In a co-managed IT arrangement, your internal IT staff and a managed service provider (MSP) split the work, and a written agreement says who owns each task. A typical split: your team keeps day-to-day user support, business applications and project priorities. The provider takes on monitoring, patching, security tooling, backup and after-hours coverage. Legal accountability for your data stays with you either way.
The model fails when two teams each assume the other is handling the same risk. This guide gives you a responsibility matrix you can adapt, the duties you cannot hand off, the questions to settle before signing, and how we run it at NetFusion Designs (NFD).
Co-managed IT sits between two familiar options. In-house IT means your staff do everything. Fully managed IT means a provider runs the environment end to end. Co-managed keeps your people in place and adds an external team beside them. If you are weighing the three, our pages on co-managed versus fully managed IT and managed versus in-house IT cover the trade-offs in more depth.
The model suits a few common situations:
The common thread is that the internal team stays. The provider supports it and does not replace it.
There is no universal split. The right one depends on your team’s size and skills, your industry and your risk. The table below is a sensible starting point for a small or mid-sized business with one to five internal IT staff. Treat it as a draft to mark up, not a template to accept as is.
| Area | Typically owned by your team | Typically owned by the MSP | Agree in writing |
|---|---|---|---|
| Helpdesk | Tier 1 for staff you know well, onboarding and offboarding requests | After-hours cover, overflow, Tier 2 and 3 escalations | Hours, response times, who triages |
| Monitoring and alerting | Reviewing alerts that affect business apps | 24/7 monitoring of servers, network and endpoints | Who is called, at what severity, and at what hour |
| Patching and updates | Approving change windows, testing line-of-business software | Scheduling, deploying and reporting on OS and third-party patches | Maintenance windows, rollback plan, exceptions |
| Security operations | Security policy, user awareness, approving risk decisions | EDR, SOC and managed detection and response, vulnerability scanning | Incident roles, containment authority, reporting |
| Backup and recovery | Deciding what matters most, taking part in restore tests | Running backups, monitoring jobs, executing restores | Recovery time and recovery point targets, test schedule |
| Microsoft 365 and cloud | Day-to-day user and licence administration | Tenant hardening, migrations, conditional access, MFA enforcement | Who holds global admin rights |
| Vendors and licences | Relationships with line-of-business software vendors | Escalating hardware, internet and telephony issues on your behalf | Who can open tickets with which vendor |
| Projects and strategy | Business priorities, application roadmap | Project labour, architecture advice, virtual CIO input | Scope, budget approval, sign-off |
| Documentation | Business context, process knowledge | Network diagrams, asset inventory, runbooks | Where it lives and who can edit it |
A useful test: pick any row and ask who gets the phone call at 2 a.m. If two people give different answers, the row isn’t finished.
Most co-managed clients keep Tier 1 in-house because their team knows the people, the quirks and the priorities. The provider then handles what your team can’t: evenings and weekends, peaks during a migration, holidays and vacancies. Define how a ticket moves between the two desks, and make sure both use the same ticketing system so nothing lives in someone’s inbox.
These are the tasks that suit an outside team best. They are repetitive, they need tooling that is costly to buy for a small shop, and they have to run at night. Your team still has a say: they know that the accounting package breaks after a certain update, or that the plant’s CNC machines cannot reboot on Tuesday. Put those exceptions in writing so the provider isn’t guessing.
Security is where an MSP most often adds what a small internal team lacks, such as endpoint detection and response (EDR, software that watches devices for attacks and can isolate them) and a security operations centre staffed around the clock. The Canadian Centre for Cyber Security recommends that organizations set up solutions to detect, monitor and respond to incidents. The question for your agreement is who has authority to act: can the provider isolate a laptop at 3 a.m. without calling you first? Decide that in advance, not during the incident.
The provider can run the backups. You still decide what counts as critical and how long you can be down. A backup that has never been restored is a hope, not a plan, so schedule restore tests and assign someone on your side to witness them.
