Insights and Resources
What Is Your IT Provider Actually Responsible For?
Published 2026-10-14 by Mark Schilling · 10 min read
Cybersecurity Awareness Month is a useful time to ask a practical question: when something goes wrong, does everyone know who is responsible? For a business working with an IT provider, clear answers about access, backups, and incident response can reveal gaps before they cause an outage or security incident.
When a business hires an IT provider, everyone usually feels a little safer. There is finally someone watching the technology, answering support calls, installing updates, and helping when something breaks.
Then a serious question comes up.
Who was supposed to test the backups? Who removes access when an employee leaves? Who decides whether a new cloud application is safe? Who keeps the cyber insurance requirements current?
If the answer is, "We thought they handled that," you do not have an IT problem yet. You have a responsibility problem, and it can become an IT problem very quickly.
The best managed IT relationships are not built on assumptions. They are built on a written understanding of what the provider owns, what the business owns, and what both sides must do together.
Outsourcing IT Does Not Outsource Accountability
Hiring an outside provider can be the right strategic decision for a small or midsize business. It gives the company access to deeper expertise, broader coverage, and tools that would be difficult to build internally.
It does not transfer every responsibility away from the business.
The National Institute of Standards and Technology advises small businesses to document service levels, responsibilities, and expectations in a managed services agreement. NIST also makes an important point: when a business outsources cybersecurity work, it does not transfer its ultimate responsibility for protecting its systems and data.
That is not an argument against managed IT. It is an argument for managing the relationship well.
Your IT provider can operate controls, monitor systems, document work, and advise leadership. Your company still makes business decisions, approves risk, controls employment decisions, and determines what information matters most.
The Three Types of IT Responsibility
Most technology responsibilities fall into one of three groups.
Provider-owned responsibilities
These are tasks the provider is expected to perform under the agreement. Examples may include monitoring alerts, applying approved patches, resolving support tickets, maintaining security tools, and reporting on system health.
The exact list depends on the contract. A service that is common in the industry is not automatically included in your plan.
Business-owned responsibilities
These require business authority or information the provider does not possess. Leadership decides who should have access, which risks are acceptable, what downtime the company can tolerate, which vendors may handle data, and how much to invest.
An IT provider should advise those decisions, but it cannot make all of them for you.
Shared responsibilities
These require action from both sides. Incident response, backup recovery, employee onboarding, compliance, strategic planning, and AI governance are common examples.
Shared does not mean vague. Each side should know its next action, deadline, and decision authority.
A Practical IT Responsibility Matrix
Use this table as a starting point. Your actual agreement may assign the work differently.
| Area | IT provider typically handles | Business typically handles | Shared decision or verification |
|---|---|---|---|
| Help desk | Receives, prioritizes, and resolves covered requests | Tells employees how to request help and identifies business urgency | Reviews recurring issues and satisfaction |
| Patch management | Deploys approved operating system and application updates within agreed timelines | Approves downtime for systems that cannot update automatically | Defines exceptions and reviews missed devices |
| Endpoint security | Operates the agreed security tools and responds to alerts | Requires employees to use managed devices appropriately | Reviews coverage, exclusions, and response expectations |
| User access | Creates, changes, and removes access after an authorized request | Decides who should have access and reports staffing changes promptly | Reviews privileged and inactive accounts |
| Backups | Monitors the covered backup jobs and addresses failures | Defines which systems and data are critical | Tests recovery and confirms recovery objectives |
| Disaster recovery | Maintains the contracted recovery technology and runbook | Defines operational priorities and acceptable downtime | Conducts exercises and updates the plan |
| Cyber insurance | Supplies technical evidence within the scope of service | Works with the broker, answers business questions, and approves representations | Reviews control requirements before renewal |
| Compliance | Helps implement and document covered technical controls | Determines applicable legal, contractual, and industry obligations | Coordinates evidence, gaps, and remediation priorities |
| Vendors and software | Reviews technical compatibility and security when requested | Involves IT before purchase and approves the business relationship | Evaluates access, data, integration, and continuity risks |
| Incident response | Investigates technical indicators and performs contracted containment work | Activates leadership, legal, insurance, communications, and operational decisions | Exercises the plan and records lessons learned |
| AI tools | Configures approved platforms and technical controls | Defines acceptable use and prohibited data | Reviews usage, training, access, and emerging risk |
| Technology strategy | Provides recommendations, roadmap options, and cost estimates | Sets business priorities and approves budgets | Reviews the roadmap regularly |
The point is not to make every row match this example. The point is to make every row explicit.
The Most Dangerous Gaps Usually Hide in the Word Managed
The phrase "managed IT" sounds comprehensive, but no provider manages every device, application, vendor, process, and business decision automatically.
Consider backups. A provider might monitor Microsoft 365 backups but have no agreement to protect data inside a specialized cloud application. It might back up a server every night without having authority to decide which system must be restored first after an outage. It might confirm successful jobs without conducting a full recovery test.
