Last Updated: October 30, 2026
Quick Summary
Co-managed IT is a shared support model in which an outside provider works alongside your internal IT staff, who keep day-to-day ownership of the environment. The provider fills gaps such as monitoring, patching, and security work, so your team keeps its knowledge while getting added capacity.
- Co-managed IT keeps your internal team in control, unlike fully outsourced arrangements where staff step back.
- Write a one-page responsibility matrix that names one owner for each recurring task and failure mode.
- Pair every SLA response target with a resolution or workaround target, and require reporting on both.
- Set response and resolution targets by priority level rather than as a single average.
- Plan the transition over 30 to 60 days and make sure knowledge transfer is completed.
Table of Contents
- What Co-Managed IT Services Are and How They Differ From Outsourcing
- How Co-Managed IT Works Alongside Your Internal IT Team
- Co-Managed IT Responsibilities and Roles: Who Owns What
- Co-Managed IT vs. Fully Managed IT: Which Model Fits Your Team
- Co-Managed IT Service Level Agreement: Metrics That Matter
- Co-Managed IT Onboarding Checklist: Transitioning in 30 to 60 Days
- Preparing Your Internal Team and Starting Your Co-Managed IT Partnership
- Frequently Asked Questions
Co-managed IT services for internal teams let your existing IT staff keep control while an outside partner covers the gaps.
A common pattern: an in-house administrator handles help desk tickets, server patches, and vendor calls alone, and important projects slip. Co-managed support can add capacity and specialized skills while keeping the people who know your systems in place. The questions below will help you decide whether it fits your team.
What Co-Managed IT Services Are and How They Differ From Outsourcing
Co-managed IT is a shared support model where an outside provider works alongside your internal IT staff. Your team keeps day-to-day ownership of the environment.
Outsourcing is different. A fully outsourced arrangement hands the entire IT function to a provider, and your internal staff may shrink or disappear. Co-managed support keeps your people in the loop.
- Co-managed: Internal team keeps control; provider fills gaps
- Fully outsourced: Provider runs everything; internal team steps back
- Staff augmentation: Extra people join your team for a fixed project
For more on the broader case for this model, read our guide on benefits of co-managed IT services for SMBs.
How Co-Managed IT Works Alongside Your Internal IT Team
In practice, co-managed IT splits the work by skill and by time.
Watch out: if the handoff between your team and the provider is unclear, tickets get dropped between the two. Agree on a single intake point from day one.
A shared ticketing system and a regular review call can help prevent these gaps. Cybersecurity is often the first area where teams add outside help, and our cybersecurity services page explains what that coverage includes.
Co-Managed IT Responsibilities and Roles: Who Owns What
Clear ownership is what makes co-managed work. Without it, both sides assume the other is handling a task, and the gap only surfaces during an outage.
Start by sorting work into four buckets: internal-only, provider-only, shared, and joint-decision. Most disputes come from the shared and joint-decision buckets, because both sides assume the other is driving.
- Internal team typically owns: user onboarding and offboarding, local hardware procurement, business application decisions, vendor relationship management, and institutional knowledge of line-of-business systems
- Provider typically owns: 24/7 infrastructure monitoring, security patching, backup verification and restore testing, endpoint detection and response alert triage, and escalated technical issues outside the internal team’s specialty
- Shared: change requests, incident reviews, documentation upkeep, and long-range technology planning
- Joint decision: major purchases, cloud migrations, security policy changes, and anything that affects compliance scope
Legacy systems create the most confusion. Our article on managing legacy software with outsourced IT walks through common arrangements.
Building a Responsibility and Escalation Matrix
A responsibility matrix lists each task, who does it, who approves it, and who gets called when it breaks. Keep it to one page and review it quarterly.
Write down the escalation path too. Who gets the call at 2 a.m.? Who approves a server replacement? Who can authorize emergency spending, and up to what amount? Who communicates to employees during an outage?
Test the matrix with a tabletop exercise. Pick a realistic scenario, a ransomware alert on a Friday night, and walk through who does what, in what order, using only the written matrix. Any pause or disagreement is a gap to fix before it happens for real.
After-Hours and On-Call Ownership
After-hours support is where co-managed arrangements most often break down. Decide explicitly whether the provider takes first call for all alerts or only for infrastructure and security alerts, and whether the internal team is on call for business application issues. A common split is provider-first for monitoring, patching, backup, and security incidents, and internal-first for line-of-business application problems that require business context.
Keeping the Matrix Current
Assign one person on each side to own the matrix. Update it whenever a new system, vendor, or compliance requirement is added, and review it at the same cadence as your SLA reporting. A matrix that is six months stale is worse than no matrix, because it creates false confidence about who is covering what.
Co-Managed IT vs. Fully Managed IT: Which Model Fits Your Team
| Factor | Co-Managed | Fully Managed |
|---|---|---|
| Internal staff role | Stays in charge | Steps back |
| Best for | Teams with 1+ IT staff | Teams with no IT staff |
| Control | Shared | Mostly provider-led |
| Pros | Keeps institutional knowledge | Simple, single point of contact |
| Cons | Needs clear ownership rules | Less internal control |
Pros of co-managed: You keep your team’s knowledge and relationships. Gaps get filled without a full handoff.
Cons of co-managed: It requires active coordination. It can feel crowded if roles are vague.
Pros of fully managed: One partner handles nearly everything. Budgeting is often simpler.
Cons of fully managed: Your internal team may lose context, and you depend heavily on the provider.
Pricing structures differ between these models, and each provider prices differently. Our managed IT pricing models guide explains how these structures are typically organized.