Handing tasks to a provider does not hand over responsibility. The Canadian Centre for Cyber Security states that your organization remains the data owner and is legally responsible for security even when it outsources, and its guidance on contracting with MSPs describes risk mitigation as shared between the organization and the provider, with the organization ultimately responsible for protecting its systems.
In practice, these stay with you:
CISA, the US cyber agency, warns executives against assuming that outsourcing reduces operational risk. Ceding too much control can create visibility gaps, where weaknesses in the provider’s network compound unresolved issues in yours. It recommends a cost-benefit review with finance, legal and security leadership before you choose a co-managed or fully outsourced model. That is US guidance, but the logic applies to any Canadian business with a provider holding privileged access.
If an outage or breach would still hit your finances despite good contracts, look at insurance as well. A Dutch broker’s overview of cyber insurance for small and mid-sized businesses explains the kind of exposures a policy is meant to cover. The market and policy wording are Dutch, so use it for the concepts and ask a Canadian broker about coverage here.
These are the failure patterns we see described most often, and they are all fixable with a clear agreement.
Ask these of any provider, including us.
The Cyber Centre also advises organizations to set security requirements and a formal service level agreement (SLA) before procurement, and to do their own due diligence on the provider’s financial and operational viability.
We have a simple view at NFD: a co-managed arrangement succeeds or fails on clarity, not on tooling. Most of the businesses we talk to already have someone good in-house. They don’t need that person replaced. They need that person to stop being the single point of failure for everything from password resets to ransomware response.
So we start by mapping what your team owns and what it would rather not. We lean on our 24/7 network operations centre and our SOC 2 Type II certified processes for the repetitive, round-the-clock work, and leave the context-heavy work with the people who know your business. We run our own infrastructure in-house, which means we are not passing your tickets to a chain of third-party vendors, and where it is required we can support provincial data residency.
We also say plainly that you should keep control of the things that are yours: your data, your admin break-glass access and your independent backups. A provider who resists that is telling you something.
One more habit worth copying whoever you choose: write the responsibility matrix in plain language, not in contract jargon, so the person on call can read it at 2 a.m. and know what to do.
— Geeshan
Our co-managed IT support is built to sit beside your internal team. Depending on the gaps you have, that can include a 24/7 staffed helpdesk for overflow and after-hours, managed EDR and 24/7 SOC and MDR, cloud backup and disaster recovery and virtual CIO guidance. We also offer emergency IT support if something breaks outside any plan. See all of our IT support service options, or talk to us about a responsibility matrix for your own environment. We have teams in Kitchener-Waterloo, Toronto, Markham, Mississauga, Montréal and Winnipeg.
A matrix that is right today will be wrong in a year. Staff join and leave, you adopt a new cloud tool, an auditor asks for evidence, or you open a second location. Build in a review:
As your internal team grows or shrinks, the split moves too. Some businesses move toward a fuller managed model, and others bring more in-house. Our guides on internal or outsourced IT and the benefits of working with an MSP can help with that decision.
Your organization remains legally responsible for its data, as Canadian Cyber Centre guidance makes clear. The provider is responsible for performing the tasks it agreed to, such as monitoring and containment, and your contract should say what it must report to you and how fast. After an incident, speak to legal counsel about your reporting duties.
No. The point of the model is to keep your team and give them tooling, depth and backup. Your staff keep ownership of the areas you assign them, and the provider covers the rest.
Keep business priorities, risk decisions, vendor relationships tied to your operations, and the final say on access to your data. Also keep your own copy of backups, logs and break-glass admin credentials.
In fully managed IT, the provider runs the environment end to end and acts as your IT department. In co-managed IT, responsibility is split with your internal team by written agreement. Our page on where the line sits between the two goes through the differences.
Review ticket and escalation data quarterly and the full matrix at least once a year. Also review it after any major incident, staffing change or new system.
%20(1).avif){kind=logo}
%201.avif)
