Fully managed vs co-managed IT: what leaders need to know

What does a managed IT service provider do?

A managed service provider is an entity that delivers, operates or manages IT and communications services for a customer, according to CISA, NSA, FBI and international partners in Protecting Against Cyber Threats to Managed Service Providers and their Customers (2022). For an established mid-size or large organization, that work covers monitoring, patching, network management and backup, run from one point of contact that covers offices, laptops, phones, servers and cloud systems.

Leaders who sign with a provider keep the business and risk decisions. The provider runs and secures the technology, and the organization's leadership decides how the business operates around it. Customers need a thorough understanding of the security services a provider delivers, and a contract that states which responsibilities belong to the provider and which stay with the customer (CISA, NSA, FBI and international partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers, 2022).

What is included in managed IT services?

Managed IT services typically include proactive support and monitoring, patching and device care, network and cloud management including Microsoft 365, backup and disaster recovery with a plan to get back to work, and IT strategy and consulting.

Many organizations add cybersecurity services alongside managed IT, such as 24/7 monitoring, investigation and containment, Microsoft 365 account and email monitoring, and dark web password alerts. Provider-run backups of critical data should be automatic and continuous (CISA, NSA, FBI and international partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers, 2022). A provider that manages both IT and security can put security inside everyday IT work, alongside monitoring and patching.

What is the difference between fully managed and co-managed IT?

Fully managed IT puts daily IT and security work with the provider. Co-managed IT keeps an in-house team in place and adds a provider for monitoring, patching or after-hours coverage.

Is co-managed IT a good fit if we already have an IT team?

Co-managed IT works when an in-house team wants a partner for monitoring and after-hours security work, without giving up control of business and risk decisions.

This model suits organizations where leaders answer to a board, insurer, auditor or parent company and need records on hand. It also suits organizations with staff across several offices who need the same support at each location. An in-house team keeps daily operations, while a provider's analysts watch systems during the hours the in-house team is off duty.

How do I choose a managed service provider?

Choosing a managed service provider starts with reviewing what the provider monitors, how fast it patches known vulnerabilities, and what the contract says about responsibility.

Due diligence before entering a supplier relationship, security requirements written into contracts, and suppliers included in incident planning, response and recovery are part of a sound selection process (NIST, The NIST Cybersecurity Framework (CSF) 2.0, 2024). Patching speed is worth checking directly: in 2025, 26 percent of known exploited critical vulnerabilities were fully fixed, down from 38 percent the year before, and the median time to a full fix rose to 43 days from 32 (Verizon, 2026 Data Breach Investigations Report, 2026). A provider that tracks and reports these numbers treats patching as a daily task.

What questions should I ask a managed service provider before signing?

Before signing, ask a provider about scope, contract responsibilities, after-hours monitoring, backups, patching pace, reporting and its own security practices.

1. What is the full scope of services, and what falls outside it?
2. Are responsibilities written into the contract for both the provider and the organization?
3. Does the provider monitor systems after hours, and who handles an incident overnight?
4. Are backups automatic, continuous and tested?
5. How fast does the provider patch known vulnerabilities, and how is that tracked?
6. What does the provider report to leadership, and how often?
7. What security practices does the provider use for its own systems, and how does it manage third-party risk?

Organizations in Syracuse, New York, and Tampa, Florida, can use this checklist when evaluating FunctionOne or another local provider.

Who is responsible for security when IT is outsourced?

Security responsibility is shared. The provider runs and monitors the technology, and the customer is responsible for understanding what is covered and confirming it in the contract.

One vulnerable provider can become an entry point into many customer networks, which is why providers are frequent targets (CISA, NSA, FBI and international partners, Protecting Against Cyber Threats to Managed Service Providers and their Customers, 2022). Third-party involvement appeared in 48 percent of breaches, up 60 percent in one year, and the global average cost of a data breach reached 4.99 million US dollars, a record, up 12 percent (Verizon, 2026 Data Breach Investigations Report, 2026; IBM, Cost of a Data Breach Report 2026, 2026). These numbers are a reason to read a provider's contract closely before signing it.