All three activities matter, but they are not the same service.
The same issue appears with security. Installing endpoint protection is different from monitoring it. Monitoring alerts is different from providing around-the-clock incident response. Helping complete a cyber insurance questionnaire is different from accepting responsibility for the accuracy of the company's insurance application.
Ask what each service actually includes, how often it happens, how it is verified, and what happens when something fails.
Five Conversations to Have With Your IT Provider
1. What is explicitly included and excluded
Request a plain-language service list. Identify business systems, locations, devices, and applications that fall outside the agreement. Pay particular attention to cloud applications purchased directly by departments.
2. Who owns security decisions and incident response
A joint advisory from CISA and partner cybersecurity agencies recommends that MSP contracts clearly assign security responsibilities and explain incident response, recovery, and notification arrangements.
Ask who receives an alert at 2:00 a.m., who can isolate a device, who contacts leadership, and when the cyber insurance carrier or legal counsel becomes involved.
3. How are backups tested
A successful backup notification confirms that a job completed. It does not prove that the business can restore the right data within the required time.
Document what is backed up, how frequently, how long it is retained, where it is stored, and how often recovery is tested. Include Microsoft 365 and critical cloud applications, not only servers.
4. What must our employees and managers do
Even the best provider cannot remove access for a terminated employee if no one reports the termination. It cannot protect an unapproved application it does not know exists. It cannot prioritize recovery without knowing which operations matter most.
Define how your team reports employee changes, suspected incidents, new vendors, new locations, compliance requests, and significant business plans.
5. How will we review the relationship
Responsibilities change as the business adds employees, software, locations, regulations, and customer requirements. Review the matrix at least annually and after a major organizational or technology change.
A strategic business review should cover more than ticket counts. It should address risk, aging systems, upcoming projects, insurance requirements, recurring support problems, and the technology roadmap.
Warning Signs That Responsibilities Are Unclear
- Leaders cannot describe what the IT agreement includes.
- The provider and client give different answers about who owns backups or security monitoring.
- New employees receive access informally, and departing employees are sometimes reported late.
- Departments buy cloud software without a technology or security review.
- Cyber insurance questions trigger a last-minute search for evidence.
- Recovery has never been tested with business leaders involved.
- The provider reports activity but does not discuss risk, priorities, or business outcomes.
- Important work depends on one employee or one technician knowing what to do.
One warning sign does not prove the relationship is failing. It does mean the responsibility model deserves attention.
What a Good IT Provider Should Give You
A good provider should be willing to explain its responsibilities without hiding behind jargon. You should be able to understand:
- What systems and users are covered.
- Which services operate continuously and which occur on a schedule.
- How urgent issues are escalated.
- What evidence and reporting you receive.
- Which work requires separate approval or cost.
- What your employees and leaders must do.
- What happens during an outage or security incident.
- How responsibilities transfer if the relationship ends.
Transparency protects both sides. It prevents the client from assuming a service exists when it does not, and it prevents the provider from being blamed for a decision or system it was never allowed to manage.
If your company has internal IT staff, the same principle applies. A co-managed IT relationship works best when the internal team and outside provider use a written responsibility matrix instead of relying on job titles or informal habits.
Frequently Asked Questions
Is an MSP responsible if our business experiences a cyberattack
That depends on the contract, the provider's actions, the client's actions, and the facts of the incident. No reputable provider can promise that an attack will never occur. The agreement should define the security services, response duties, notification process, limitations, and responsibilities of both parties. Legal questions about liability should be reviewed by qualified counsel.
Should our IT provider complete our cyber insurance application
The provider can supply technical facts and evidence for systems it manages. Business leadership should coordinate with the insurance broker and approve the final representations. Do not guess, and do not assume a control exists because it appears on a renewal form.
Who is responsible for employee access
The business decides who should have access and must report hires, role changes, and departures promptly. The IT provider can implement those authorized changes, maintain procedures, and help review inactive or excessive access.
Is backup testing the provider's responsibility
It should be assigned explicitly. The provider may operate and test technical recovery, while business leaders confirm priorities, acceptable downtime, and whether restored systems support real operations. Both sides should participate in a meaningful recovery exercise.
How often should we review IT responsibilities
Review them at least annually and whenever the company changes providers, adds a location, adopts a critical application, faces a new compliance requirement, renews cyber insurance, or substantially changes its workforce.
A Useful Next Step
Use Cybersecurity Awareness Month to start this conversation, then revisit it throughout the year. Take the matrix in this article to your next leadership or IT meeting. Replace every word such as "typically" with a name, company, deadline, or contract reference. Any blank row is a question to resolve before an incident resolves it for you.
If your current arrangement still feels unclear, Schilling IT can help you review the environment, identify uncovered responsibilities, and build a practical technology roadmap. Start with our free security assessment, or talk with our team about a managed or co-managed IT relationship built around clear accountability.