IT Operating Model Assessment

FAQs

Should we outsource IT or keep it in-house? 

For most mid-market organizations it isn’t either/or — it’s a function-by-function decision. Functions where internal demand exceeds coverage, like 24/7 security monitoring and compliance management, are usually outsourced or co-managed first, while well-staffed functions like day-to-day user support often stay in-house. The deciding factors are IT team size, location count, compliance obligations, and growth plans. 

What is co-managed IT? 

Co-managed IT is a shared model where your internal team keeps ownership and a provider adds capacity, specialized skills, or after-hours coverage. It fits organizations with a capable IT team that is stretched by growth, compliance, or 24/7 requirements — you keep control while closing specific gaps. 

How many IT staff does 24/7 security monitoring require? 

Around eight dedicated security analysts. Continuous coverage means three shifts plus weekends, holidays, vacation, and turnover — which is why organizations with IT teams under roughly ten people almost never run a true in-house SOC, and typically use a managed or co-managed SOC instead. 

Which IT functions do mid-market companies outsource first? 

24/7 security monitoring and response is usually first, because staffing it internally requires about eight dedicated analysts. Compliance management follows in regulated industries such as healthcare, financial services, and defense manufacturing. Day-to-day user support is often last — it is the function mid-market IT teams most commonly keep in-house or run co-managed. 

When should you keep IT in-house? 

When coverage matches demand: the function has a dedicated owner and your team is honestly confident it is working. A staffed helpdesk your users rate well, or infrastructure your team manages confidently, does not need to be outsourced. Outsourcing decisions should target the functions where demand has outrun your team — not replace what is working. 

How is this assessment scored? 

Each of the eight IT functions gets a demand score, based on your size, locations, compliance obligations, 24/7 needs, and growth plans, and a coverage score, based on who owns the function today and how it is going. The gap between the two produces the verdict: keep as-is, co-manage, or bring in a partner. Results appear immediately, without an email address.