Co-Managed IT Services
Co-managed IT services keep your internal team in charge and add capacity where it needs help: a support backlog, infrastructure maintenance, security operations or an upcoming project. NetSys agrees the responsibilities with your IT lead before taking them on, including the tools, approval rights and escalation route both teams will use.
The short answer
Co-managed IT services split operating responsibilities between your internal team and NetSys. Your IT lead keeps the work and decisions you choose; we take on agreed monitoring, security, infrastructure, escalation or project tasks. The responsibility matrix identifies the primary owner, backup owner, approval rights and hours for each activity, so shared work has a clear route when something crosses both teams.
Bring the tasks that repeatedly wait, interrupt planned work or lack a backup owner. Separate a temporary project backlog from recurring operations. If the need is a defined migration, a project engagement may fit better; if it is an ongoing split between internal support and outside infrastructure or security work, co-management can provide that structure.
A useful proposal names what your team keeps as clearly as what NetSys takes on. It should address vendor coordination, employee departures, production changes, restore requests and incidents where several systems are involved. Shared work still needs a primary owner so two teams do not assume the other has acted.
Agree responsibilities, establish access and test the handoff
We review the environment, current agreements and internal responsibilities with your IT lead. Onboarding establishes authorized access, documentation, supported systems and any prerequisites before coverage begins. The teams then walk through representative situations: a failed backup, an urgent access change, an after-hours alert and a production change. Each needs a contact route, decision owner and record of the work. Review the split when staffing, tools or systems change.
What to define in a co-managed IT arrangement
Responsibility matrix and escalation
Give each recurring task and incident decision a named owner.
- Internal, NetSys and vendor responsibilities for users, applications, infrastructure and security
- Supported hours, request channels, priorities and escalation when the first owner is unavailable
- Authority to approve changes, isolate equipment, disable access or start recovery
- A shared record of exceptions, dependencies and separately scoped projects
Access, tooling and documentation
Visibility and access should match the work each team performs.
- Named administrative access with appropriate controls and a documented removal process
- An agreed ticket, alert and documentation workflow, including any integration limits
- Tool ownership, licenses, data access and export arrangements stated in the proposal
- Current inventories, configurations and vendor contacts available to authorized owners
Infrastructure, security and recovery tasks
Select the responsibilities that address your actual capacity gaps.
- Agreed monitoring, maintenance, patching and configuration responsibilities
- Security-tool administration, alert review and response authority defined separately
- Backup monitoring, restore requests and representative recovery tests assigned to an owner
- Scheduled changes coordinated with application owners and business operating windows
Projects and service review
Keep project work and ongoing operations connected without blurring scope.
- Technical discovery, migration or rollout work scoped with deliverables and acceptance checks
- Operational handover after a project, including documentation and unresolved issues
- Review of repeated incidents, backlog, completed work and gaps in the responsibility split
- Transition arrangements for credentials, documentation and tools if the service changes
Support that works with your internal IT ownership
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your co-managed it stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- A written split covering routine work and the decisions that arise during incidents
- Tooling and access arrangements established before either team depends on them
- Project deliverables separated from the responsibilities of ongoing support
- An operating review based on work completed, exceptions and the needs of your team
The responsibility matrix, published
Co-managed IT fails when nobody wrote down who owns what. This is the starting split we formalize with every co-managed client at kickoff. Your version is adjusted to your team and put in writing:
| Area | Your internal IT | NetSys |
|---|---|---|
| Day-to-day helpdesk | First line, keeps the relationships | Overflow, after-hours, and depth |
| 24/7 monitoring & alert triage | Full visibility | Owns and staffs it |
| Patching & updates | Change windows agreed jointly | Executes and reports |
| Security stack (MFA, EDR, email, backups) | Full visibility | Operates and verifies |
| Major incidents & escalations | Informed and involved | Leads the response |
| Projects & buildouts | Scoped jointly | Engineering muscle |
| Documentation | Shared system: both maintain it | Shared system: both maintain it |
The matrix is a working document, not a sales page. It is reviewed whenever your team or environment changes, so the split never drifts into assumption.
Build the responsibility matrix with your IT lead
The downloadable worksheet leaves the owners blank for your team to agree. These rows show the decisions it should capture.
| Responsibility | Owner and approval question | Evidence or handoff |
|---|---|---|
| Help desk | Who is first line, and when does the backup team take over? | Ticket route, escalation threshold and service hours |
| Security incident | Who leads and who may isolate an affected system? | Response authority, contacts and incident record |
| Backup and restore | Who checks jobs and who approves a production restore? | Restore-test result and business acceptance |
| Production change | Who proposes, approves, executes and rolls back? | Change window, result and updated documentation |
| Project | Who owns delivery and the final sign-off? | Separate scope, dependencies and acceptance checklist |
Download the responsibility worksheet (CSV).
