed provider |
| IT strategy and budget | Owns | Advises |
| Business application support | Owns | Escalation support |
| Endpoint patching and baselines | Approves exceptions | Operates and reports |
| 24×7 security monitoring and triage | Informed; owns business decisions during incidents | Operates |
| Backup operations and restore testing | Approves restore priorities | Operates and tests |
| User onboarding and offboarding | Initiates and approves | Executes technical steps |
For regulated environments, the matrix should map to your security documentation, so that each requirement in your system security plan names who implements it. Our post on keeping a system security plan accurate covers that mapping.
What does co-managed IT look like week to week?
Co-managed IT works week to week when the provider operates inside your processes rather than beside them. That means one ticketing workflow both teams can see, one change control process with both teams on the approval path, and shared access to monitoring and reporting.
A healthy rhythm usually includes:
- A weekly operations call covering open tickets, changes, and security findings
- A monthly service review with metrics, exceptions, and upcoming work
- A quarterly planning session tied to your budget and roadmap
- A named contact on the provider side who knows your team by first name and attends all three
The named contact is what turns a vendor into an extension of your team. At VSO, that person is your Service Delivery Manager (SDM), who coordinates the technical staff working on your environment and joins your planning conversations as part of the team.
What should the first 90 days of co-managed IT include?
The first 90 days should produce a signed responsibility matrix, shared tooling, and one clean round of every recurring process. A reasonable sequence:
- Days 1 to 30: document the environment together, agree on the matrix, set up named accounts and shared ticketing, and confirm escalation paths.
- Days 31 to 60: the provider begins operating its functions while the internal team shadows, and both sides adjust the matrix where reality differs from the plan.
- Days 61 to 90: run the first full monthly service review, close the gaps it surfaces, and agree on the metrics you will track from then on.
Resist the urge to hand over everything on day one. A staged transition exposes mismatched assumptions while they are still small.
How to keep control in a co-managed model
You keep control in a co-managed model by owning the decisions and making the provider own the execution. Retain administrative credentials for your own team, require the provider to use named accounts with multifactor authentication, keep logs where you can see them, and review access quarterly. CISA’s guidance recommends direct customer access to security logs and documented employee vetting for the provider’s staff, which are reasonable requirements to write into any co-managed agreement.
VSO’s Managed IT Services are often delivered this way for established organizations: scoped to the functions you want covered, working inside your processes, and reporting to your team. Learn more about VSO and how the company approaches client relationships.
Making co-managed IT work
Co-managed IT works when the split is specific, the processes are shared, and a named person on the provider side is accountable to your team. Write the responsibility matrix first, then choose a provider that is willing to work inside it.
Want a team that works as an extension of yours? Contact us today at sales@vso-inc.com or schedule a consultation with VSO.
