Co-Managed IT: How It Works When You Already Have an IT Person

Many firms with 20 to 150 staff run their IT with one in-house person. That person usually knows your systems, your staff and your suppliers better than any outside provider will, and you would not want to lose them. But they work office hours, they take holidays, and nobody can be an expert in every part of IT on their own.

Co-managed IT is the arrangement where you keep that person and a managed IT provider takes on agreed parts of the work alongside them. We wrote this guide for owners and managers of financial services firms and consultancies who are weighing it up.

We offer co-managed support ourselves, so we have written this from the provider's side of the arrangement. The advice applies whichever provider you choose.

Co-managed IT at a glance

Why one IT person cannot cover everything

The difficulty lies in the size of the job, and it has little to do with how good your IT person is. Someone on a 37.5-hour week is at work for about 22% of the 168 hours in a week, by our own calculation, and almost every UK worker is entitled to 5.6 weeks of paid holiday a year. For the rest of the time, nobody at your firm is watching your systems.

Firms that use a provider say the same thing. In the government's Cyber Security Breaches Survey 2026, organisations with small IT teams described 24/7 access to a managed service provider as a significant advantage, because the provider can monitor systems and act outside working hours when in-house staff cannot.

The range of skills is the second problem. Firms expect one person to look after laptops, Microsoft 365, the network, backups, software suppliers and security, and security is where small teams struggle most. The government's 2026 report on cyber security skills found that 57% of UK businesses had a basic technical skills gap, and that detecting and removing malware was the biggest single gap. It also found that 47% of the people responsible for cyber security in UK businesses lacked the confidence to deal with a breach or attack and had not outsourced that work.

Then there is the question of what happens when your IT person is ill or leaves, or when you simply cannot reach them. If the admin passwords, the network details and the supplier contacts exist only in one person's memory, your firm depends on that person far more heavily than it should.

Few firms solve this by handing everything over. The same skills report found that among UK businesses that outsource any part of their cyber security, only 29% outsource all nine of the basic areas it asked about, so most share the work between their own staff and a provider. Co-managed IT means doing that on purpose, with the split agreed and written down.

How the work is usually divided

There is no standard split, and every firm moves the lines to suit its own staff. The table below shows a common starting point: the in-house person keeps the work that depends on knowing your people and systems, and the provider takes the work that needs round-the-clock cover, specialist tools or extra hands.

Area	Your IT person	The provider
Everyday requests from staff	Handles most of them during office hours	Takes calls outside office hours, during holidays and when the queue is long
Security monitoring and response	Reports anything suspicious and follows the agreed incident plan	Watches devices and accounts around the clock and contains threats as they happen
Updates and patching	Agrees when to update business software that staff rely on, such as practice management or CRM systems	Rolls out updates to every device and checks that they installed
Backup	Decides what the firm must be able to recover, and how quickly	Runs the backups and tests that it can restore files and mailboxes
Microsoft 365	Manages users, mailboxes, shared folders and day-to-day changes	Sets up and maintains the security settings
Starters and leavers	Requests accounts and equipment, and helps new staff settle in	Creates or removes accounts and devices to an agreed checklist
Projects such as migrations or office moves	Owns the plan and the decisions that affect the business	Supplies extra engineers and specialist skills
Software suppliers	Manages the relationships, contracts and renewals	Works with the supplier when a fault involves the provider's area
Documentation and passwords	One named owner, agreed in writing. Both sides update the records after every change.
IT planning and budget	Leads it with the firm's directors	Advises on what needs replacing or renewing, and when

Some firms give the provider all first-line support and let their IT person concentrate on projects and planning. Others keep almost everything in-house and use the provider only for security monitoring and cover outside office hours. Either can work, provided both sides know exactly where the line sits.

Where co-managed arrangements go wrong

When a co-managed arrangement fails, the cause is usually unclear ownership. Four problems come up again and again, and you can prevent each of them at the start.

Each side thinks the other is doing a task

Backup checks and removing leavers' accounts are typical examples, because both feel routine until the day someone needs them. The NCSC's guidance on choosing a managed service provider says that "a matrix of responsibilities detailing what the MSP will do and what is expected from you as the customer is good practice". Write one, include the small tasks, and agree that neither side changes security settings or firewall rules without telling the other.

Disputes over admin access

The provider needs control of the security settings it is responsible for, and your IT person needs to fix problems without waiting for someone else. The answer is to give each person a named admin account with only the rights their role requires, protect every one of those accounts with multi-factor authentication, and keep an emergency admin account that belongs to your firm. The NCSC gives the same advice: "You should only give administrative accounts to people that really need them, and ensure they are protected."

Your IT person worries about their job

If your IT person sees the provider as the first step towards losing their job, they may keep information to themselves, and the arrangement will suffer for it. Talk to them before you speak to providers. Explain what they keep, and explain what they gain: holidays without being on call, and specialist help with the problems they currently solve alone.

Paying twice for the same tools

A provider runs its service desk and security monitoring on its own platforms, so some of the tools your IT person uses today will overlap with them. Agree before you sign which tools stay, which ones go and when the old licences end.

What FCA-regulated firms should add

If your firm is FCA-authorised, two parts of the rules affect how you set up a co-managed arrangement.

The first is responsibility. The FCA's outsourcing rules in SYSC 8 state that a firm which outsources critical or important functions "remains fully responsible for discharging all of its obligations under the regulatory system" (SYSC 8.1.6R). How much of SYSC 8 applies to your firm as rules, and how much as guidance, depends on the type of firm you are. Every firm should still have a written agreement that covers what the provider does, how you oversee it, your access to your own data and how you would leave.

