Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsCo-managed IT works when your internal team and an outside provider have clearly divided responsibilities—and your business retains decision-making and oversight. An independent provider can add specialist skills, capacity, or an objective review, but another vendor alone does not close security gaps. Define who does what, how performance is measured, and how you can verify or end the arrangement.
What co-managed IT means
Co-managed IT is a shared operating model: in-house staff and an external provider each own defined work. Your team contributes knowledge of the business, its people, and its priorities; the provider can supply capabilities or coverage that are difficult to maintain internally. The division varies by organization. It might involve an MSP handling endpoint maintenance while internal staff manage business applications, or a security specialist monitoring alerts while the internal team authorizes disruptive changes.
“Independent” can mean a provider separate from your incumbent MSP, a specialist that does not operate the controls it assesses, or an advisor able to challenge assumptions made by either team. Those are different forms of separation, and none guarantees impartiality. Ask providers to disclose conflicts and clarify who controls access, owns evidence, and approves remediation.
Why bring in an outside provider?
Specialist skills without a full-time hire
Small businesses may not have the expertise, resources, or budget to build every cybersecurity capability in-house. NIST’s small-business guidance, updated September 21, 2026, says outsourcing security expertise is common, particularly for smaller organizations. A specialist may provide security, cloud, identity, compliance, or recovery skills that an internal generalist team or helpdesk-focused MSP does not maintain.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
More capacity and continuity
External staff can support after-hours monitoring, a migration, an acquisition, an audit, or an incident surge while internal staff retain business context. They may also help cover a hiring gap, leave, or turnover. Specify the hours and work included: a provider’s advertised coverage is not proof that it will remediate alerts, test recovery, or support your staff during business hours.
A separate check on the work
An assessor that does not operate a control can review whether it works and whether the operator’s evidence supports its claims. That separation can help expose gaps in privileged access, backups, or incident readiness. It is less meaningful if the reviewer audits its own work or has an undisclosed commercial interest in the incumbent’s tools.
Rank #2
- 【Flexible Port Configuration】1 Gigabit SFP WAN Port + 1 Gigabit WAN Port + 2 Gigabit WAN/LAN Ports plus1 Gigabit LAN Port. Up to four WAN ports optimize bandwidth usage through one device.
- 【Increased Network Capacity】Maximum number of associated client devices – 150,000. Maximum number of clients – Up to 700.
- 【Integrated into Omada SDN】Omada’s Software Defined Networking (SDN) platform integrates network devices including gateways, access points & switches with multiple control options offered – Omada Hardware controller, Omada Software Controller or Omada cloud-based controller(Contact TP-Link for Cloud-Based Controller Plan Details). Standalone mode also applies.
- 【Cloud Access】Remote Cloud access and Omada app brings centralized cloud management of the whole network from different sites—all controlled from a single interface anywhere, anytime.
- 【SDN Compatibility】For SDN usage, make sure your devices/controllers are either equipped with or can be upgraded to SDN version. SDN controllers work only with SDN Gateways, Access Points & Switches. Non-SDN controllers work only with non-SDN APs. For devices that are compatible with SDN firmware, please visit TP-Link website.
Defined work instead of every specialty on payroll
Buying a specific service can be more practical than employing every specialist full time, especially where in-house expertise or budget is limited. But available authoritative guidance does not establish a general savings rate or return on investment for co-managed versus internal-only or fully outsourced IT. Compare your actual costs—including onboarding, overlapping tools, staff time, projects, after-hours coverage, and exit work—rather than relying on a generic savings claim.
Which operating model fits?
These arrangements are not interchangeable. A contract and proposal should make clear what work, staffing, hours, and authority are included; the labels alone do not establish coverage.
Rank #3
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
| Option | What it can provide | What to verify |
|---|---|---|
| Internal-only IT | Your own staff manage the work. | Whether the team has the specialist skills, staffing depth, and hours required. |
| Incumbent MSP | An external provider handles agreed IT services. | The actual scope, security practices, escalation path, and any work that remains with your staff. |
| Co-managed MSP | Internal staff and an MSP divide IT responsibilities. | Decision rights, handoffs, tool overlap, and who owns each task. |
| MSSP or MDR provider | A security provider may supply security operations or managed detection and response. | Which alerts it monitors, when it responds, whether it can act, and who handles remediation and recovery. |
| Independent assessor | A separate party assesses controls, evidence, or provider performance. | Whether it operates or resells what it assesses, how conflicts are disclosed, and who tracks corrective action. |
These roles can be combined, but combining them does not remove the need for clear boundaries. CISA advises customers to weigh outsourcing efficiencies against enterprise risk, define roles through a shared-responsibility model, and consider independent help when they lack technical expertise.
What risks should you weigh?
- Third-party access: MSP accounts and remote-management tools can provide a route into customer systems if compromised. A 2022 joint advisory from CISA, NSA, FBI, and international partners warns that an MSP compromise can create downstream risk for the organizations it supports.
- Responsibility gaps: “The provider handles security” does not identify who approves changes, investigates incidents, or protects backups. NIST’s 2026 small-business guidance says outsourcing work does not transfer the customer’s responsibility for protecting its systems and data.
- Coordination costs: Two teams may duplicate tools, miss handoffs, or disagree over change authority. Set escalation, approval, and reporting rules before work begins.
