Security assessment first
FunctionOne starts with a security assessment of your systems and accounts. We agree scope and response rules with you before anything is switched on.
FunctionOne co-managed IT
FunctionOne co-managed IT works beside your in-house IT team
With FunctionOne co-managed IT, your in-house IT team keeps day-to-day control, and FunctionOne adds monitoring, security and specialist support where the team needs it. Our security analysts watch connected systems 24/7, investigate and contain threats within response rules you approve. Your leadership makes business and risk decisions. We agree on scope and response rules with you before anything is switched on.
Book a security assessment
We'll review your systems and accounts, then agree scope and response rules with you before anything is switched on.
We use your details only to arrange your assessment.
Who does what in FunctionOne co-managed IT
FunctionOne co-managed IT splits the work so your in-house team keeps day-to-day control and both sides know who does what.
Around-the-clock security monitoring
FunctionOne security analysts watch connected systems 24/7. They investigate what they find and give your team the findings.
Containment within approved rules
Our analysts contain threats only within the response authority your leadership approves.
Specialist support and escalations
FunctionOne adds specialist support where your in-house team needs it. We also support escalations your team raises.
Onboarding and service management
FunctionOne coordinates onboarding and integrations with your IT team and manages the service.
Organized remediation
When analysts find a problem, FunctionOne organizes remediation with your team. Your team sees who owns each fix and the next step.
Leadership reporting
Your leaders get a monthly summary and a regular security review from FunctionOne. Reports name owners and next steps.
Decisions stay with leadership
Your leadership identifies critical operations, approves response authority and makes business and risk decisions. Your leaders also direct outside communications.
Why does FunctionOne agree on scope and response rules first?
In The NIST Cybersecurity Framework (CSF) 2.0, published in 2024, NIST calls for cybersecurity roles, responsibilities and authorities to be established, communicated, understood and enforced (GV.RR-02). FunctionOne names who does what: our analysts monitor, investigate and contain, and your leadership makes business and risk decisions.
NIST's Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3), published in 2025, says that when an organization uses a provider under a shared responsibility model, the contract defines the division of duties, information flows and authority to act. Our analysts contain threats only within the response rules your leadership approves.
CISA, NSA, FBI and partners advise in Protecting Against Cyber Threats to Managed Service Providers and their Customers (2022) that contracts should say which security responsibilities belong to the provider and which belong to the customer. FunctionOne starts with a security assessment of your systems and accounts. Then we agree scope and response rules with your leaders before anything is switched on.
How does FunctionOne set up co-managed IT?
FunctionOne starts co-managed IT with a security assessment and switches on monitoring only after your leadership approves the response rules.
Security assessment
FunctionOne starts with a security assessment. We review your systems and accounts.
Scope and response rules
We agree scope and response rules with your leadership before anything is switched on.
Onboarding and integrations
FunctionOne coordinates onboarding and integrations. Your in-house team keeps day-to-day control of IT.
Monitoring and containment
Security analysts watch connected systems 24/7 and contain threats only within the authority you approved.
Leadership reporting
Leadership gets a monthly summary and a regular security review, with owners and next steps named.
Who does what in FunctionOne co-managed IT?
Use this split to see which jobs stay with you and which jobs FunctionOne takes on.
| Your organization | FunctionOne |
|---|---|
| In-house team keeps day-to-day control | Adds monitoring, security and specialist support where your team needs it |
| Leadership approves response authority | Analysts contain threats within that authority and give findings |
| Leadership makes business and risk decisions | Supports escalations and organizes remediation |
| Leadership gets a monthly summary and security review | Reports name owners and next steps |
Who is FunctionOne co-managed IT for?
FunctionOne co-managed IT suits established mid-size and large organizations that already run an in-house IT team.
IT directors and their teams
Your team keeps day-to-day control. FunctionOne adds monitoring, security and specialist support where you need it.
Executives who report upward
Leaders who answer to a board, insurer, auditor or parent company get a monthly summary and a regular security review.
Organizations with several offices
Our analysts watch connected systems 24/7 for staff spread across several offices.
Leaders of high-stakes operations
You name your critical operations, and analysts contain threats only within response rules you approve.
What do leaders ask FunctionOne about co-managed IT?
What is co-managed IT?
Co-managed IT is a setup where FunctionOne works beside your in-house IT team. Your team keeps day-to-day control. We add monitoring, security and specialist support where your team needs it, and we report to leadership with owners and next steps.
Will co-managed IT replace my in-house IT staff?
No, your in-house IT team stays in place and keeps day-to-day control of your systems. FunctionOne adds security analysts who watch connected systems 24/7, along with specialist support and help with escalations when your team needs it.
Who makes decisions during a security incident?
Your leadership makes the business and risk decisions, approves response authority and directs outside communications. FunctionOne analysts investigate, contain threats only within the authority you agreed and give findings. FunctionOne supports escalations and organizes remediation alongside your in-house team.
How should a co-managed IT contract split security duties?
A contract should spell out both sides' security duties. CISA, NSA, FBI and partners, in Protecting Against Cyber Threats to Managed Service Providers and their Customers (2022), advise naming which responsibilities belong to the provider and which to the customer. FunctionOne agrees response rules before anything is switched on.
What does shared IT responsibility mean?
Shared responsibility means the contract sets out who does which job and who can act. NIST's Incident Response Recommendations and Considerations for Cybersecurity Risk Management (SP 800-61 Rev. 3, 2025) says the contract defines the division of duties, information flows and authority to act. FunctionOne agrees scope first.
Do we still need in-house incident handlers with co-managed IT?
Your organization can mix both. NIST's incident response guidance, SP 800-61 Rev. 3 (2025), says incident handlers can be on staff, on contract through an outsourced security operations center, or on call. With FunctionOne, your in-house team stays in place and our analysts monitor and investigate.
How does FunctionOne report to leadership?
FunctionOne gives leadership a monthly summary and a regular security review. Reports name owners and next steps, so your executives and IT director can see open items.