Co-Managed IT Checklist: Is Your Internal IT Team Ready?

A co-managed IT checklist is a short readiness test you run before bringing an outside team in beside your own IT person. It tells you whether co-managed IT will work for you right away, needs a few weeks of cleanup first, or isn’t the right model at all.

I’m Jeffrey Bowles, Partner and Director of IT Services at ACT360. The checklist below is the same ground we cover in the first conversation with an Ontario business that already has an IT person or a small IT team. Go through it with your IT lead in the room. Their answers matter more than yours.

Being ready for co-managed IT means your internal IT person and the outside team can split the work without gaps or overlap. That takes a named internal owner, company-held admin access, basic documentation, one set of tools and a leadership decision on scope.

Co-managed IT is an arrangement where an outside provider works alongside your internal IT staff instead of replacing them. Your person usually keeps daily support and the systems they know best. The outside team takes the work that one person can’t cover well: after-hours and vacation coverage, security hardening, projects and planning.

Readiness isn’t about how good your IT person is. An excellent IT person can still work in an environment that isn’t ready, simply because nobody ever had time to write anything down. It’s about whether a second team can step in without guessing.

If you’re still deciding whether the model fits at all, start with whether co-managed IT support is right for your business. This post assumes you’re leaning yes and want to know what to fix first.

Check seven things in order: who owns IT internally, who holds the admin accounts, what is documented, how the work will split, which tools both teams use, where security stands, and whether leadership has agreed on scope. Each one is a yes, a partial or a no.

1. Name the internal IT owner and confirm they want backup, not a replacement.
2. Move every admin account into company ownership, with at least two people holding access.
3. List your systems, licences, vendors and renewal dates in one shared place.
4. Write down which work stays inside and which goes to the outside team.
5. Agree on one ticketing system and one monitoring tool for both teams.
6. Check MFA, backups and patching against a basic security baseline.
7. Get leadership to sign off on scope, budget and a quarterly review.

Order matters here. Steps 1 and 2 are the ones that sink an arrangement later if they’re skipped, so do them first even if they feel like paperwork. The rest of this post walks through each area, with what “ready” looks like and what “not yet” looks like.

The full checklist covers seven areas. For each one, compare your business against the “ready” column and the “not yet” column. Mostly ready means you can scope the arrangement now. Mostly not yet means cleanup comes first.

Print it, or share it with your IT lead before your next meeting. A “not yet” in one row isn’t a dealbreaker. A “not yet” in the first two rows is the thing to fix before anything else.

The company should own every admin account, not your IT person personally and not the provider. Each team then gets only the access its share of the work needs, and that access can be reviewed or removed without anyone’s cooperation.

This row gets its own section because it’s the hardest one to fix after the fact. If your IT person leaves on bad terms, or you change providers, you need to be able to lock everything down in an afternoon.

• Keep Global Administrators few. Microsoft recommends assigning the Global Administrator role to fewer than five people, plus two cloud-only emergency access accounts that live outside daily use.
• Give everyone else narrower roles. A help desk admin doesn’t need the keys to everything.
• Use partner access that expires. Microsoft’s granular delegated admin privileges, or GDAP, give a provider time-bound, task-based access to your tenant. A GDAP relationship can last two years at most, and permanent ones aren’t possible.
• Store firewall, backup and domain registrar logins in a company password vault, not a spreadsheet on someone’s desktop.

The Canadian Centre for Cyber Security makes the same point in its guidance for organizations that use managed services: providers should only have the access that lets them manage their services, and your organization stays accountable for incident response. That holds whether the provider is doing everything or just backing up your IT person.

Before the outside team starts, write down your systems, licences, vendors, renewal dates, network layout, backup setup and the handful of things only your IT person knows. Rough notes are fine. Blank is the problem.

Your IT person doesn’t need to produce a binder. A shared document with these headings is enough to start:

• Every system people log into, and who the vendor contact is
• Licences and renewal dates, including Microsoft 365 and line-of-business software
• Network basics: internet providers, firewall, Wi-Fi, any site-to-site links between locations
• Where backups go, how often they run, and when a restore was last tested
• The quirks. The PC on the shop floor that can’t be rebooted mid-shift. The app that only runs on one old laptop. The vendor who only answers on Tuesdays.
• How new hires get set up and how leavers get shut off

That last item matters more as you grow. With 30 or 40 staff and regular turnover, onboarding and offboarding are where access quietly piles up. The first weeks of a co-managed arrangement usually go to filling these gaps together, and our post on what co-managed IT looks like day to day shows how that handoff runs once it’s underway.

Keep the work that depends on knowing your people and systems, and hand off the work that needs extra hours, coverage or specialized skills. Write the split down before day one, then revisit it each quarter.

This is a starting point, not a rule. Some internal IT people love security work and want to keep it. Fine. The point of the exercise is that nobody discovers at 2 a.m. that each side assumed the other was watching the backups.

One more question belongs here: what does your IT person stop doing? If the answer is nothing, co-managed IT adds a team without giving anyone time back.

Count how many of the seven areas look “ready.” Five or more means you can scope co-managed IT now. Three or four means a short cleanup first. Two or fewer usually means the business needs a different model.

A low score doesn’t mean your IT person has failed. More likely, it reflects years of running alone with no time to document anything, which is the exact problem co-managed IT exists to solve.

It can also point the other way. If the honest answer to row one is that IT is the controller’s side job, you’re likely better off with full managed IT services, where the provider owns the whole environment. Our comparison of MSP vs in-house IT in Ontario walks through that decision.

The biggest red flags are an internal IT person who wasn’t consulted, admin access held by one individual, a plan to quietly replace the IT person, and leadership that sees the outside team as cheap overflow rather than a defined role.

Some of these are fixable in a week. Others mean you should pause.

• Your IT person found out from the invoice. If they weren’t part of choosing the scope, expect resistance, and fair enough.
• One person holds every password. Fix this first, with them, before any outside team gets access.
• The real plan is replacement. Be honest about it. Co-managed IT as a quiet transition plan tends to sour everyone involved.
• “Overflow” is the whole scope. Without a written split, the outside team becomes a second help desk that nobody manages.
• No budget owner. Who approves projects the outside team recommends? If nobody, the recommendations will pile up unread.

The older post on the good and the bad of co-managed IT covers the situations where the model breaks down in more depth.

We start every co-managed engagement by understanding what your IT person already owns well, so we fill the real gaps instead of duplicating their work. In practice:

• A named contact, Adam Bowles or me, who coordinates directly with your internal person rather than through a generic queue.
• A written split of who handles what, including nights, weekends and vacations.
• Specialized work your person doesn’t have time for: security hardening, migrations and vendor negotiations.
• Quarterly reviews, so the split follows the business as it changes.
• A path to full managed IT later, without starting over.

Co-managed engagements are scoped to the gap being filled and confirmed at the assessment, so there’s no published per-user rate. If you’re in Simcoe County, our page on co-managed IT in Barrie covers how we work locally.

Run the checklist with your IT person, not about them. If you can’t tick the first two rows, fix those this month, whatever model you choose.

If you’d like a second pair of eyes on the results, book a free IT Readiness Assessment. We’ll go through the seven areas with you and your IT lead and tell you plainly whether co-managed IT fits now, later or not at all. You can also call 705-739-2281 or email [email protected].