- Dependency and lock-in: Provider-held credentials, proprietary tools, and undocumented configurations can complicate a transition. Agree on access, documentation, data retrieval, and transition assistance in advance.
- Coverage mismatch: Monitoring an alert is not the same as investigating it, containing an incident, restoring systems, or supplying compliance evidence. Buy specified outcomes and authority, not just a service label.
Who is responsible if the provider makes a mistake?
Responsibility depends on what happened, the contract, and applicable legal or regulatory obligations; this article cannot determine liability for a particular incident. NIST’s guidance is clear on one important point: outsourcing does not remove the customer’s responsibility for protecting its systems and information. That does not, by itself, settle what contractual duties or remedies the provider may have.
Rank #4
- Multi-WAN Business Continuity: Connect up to 5 ISPs with automatic failover and load balancing — if one connection drops, traffic instantly reroutes to keep your business, remote office, or home lab online
- OpenWRT-Ready Enterprise Control: Full OpenWRT support unlocks VLAN segmentation, advanced firewall rules, custom QoS policies, and community-developed packages for professional-grade network management
- Complete VPN Gateway Suite: WireGuard, OpenVPN, IPsec, PPTP, and L2TP server and client built in; create site-to-site tunnels, host remote access, or route specific VLANs through encrypted VPN connections
- Professional Security Stack: SPI firewall, DoS attack prevention, IP/MAC binding, domain filtering, and DMZ hosting protect your network perimeter while keeping critical services accessible
- Flexible Deployment & Monitoring: Web GUI or Cudy App cloud management with TR-069 support; built-in diagnostic tools (Ping, Traceroute, NSLookup, system logs) for rapid troubleshooting anytime
Before signing, document each party’s work, approvals, service levels, notification duties, evidence handling, and escalation path. If an incident occurs, the agreement should help establish what each party was assigned to do and what records to review. Retain enough oversight to check performance and make decisions about your business risk rather than treating the provider’s presence as proof that controls are working.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should a shared-responsibility matrix cover?
Put the matrix in the operating agreement or a controlled companion document. For each activity, name the accountable party, the people who perform and approve it, the evidence retained, and any handoff or deadline. “Shared” should prompt a more precise division, not leave ownership ambiguous.
Recommended Free Tools
| Work area | Questions the agreement should answer |
|---|---|
| Asset and configuration inventory | Who discovers assets, records owners, and approves the authoritative inventory? |
| Identity and privileged access | Who grants, reviews, rotates, and revokes administrator access? |
| Endpoint and server patching | Who tests, schedules, applies, verifies, and reports patches? |
| Network and cloud controls | Who manages firewalls, tenant settings, segmentation, and applicable cloud shared-responsibility tasks? |
| Monitoring and detection | Who watches alerts, sets severity, investigates, and contacts leadership? |
| Incident response | Who can isolate systems, preserve evidence, notify counsel or insurers, and coordinate recovery? |
| Backups and recovery | Who defines recovery point and recovery time objectives, protects backup credentials, tests restores, and records results? |
| Security awareness | Who trains users, tracks completion, and handles exceptions? |
| Compliance and evidence | Who maps controls to contracts or regulations and supplies audit evidence? |
| Change and vendor management | Who approves changes, reviews subcontractors, and tracks service-level breaches? |
| Exit and portability | Who owns configurations, logs, credentials, and documentation, and who provides transition assistance? |
For backups in particular, CISA’s ransomware guidance tells customers to understand the shared-responsibility model and verify best practices when a third party or MSP maintains them. Make restore testing and its recorded results an assigned duty, not an assumption based on a backup service being enabled.
How to evaluate a co-managed IT provider
NIST SP 800-35, published in October 2003, identifies selection considerations including service arrangement, provider qualifications and capabilities, experience and viability, employee trustworthiness, and the ability to protect systems, applications, and information. Apply those questions alongside your current obligations and practical operating needs.
Quick Recap
- Document your starting point. List critical assets, dependencies, business outcomes, and legal, regulatory, and contractual obligations before requesting proposals. NIST’s 2026 small-business guidance recommends documenting these conditions.
- Map current responsibilities. Mark each IT and security task as internal, incumbent-provider, proposed-provider, or genuinely shared. Identify uncovered work and duplicated effort.
- State the gap you need filled. Be specific: specialist security, independent validation, round-the-clock coverage, recovery testing, project capacity, or continuity. Avoid purchasing a broad label without tying it to a need.
- Request a detailed proposal. Ask for scope, assumptions, exclusions, staffing and hours, subcontractors, tools, evidence, measurable service levels, customer responsibilities, and escalation procedures. NIST advises documenting service levels, responsibilities, and expectations in a managed services agreement or other formal contract.
- Check capability and fit. Ask for evidence of the provider’s security practices and references relevant to your organization’s size and sector. Assess how it protects its own identities, remote tools, logging, backups, and incident processes, as well as whether its approach fits your contracts and regulatory duties.
- Test the handoffs in conversation. Walk through a compromised privileged account or ransomware scenario. Confirm who decides, who can act, who preserves evidence, and who communicates. CISA warns that shifting more responsibility to an MSP may improve cost efficiency while increasing risk exposure, so authority and oversight deserve particular attention.
- Begin with bounded work. Consider a limited assessment or pilot with defined deliverables, reporting, access limits, and exit terms. Expand only when ownership and operating arrangements are acceptable to your organization.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