Coverage, licenses and after-hours tasks must be agreed; the worksheet is not a service commitment.
Three situations a co-managed scope can address
Illustrative arrangements to discuss, not staffing promises or preset packages.
| Situation | Internal team may retain | NetSys work to scope |
|---|---|---|
| One IT lead | Application knowledge, staff relationships and approvals | Monitoring, security, backups and an escalation route |
| Multiple sites | Local coordination and first-line support | Shared standards, central administration and agreed remote escalation |
| A migration alongside daily support | Business decisions and normal service desk work | Project delivery, cutover coordination and handover |
What moves the price of co-managed IT
Co-managed IT is priced monthly for the work you hand over, not for a job title. What moves the number, and what to pin down in the quote:
| What moves the price | Why | Pin it down in the quote |
|---|---|---|
| Responsibilities handed over | Monitoring alone is less work than monitoring plus security operations, patching and escalation | The responsibility matrix, attached to the quote |
| Users, devices and servers covered | Each one adds monitoring, patching and protection work | An inventory both teams have checked |
| Tools and licenses | Running our stack or keeping yours changes licensing and integration work | Who owns each tool and license, and what happens to them at exit |
| Coverage and escalation | Monitoring runs 24/7; using our help desk, staffed seven days a week from 4 a.m. to 11 p.m. Eastern time, beyond your team's hours is a separate choice | Hours, contacts and escalation written down by severity |
| Projects | Migrations and build-outs sit outside the monthly service | Deliverables and acceptance checks for each project |
NetSys publishes no rate card. Agreements run month to month.
Two common splits, as illustrations
Two shapes a co-managed arrangement often takes. They are illustrations, not client configurations; your version goes into the responsibility matrix above:
| Situation | Your team keeps | NetSys takes on |
|---|---|---|
| A one-person IT department | User support, vendor relationships and business applications | Monitoring and alert triage, patching, the security stack and backups, plus a bench for projects and time off |
| An internal team tied up with one system | The line-of-business application and first-line support | Microsoft 365 administration, Intune device management, backups and restore tests |
24/7 co-managed IT support
Not every part of a co-managed arrangement runs around the clock. What runs 24/7, what runs in help desk hours, and who handles each in the starting split:
| Work | Hours | Who handles it |
|---|---|---|
| Monitoring and alert triage | 24/7 | NetSys owns and staffs it; your team keeps full visibility |
| Emergency service | 24/7 | A NetSys engineer, under the escalation route and approval rights in your responsibility matrix |
| Major incidents | 24/7 | NetSys leads the response, with your team informed and involved |
| Help desk | Seven days a week, 4 a.m. to 11 p.m. Eastern | Your team as first line, with NetSys taking overflow and after-hours requests if you choose |
| Patching and planned changes | In change windows agreed with your team | NetSys executes and reports |
What runs around the clock in 24/7 IT support.
This is the starting split. The hours and owners for your arrangement go into the responsibility matrix and the agreement.
Where we deliver Co-Managed IT
Co-Managed IT in Westchester County · Co-Managed IT in White Plains, NY · Co-Managed IT in Suffolk County, NY · Co-Managed IT in Stamford, CT · Co-Managed IT in Pennsylvania · Co-Managed IT in New York City · Co-Managed IT in Morristown, NJ. We also support clients remotely wherever their systems run. See all locations and service areas.
Co-Managed IT FAQs
How do we stop work falling between two IT teams?
Name one primary owner and one backup for each task, then test the handoff with realistic scenarios: a failed backup, an urgent departure, an after-hours alert and a production change. Record the ticket route, required authority and who tells the business what happened. Review the split when staffing or systems change.
How is co-managed IT different from fully managed IT or staff augmentation?
A fully managed arrangement gives an outside provider a broader agreed operating role. Co-managed IT deliberately splits that role with your existing team. Staff augmentation usually adds a person or defined capacity under your direction. Compare ownership, coverage, supervision, tooling and deliverables rather than assuming one model is always cheaper or more capable.
Can our team keep its help desk and existing tools?
Yes, that can be part of the proposed split. Identify which tools remain, who owns the licenses and how requests, alerts and documentation will move between teams. Direct access or an integration depends on platform capabilities and permissions. If the tools cannot share a workflow, agree a practical handoff and record-keeping process before service begins.
What happens when an urgent issue crosses both teams?
