I'm the IT Director for a public library system with four branches. Our internal IT team is just me and one full-time assistant/help desk technician. We've outsourced major projects such as wireless access point upgrades and server or switch replacements, but we need ongoing expertise for maintaining the resulting infrastructure.
My role is split between IT and general administration, including staff management, policies, budgeting, grants, facilities, and safety. Much of my IT time is already taken up by project management, so I'm looking for outside support with:
- Physical and virtual server updates, maintenance, and backups
- On-premises and cloud storage, backup, and redundancy for more than 10 TB of archival data
- Network security, monitoring, configuration, and infrastructure support
- Possibly managed endpoint protection
The challenge is that nearly every MSP I contact says it can provide co-managed infrastructure support, but the proposals always include help desk services, workstation patching, email protection, security awareness training, laptop imaging, and other end-user offerings. We have about 65 employees, and our internal team has enough capacity to handle those tasks. What we lack is specialized networking, security, and infrastructure experience.
Is this common because smaller organizations are not profitable enough for infrastructure-only support, or is bundling end-user services mainly a sales and business-model issue? Would it be better to approach regional infrastructure consultants, MSSPs, or professional services firms instead of traditional MSPs? How should I define the scope so that providers understand we want genuine co-managed infrastructure support? I'm also interested in providers serving Massachusetts or the broader New England area that work this way.
4 Answers
Try describing the engagement as infrastructure and security consulting or managed infrastructure services rather than leading with “MSP.” Ask for a clearly defined scope covering servers, virtualization, backups, storage, firewalls, switching, wireless, monitoring, vulnerability management, and incident escalation. Explicitly state that your staff retain ownership of help desk, desktops, user administration, workstation patching, imaging, and routine endpoint support.
There are providers that do exactly this, including firms that support municipalities, schools, and libraries through a split-responsibility model. A practical arrangement might have your team running the ticket queue and daily user support, an MSP handling licensing and standard Windows or cloud administration, and an infrastructure consultant handling network architecture, wireless, firewalls, servers, backups, cloud platforms, DNS, certificates, and complex escalations.
You could also consider a monthly block of consulting hours or a small retainer with defined response times instead of a full managed-services contract. That can work well when the environment is stable but still needs expert backup and periodic maintenance.
The endpoint protection requirement may be causing some of the confusion. If a provider is responsible for network security or incident response, it will reasonably want visibility into endpoints and control over remediation. Define the boundary carefully: for example, the provider can manage the firewall, network monitoring, server security, and endpoint detection platform, while your team handles user-facing remediation unless an incident meets an agreed escalation threshold.
The more clearly you document who owns endpoint containment, malware cleanup, identity incidents, and recovery decisions, the easier it is for a provider to quote the infrastructure portion without taking on unlimited liability.
This is fairly common. Traditional MSPs often make most of their predictable recurring revenue from per-user services such as help desk, endpoint management, licensing, and security training. Network and server work can be more specialized but may be sporadic, so many firms try to attach it to a larger per-user package. You are not asking for anything unreasonable; you may simply be talking to providers whose standard business model does not fit.
Smaller regional firms and independent infrastructure consultants are often more flexible than large or franchise-style MSPs. Some will price by device, server, site, or project retainer instead of by user.
A named escalation engineer, response-time commitments, scheduled maintenance, monitoring responsibilities, and an after-hours procedure are more useful requirements than a generic request for co-managed IT.