The second is incident reporting, which changes on 18 March 2027. Under the FCA's PS26/2 rules, every FCA-authorised firm will have to report operational incidents that meet the FCA's thresholds, and the FCA expects the report within 24 hours of the firm deciding that an incident meets one. That clock depends on someone noticing the incident first. If your IT person works office hours and nobody monitors your systems overnight, an attack that starts on a Friday evening may go unseen until Monday morning.

Decide in advance who assesses an incident, who decides whether it meets a threshold and who submits the report. The decision and the report stay with your firm. Your provider's job is to give you the technical facts and the timeline quickly enough for you to meet the deadline, and your agreement should say so.

What consultancies should add

Clients who share confidential information with a consultancy often send a security questionnaire before they sign, and many of the questions assume someone is watching your systems. They ask who monitors your devices, how you respond to an incident and whether you hold Cyber Essentials. Cyber insurers ask similar questions; Tokio Marine HCC's UK proposal form, for example, asks whether you run endpoint detection and response with central monitoring across every device.

A co-managed arrangement lets your IT person answer those questions with evidence, as long as the provider shares its monitoring reports and certificates with them. If your firm bids for central government work, Procurement Policy Note 014 requires Cyber Essentials for in-scope contracts, and a provider can help you achieve it and keep it each year.

Setting up co-managed IT

A provider can usually start quickly, but the steps below decide whether the arrangement still works a year later.

1. Write down what your IT person does now. List the systems they look after, the suppliers they deal with, the jobs they repeat each week and month, and where passwords and records are kept.
2. Agree the split in writing. Use the table above as a starting point, and add how each side reports incidents to the other, as the NCSC recommends.
3. Set up accounts and access. Give each person a named admin account, turn on multi-factor authentication for all of them, and keep the emergency account under your firm's control.
4. Agree how work passes between you. Decide where staff report problems, how a request moves from one side to the other, and how each side gives notice of changes.
5. Run a handover period. Let the provider learn your systems while your IT person is there to answer questions, before it covers nights and holidays alone.
6. Review the split regularly. Meet at fixed intervals, and again whenever someone leaves, a system changes or a task keeps slipping between the two sides.

How AIS Technology works alongside in-house IT staff

We provide co-managed support to firms across Essex and London that already employ their own IT person or team. You decide which work stays in-house. We usually take on support outside office hours, security monitoring, backup and specialist projects, and your IT person keeps the work that relies on knowing your firm.

Our pages on IT support for financial services and IT support for consultancy firms explain how we support each sector, and our managed IT services page lists everything the plan includes. If you would like to see how a split could work at your firm, contact us and we will start by going through what your IT person does today.

Questions about co-managed IT

Will co-managed IT replace our IT person?

It should not, and a provider that plans to replace them is selling a different service. Co-managed IT works because your IT person keeps the knowledge of your firm that an outside provider would take a long time to learn, while the provider covers the hours and specialist areas that one person cannot.

Who keeps admin rights in a co-managed arrangement?

Both sides usually need some. Give each person a named admin account limited to the work they do, protect every account with multi-factor authentication, and keep an emergency admin account that belongs to your firm. Keep a log of who uses which account.

Who is responsible if we have a data breach?

Your firm stays responsible to its clients, to the ICO and, if you are authorised, to the FCA. Your contract with the provider should set out what the provider is responsible for, how it will report incidents to you and what liability it accepts, which is what the NCSC recommends.

Do we still report incidents to the FCA ourselves?

Your firm makes the report. From 18 March 2027, FCA-authorised firms must report operational incidents that meet the FCA's thresholds, and the FCA expects the report within 24 hours of the firm deciding that an incident meets one. Your provider should give you the technical facts and the timeline quickly enough for you to meet that deadline.

Can the provider work with the tools we already use?

It will work with your business software, such as your practice management, CRM or accounting systems, which stay as they are. Expect the provider to replace tools that overlap with its own service desk and security monitoring, such as antivirus or remote management software, so that you are not paying for both.

How is co-managed IT priced?

Most providers charge a monthly fee per user or per device, in the same way as for fully managed support. Compare what each fee includes, because round-the-clock monitoring, endpoint detection and response, backup and out-of-hours support are extras on many cheaper plans. We publish our own price on our IT packages page.

Sources

1. GOV.UK, Cyber security breaches survey 2025/2026, published 30 April 2026, https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
2. GOV.UK, Cyber security skills in the UK labour market 2026, https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2026/cyber-security-skills-in-the-uk-labour-market-2026
3. NCSC, Choosing a managed service provider (MSP), https://www.ncsc.gov.uk/guidance/choosing-a-managed-service-provider-msp
4. FCA Handbook, SYSC 8.1 General outsourcing requirements, https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html
5. FCA, PS26/2: Operational incident and third party reporting, https://www.fca.org.uk/publications/policy-statements/ps26-2-operational-incident-third-party-reporting
6. GOV.UK, Holiday entitlement, https://www.gov.uk/holiday-entitlement-rights
7. Tokio Marine HCC, CyberGuard Plus proposal form, https://www.tmhcc.com/en/-/media/project/tokio-marine/tmhcc-row/documents/cyber/cyberguard-plus-online-proposal.pdf
8. Cabinet Office, PPN 014: Cyber Essentials scheme, https://www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-html