Define the incident lead, contact path and authority in advance. A security alert may require action on an application your staff manages, so the response plan should state who can approve or perform that action and how unavailable contacts are handled. Response commitments and after-hours coverage belong in the agreement; detecting an alert is different from having authority to change the system.
What do co-managed IT services cost?
The quote depends on systems and users covered, the responsibilities delegated, service hours, existing tools, required licenses and the condition of the environment. Discovery, remediation and projects may have separate costs. Compare the proposed scope with the work a hire or another provider would actually perform, including supervision and tooling; a salary comparison alone is incomplete.
What should our IT lead bring to the first conversation?
Bring an outline of the environment, current tools and vendors, support hours, recurring problems and work that is waiting. Identify the decisions your team needs to retain and any access or data restrictions. That is enough to begin a responsibility matrix and identify onboarding prerequisites without committing to a wholesale replacement of working systems.
Can co-managed support cover onsite work and a future provider handover?
Both need explicit scope. Confirm the actual site locations, tasks that require physical access, scheduling and charges. The agreement should also explain how authorized access, documentation, tickets and tool dependencies are transferred or removed if the arrangement changes. Service terms and third-party commitments should be checked in the written proposal.
What is co-managed IT support?
Co-managed IT support is a split: your internal IT staff keep part of the work and an outside provider takes the rest under a written responsibility matrix. It differs from fully outsourced IT because your team stays in charge of what it keeps. A typical split leaves user support in-house and hands over monitoring and security.
What is included in co-managed IT services?
Whatever the responsibility matrix hands to NetSys, chosen from: 24/7 monitoring and alert triage, patching in agreed change windows, the security stack and its alerts, backups and restore tests, Microsoft 365 administration, Intune device management, help desk overflow and after-hours requests, and a bench for projects and time off. Emergency service runs 24/7 under the approval rights in the matrix. Migrations and build-outs are scoped as separate projects with their own deliverables.
How does co-managed IT onboarding work?
It starts with your IT lead: a review of the environment, current agreements and the work that keeps waiting, which becomes the first responsibility matrix. Onboarding then sets up named administrative access, documentation, the ticket and alert workflow both teams will use, and any prerequisites. Before coverage begins, the teams walk through a failed backup, an urgent access change, an after-hours alert and a production change, so each has a contact route, a decision owner and a record. The split is reviewed whenever staffing, tools or systems change.
Which tools does each team use?
Either ours or yours, and the proposal says which. If NetSys runs its stack, it is the one our managed IT clients get: NinjaOne for monitoring, patching and remote support, IT Glue for documentation, and Intune with Windows Autopilot for devices, plus endpoint protection. If your team keeps its own tools, we work inside them through named accounts. Either way, the proposal states who owns each license and what happens to tools, data and access if the arrangement ends.
Who handles support and escalations?
Your team stays first line for the work it keeps, and NetSys for the work the matrix assigns to it. Alerts reach NetSys monitoring 24/7, an engineer handles emergencies at any hour within the approval rights you set, and major incidents are led by NetSys with your team informed and involved. The help desk, staffed seven days a week from 4 a.m. to 11 p.m. Eastern, takes overflow and after-hours requests if you choose, and every owner in the matrix has a named backup.
Will our internal IT team lose control of our systems?
No. Your team keeps admin authority over what it runs, and NetSys works through named accounts inside the split you approved. Changes follow the approval rules in the matrix, and both teams work from an agreed ticket, alert and documentation workflow. If the arrangement ends, access and records are handed back as the agreement sets out.
Is co-managed IT support available 24/7?
Monitoring and emergency service run 24/7. Our help desk is staffed seven days a week, 4 a.m. to 11 p.m. Eastern, so your staff can reach an engineer outside your internal team's hours if the responsibility matrix gives us after-hours requests. Patching and planned changes run in windows both teams agree, and the agreement states the hours that apply to each responsibility.
Sources and technical references
Guides on this topic
- Download the co-managed scoping worksheet
- Help desk responsibilities
- Security response responsibilities
- Separate project delivery
- Compare a fully managed IT scope
- Compare support pricing and exclusions
- Plan support across construction offices and field teams
- Coordinate support around engineering project workflows
- When a co-managed arrangement fits
- Managed services vs professional services: which engagement fits
- Intune vs NinjaOne: device management and RMM compared
- Read the multi-divisional company case study
- IT outsourcing services
- co-managed IT for Florham Park offices
- co-managed IT for Uniondale office towers
- managed IT services in Raleigh
- What is co-managed IT? The definition and how the split works
Bring your IT lead and the work you want to delegate.
Mark what your team wants to keep, what needs backup and what repeatedly waits. We will use that to define ownership, approvals and coverage.