Managed IT for Mid-Market: MSP vs Co-Managed

A 40–400 person company usually has an IT owner, a pile of vendors, and a gap after 6 p.m. Fully outsourcing that stack to a classic MSP can work. It can also remove the people who know the business applications. Co-managed is the model we use most: your team stays, we cover the operating layer.

Service detail is on managed IT services. If you are in a regulated clinical environment, start with healthcare IT / HIPAA instead of a generic MSP conversation.

Model comparison

Classic MSP

The provider owns the queue, the tooling, and most of the environment. Your staff become requestors. This fits when you have little internal IT, or when you want a single throat to choke. It fits poorly when your applications team still needs admin rights and context the MSP will never have.

Co-managed

You keep identity, application owners, and business-facing IT. The partner takes monitoring, patch, backup, after-hours, and the overflow queue. Access is shared. Escalation is written. Nobody pretends one party “owns everything.”

Staff aug (not the same thing)

Buying extra hands without an SLA is contracting, not managed IT. Useful for a project. Fragile as a standing model — when the contractor is out, coverage is out.

Choose the model by who must approve a production change at 2 a.m., not by a brochure. If that person is still yours, you want co-managed.

SLA

24/7 coverage is a coverage statement, not a promise that every ticket is P1. An SLA that mid-market finance can live with names:

• Severity definitions (what is down, degraded, or a request).
• Response and restore targets per severity — and whether they are clock hours or business hours.
• The escalation path: who is called, in what order, including your side.
• What is in-scope (monitor, patch, backup, standard requests) vs project work.
• How missed targets are reported. If they are never reported, they are not targets.

We will not invent an uptime percentage for marketing. Uptime is measured on the systems you put in the contract. If a vendor leads with a number and cannot show the measurement method, treat it as decoration.

Refresh+support

Support without a refresh plan is how mid-market shops end up with a fleet nobody will touch. The operating model should include both:

• Support: the ticket, the after-hours path, and the standard request catalog (access, device, mailbox, VPN).
• Refresh: a living inventory, a replacement cadence for endpoints and aging infrastructure, and a rule for when “repair” becomes “replace.”
• Hygiene: patch windows, backup tests (restore, not just “job succeeded”), and a named owner for each critical system.

Refresh is planned work. It should not hide inside the monthly ticket pile. If you need the partner to run both, say so in the SOW — that is how co-managed stays honest.

Pricing clarity

Mid-market pricing should be explainable on one page:

• What is included in the monthly number (coverage hours, device or user count, monitoring, backup, patch).
• What is excluded (projects, major version upgrades, net-new sites, work outside the catalog).
• How it scales when headcount or sites change — a unit, not a surprise true-up.
• How you start — Discovery at $99, then a written scope. See pricing.

If the quote is only “per user” with no catalog, you will pay for the same work twice: once in the retainer and again as a project. Ask for the catalog. Managed IT is the landing for that conversation.

FAQs