Co-Managed IT Service Level Agreement: Metrics That Matter
A service level agreement (SLA) defines what the provider promises and how you will measure it (service level agreement (SLA) – Glossary).
Focus on a handful of metrics you can actually track, and set targets by priority level rather than as a single average. A total outage needs a faster response than a printer issue, and averaging the two hides the failures that matter.
- Response time: How quickly a ticket gets acknowledged, measured separately for critical, high, and standard priority
- Resolution time: How long a typical fix takes, reported as a median rather than an average so a few long-running tickets do not distort the picture
- System uptime: The percentage of time core systems stay available, measured against an agreed list of systems rather than a vague “network”
- Ticket backlog: How many open requests are waiting and how many are older than the agreed resolution target
- Patch compliance: The percentage of endpoints and servers patched within the agreed window after a vendor release
- Backup success rate and restore test results: The percentage of scheduled backups that completed and the date of the last successful restore test
- Security incident response: Time from alert to triage, and time from triage to containment, for security events
Setting Response and Resolution Targets by Priority
A practical starting point is to define three or four priority levels and attach both a response and a resolution target to each. Critical incidents, such as a server down or a ransomware alert, call for a fast response and a resolution target agreed in advance. High-priority issues affecting a department may warrant a shorter response window than standard requests, which can follow a longer target. The exact numbers should reflect your business, but the structure should be written down and agreed before the contract is signed.
Beware of SLAs that promise only response time. A provider can acknowledge every ticket within 15 minutes and still leave work unresolved for days. Pair every response target with a resolution or workaround target, and require reporting on both.
Reporting Cadence and What to Ask For
Ask for a monthly report showing actual performance against each target, broken out by priority and by service category.
Review the report in a monthly operations call and a quarterly business review. The monthly call is for exceptions and backlog; the quarterly review is for trends, recurring root causes, and whether the targets still match the business. Use the same data to decide whether to expand or reduce the provider’s scope.
Tying SLAs to the Responsibility Matrix
Every SLA metric should map to a task the provider owns in the responsibility matrix. If the provider is accountable for patching, patch compliance belongs in the SLA. If the internal team owns user onboarding, onboarding turnaround is an internal metric, not a provider SLA. This mapping prevents the common failure where the SLA measures things the provider does not control and ignores the things it does.
Service Credits and Remedies
Many co-managed agreements include service credits, a percentage reduction in the monthly fee if the provider misses agreed targets. Credits are not a substitute for good service, but they focus attention. Keep the credit structure simple: a defined credit for missing a critical response or resolution target, and a cap on total monthly credits. More important than the credit itself is the root-cause review that follows a missed target, so the same failure does not repeat.
Comparing Providers on Measurable Terms
When you evaluate providers, ask each one for a sample monthly report and a copy of its standard SLA. Compare the priority definitions, the response and resolution targets, the reporting fields, and the credit terms side by side. A provider that publishes clear targets and shows real reports is easier to hold accountable than one that promises “24/7 support” without numbers.
Co-Managed IT Onboarding Checklist: Transitioning in 30 to 60 Days
A smooth transition usually takes 30 to 60 days. Plan the work in phases rather than trying to switch everything at once.
- Inventory all hardware, software, licenses, and vendor contracts
- Document current network diagrams and admin credentials (stored securely)
- Confirm backup status and test a restore
- Agree on the responsibility matrix and SLA
- Set up shared ticketing and monitoring access
- Run a security baseline review
- Schedule weekly check-ins for the first 60 days
Knowledge transfer is the step teams most often rush. Make sure your internal staff walks the provider through the environment, and that critical documentation lives somewhere both teams can reach.
Preparing Your Internal Team and Starting Your Co-Managed IT Partnership
Your internal team’s buy-in matters more than any contract clause. Some staff worry that outside help means losing their role. Address that directly.
Before you start, have a frank conversation about what your team wants to focus on, such as projects, planning, or user training.
If you want to talk through whether co-managed support fits your team, contact us today. A PC Geek has served the Dallas/Fort Worth area and East Texas since 2001.
Frequently Asked Questions
What are co-managed IT services?
Co-managed IT is a model where an outside provider supplements an existing internal IT team rather than replacing it. The internal staff keeps control of strategy, business applications and day-to-day relationships with employees, while the provider adds capacity for help desk coverage, network monitoring, patch management, backup oversight and specialized projects. Pricing depends on the services included, the number of users and devices, and response requirements, so readers should request a quote from A PC Geek for current figures.
How do you divide responsibilities between internal IT and a co-managed provider?
Start by listing every IT function and assigning a clear owner: internal, provider or shared. Routine tasks such as ticket triage, patching and monitoring often go to the provider, while vendor selection, budget decisions and user-facing policy usually stay internal. A written responsibility and escalation matrix prevents gaps where both sides assume the other is handling an issue, and it should be reviewed each quarter as the environment changes.
What is the difference between co-managed and fully managed IT?
Fully managed IT hands the entire IT function to an outside provider, which then runs help desk, infrastructure, security and planning. Co-managed IT keeps the internal team in place and fills specific gaps. Teams with strong in-house skills but limited bandwidth usually fit co-managed best, while businesses without internal IT staff typically need fully managed support. Ask A PC Geek to walk through both options against your current staffing.
How can a business measure the success of a co-managed IT partnership?
Track measurable service level agreement metrics such as first response time, average resolution time, system uptime percentage, ticket backlog and the number of unplanned outages. Compare these figures against the targets in your agreement each month, and review user satisfaction and the time your internal team spends on routine work. Clear numbers make it easier to confirm the partnership is delivering value.
