Co-Managed IT

What does TTS Cyber’s Co-Managed IT include?

TTS Cyber provides monitoring and management tools to your IT team. The service is for companies with one IT person, or a small IT team of two to five people.

TTS Cyber handles overflow tickets. A ticket is one logged request for IT support. TTS Cyber also covers after hours and vacations, and it takes on the security work.

TTS Cyber runs projects such as migrations and upgrades. It gives senior help on hard problems, which is called escalation. That means moving a hard problem to someone more senior. TTS Cyber also helps plan an IT roadmap, which is a plan for which IT work happens and when.

What is co-managed IT, and how is it different from other models?

Vendors and trade sources use the term co-managed IT for an arrangement where an outside managed service provider (MSP) works alongside a company’s own IT staff and provides part of the IT services without taking over completely. One vendor says the customer picks the areas where it wants outside help. No regulator or standards body defines the term.

Sources describe three models. One IT staffing and support vendor frames them by who owns outcomes, who manages the people, and who is accountable when something breaks. Each model is an alternative to the others:

• Full IT outsourcing, or fully managed IT, gives a provider responsibility for IT operations from start to finish.
• Staff augmentation adds individual technical people. You keep full management and operational control.
• Co-managed IT splits responsibilities between your team and a provider, based on a defined division of labor.

One vendor says co-managed IT keeps your team’s knowledge of how the company works and adds capacity and specialization.

When does co-managed IT make sense?

Vendors describe several situations where co-managed IT adds value. These describe fit and are not measured results. Any one of them can be a reason to look at it:

• Your team lacks depth in a specialty. One vendor gives cybersecurity as the example.
• You need coverage to continue, for example after hours.
• You need flexible capacity.
• You have trouble hiring technical talent, or your company is growing fast. A second vendor lists both, along with skill gaps.

What should you agree on in writing with a provider?

Both sides need to know who does what. One IT services vendor suggests a responsibility matrix, which is a written table of who owns each task. It recommends one accountable owner per task where possible. The same vendor lists items such as these:

• Help desk ownership and escalation: how to reach it, its hours, after-hours coverage, how serious problems are ranked, and what response to expect.
• Routine administration kept separate from approval of major changes.
• Security, backup and continuity tasks.
• Named owners for projects.
• Who has decision authority in an emergency.

This is one vendor’s practice suggestion, not a standard.

What do cyber agencies advise about a provider’s admin access?

A joint advisory (CISA AA22-131A) from cyber agencies in the US, UK, Australia, Canada and New Zealand includes advice for MSP customers on the accounts an MSP uses to reach your systems. It was last revised May 11, 2022. It tells customers to:

• Restrict MSP accounts to the systems the MSP manages, and keep them out of your internal administrator groups.
• Grant access on a need-to-know basis, using least privilege (only the access a task requires), and audit that MSP accounts are used for appropriate purposes.
• Disable MSP accounts that no longer manage your infrastructure.

It also says contracts should identify who owns IT security roles and responsibilities. They should require multifactor authentication (MFA, a second sign-in check such as a code) on all MSP accounts used to reach your environment. They should also say the MSP will not reuse administrator logins across customers.

This is guidance, not a law, and it does not say what any provider does. TTS Cyber is not a law firm, and this is general information, not legal advice.