Keep the IT person you have. An internal engineer keeps the computers running. The written security program, the evidence behind it, and the controls that keep a bad day from becoming a bad month are a different job, and both can run at once.
Stays with your IT person
Comes from Arain Systems
Keeping an office running is a full job on its own. The security program is a second one: it has to be written down, the controls have to be verified rather than assumed, and someone has to be able to produce the evidence on the week it is actually asked for. When both sit with the same person, the program is reliably the half that slips, because nothing breaks visibly when it does.
Splitting them also removes a single point of failure. The program, the documentation, and the runbook live outside any one person, so a resignation is a staffing problem rather than an institutional one.
If the arrangement stops making sense in either direction, it unwinds cleanly. Arain Systems can take the everyday IT over in full, or hand the program back with the documentation intact. See what switching looks like if replacing the incumbent is the actual question.
Your Microsoft tenant, your credentials, and your backups are yours before, during, and after. Your IT person keeps their access. A documented runbook means anyone who needs to pick the work up can, and that includes picking it up from Arain Systems. There is no lock-in in either direction.
Yes. That is what co-managed IT is. Your IT person keeps the help desk, the hardware, and the applications they already know. The security program, the controls behind it, and the evidence come from Arain Systems. Both run at once, and neither waits on the other.
No. You own your Microsoft tenant, your credentials, and your backups before, during, and after, and your IT person keeps their access. A documented runbook means anyone who needs to pick the work up can. There is no lock-in, including to Arain Systems.
Many can, and some do. The question worth asking is whether it is written down, whether the controls are verified rather than assumed, and whether the evidence could be produced on the week it is asked for. Keeping an office running is a full job already, and the program tends to be the half that slips when both sit with one person.
The security program, the documentation, and the runbook stay, because they were never in one person head. Arain Systems can also take the everyday IT over in full at that point rather than starting from nothing.
On the same per-user monthly rate as any other engagement, on whichever tier matches the work. Co-managed is a division of responsibility, not a separate price list. The published rates are on the plans page.
The review covers the whole environment, including the parts your IT person already handles, and the written findings go to both of you. Nothing changes hands to get it.
Get a free gap reportWritten by Hammad Arain, founder of Arain Systems. CCNA, CompTIA Security+, Microsoft AZ-104. Updated June 2026. Educational, not legal advice.
Offices that already have an IT person, internal or outsourced, and need the written security program and the evidence from someone whose whole job that is.
On-site across the Houston metro. See the cities we cover.