Managed Service Provider vs In-House IT: Which Fits a Small Business

A managed service provider (MSP) usually fits a small business that needs broad coverage, such as help desk, patching, backup and security monitoring, without paying for a full-time hire. An in-house IT person fits when your needs are steady, specific to your business and large enough to keep someone busy. Many small businesses end up with a hybrid: an MSP for monitoring and after-hours coverage, plus one person on staff or a designated office lead. Either way, the decision should rest on written quotes and a written service level agreement (SLA), not on a headline price.

Who this is for and what you will have at the end

This is for owners and office managers at US companies with roughly 10 to 50 staff who are deciding between outsourcing IT and hiring. By the end you will have a cost worksheet for both options, a summary of how MSPs price their services, and a checklist of terms to put in an SLA and contract.

The article does not recommend a particular provider and does not give a "typical" MSP price, because published price ranges come from single vendor pages and vary with location and scope. Use your own quotes. Salary data comes from the Bureau of Labor Statistics, and the contract guidance comes from CISA.

Compare the two options at a glance

Neither option removes your responsibility for the data. The contract and your internal checklists decide who does what.

How MSPs price their services

Pricing pages from MSP software vendors describe four common models:

• Per user. A flat monthly fee per end user that covers support on all of that person's devices. It is simple to budget, though one person with a desktop, laptop, phone and tablet is covered by one fee, so the provider carries that load.
• Per device. A flat fee for each supported device type. It makes quotes straightforward, and the cost rises as you add devices. One vendor page gives an older example of per-device pricing attributed to a trade publication, without a date, which is why you should not use it as a current price.
• Monitoring only. The provider handles monitoring and alerting for a flat fee and bills remediation separately. It can look cheap until something breaks.
• Tiered. Packages at different service levels that increase in price as more services are added. The vendor page calls this one of the most popular models.

Pricing factors that providers say they weigh include the number of servers, workstations and mobile devices, which IT services you already have, and what backup software is in place. Collect the same inventory before you ask for quotes so each provider prices the same scope.

Questions to ask when comparing quotes

• Which devices and users does the fee cover, and what happens when I add or remove some?
• Is on-site work included, or billed separately?
• Are projects (migrations, new office setups) outside the monthly fee?
• Are after-hours incidents covered, and at what rate?
• What is the minimum term, and what notice is needed to cancel?
• Which security tools and backup services are included, and who owns the licenses?

What an in-house hire really costs

Start with pay. The Bureau of Labor Statistics Occupational Outlook Handbook lists a median annual pay of $61,860 for computer user support specialists, who provide technical help to non-IT users in person, by phone, chat or email, with May 2025 data. For network and computer systems administrators, who install, configure and maintain organizations' computer networks and systems, it lists $99,130. These are national medians, so pay in your city may be higher or lower.

Pay is not the cost. Build the loaded figure yourself:

Loaded annual cost of one hire =
    salary
  + employer payroll taxes
  + benefits (health, retirement, paid time off)
  + equipment and software licenses for the role
  + training and certifications
  + recruiting cost spread over expected years in the role
  + cost of covering absences (contractor or MSP backup)

Then compare it against the full MSP quote, including any projects and out-of-scope work:

MSP annual cost =
    monthly fee x 12
  + projects and on-site visits billed separately
  + licenses you still buy yourself
  + internal time to manage the vendor

For a company at the lower end of the 10 to 50 range, the question is often utilization. If a full-time person would spend half their time with nothing urgent to do, an MSP or a part-time arrangement may use the money better. At the upper end, steady daily tickets and onboarding can justify a hire. These are decision heuristics, not figures from the sources. For the rest of the IT budget, see How much should a small business spend on IT per employee.

What to put in the SLA and contract

CISA's joint advisory on protecting MSPs and their customers gives a useful frame: the contract should meet your specific security requirements and say who owns what. The items below combine CISA's contract recommendations with standard service-agreement elements. The CISA items are labeled.

Scope and responsibilities

• List the services, the covered users and devices, and anything excluded.
• State whether the MSP or you owns specific responsibilities such as hardening, detection and incident response. This is a CISA recommendation.
• Define the level of access the provider needs to your network and data, and keep it to that.

Service levels

An SLA should convert "fast support" into numbers. Ask for:

• Priority definitions (for example, outage affecting everyone versus a single user's question).
• A response target and a resolution target for each priority.
• Support hours, and what counts as after hours.
• How targets are measured and reported.
• What remedy applies when targets are missed, such as service credits.

The CISA material does not set response times, so those numbers are for you to negotiate based on how long your business can tolerate each type of problem.

Security terms from CISA

• Require multi-factor authentication to be enforced on all MSP accounts used to access your environment.
• Require that the MSP does not reuse administrator credentials across multiple customers.
• If the MSP handles monitoring, require comprehensive security event management and visibility into the MSP's activities and connections.
• Require the MSP to notify you of confirmed or suspected security events and incidents, and specify how and when.
• Keep your own logging on your systems. CISA advises that all organizations store their most important logs for at least six months.

Backup and recovery

• Include backup services that meet your resilience and disaster recovery needs.
• Ask that critical data and system configurations be backed up automatically and continuously, per CISA's advisory.
• Store backups somewhere retrievable, such as cloud storage or a location separated from the network.
• Include an incident response and recovery plan, and test it at regular intervals.

Reporting, documentation and exit

• Regular reports on tickets, patching status and incidents.
• Clear ownership of your documentation, credentials and configurations.
• Termination notice, data return and transition help.
• An offboarding checklist. CISA warns that disabling MSP accounts can be overlooked when a contract ends, so name who removes access and by when.

Have a lawyer review the final agreement, since this article cannot cover state law or your specific terms.

Choosing between them: a short process

1. Inventory. Count users, devices, servers, cloud services and critical applications.
2. List the work. Separate daily help desk, routine maintenance (patching, backup checks), security monitoring and projects.
3. Get three numbers. One MSP quote or more, the loaded cost of a hire, and the cost of a part-time or hybrid arrangement.
4. Score the risks. What happens when the one person is sick, leaves or is the only one who knows the system? What happens if the MSP's account is compromised?
5. Pilot or negotiate a short term. Where possible, begin with a shorter initial term, so you can adjust if service falls short.
6. Review yearly. Re-run the numbers when headcount changes significantly.

Troubleshooting common problems

Summary checklist

• Inventory of users, devices and applications prepared
• Quotes compare identical scope
• In-house cost calculated at loaded cost, not salary alone
• SLA includes priorities, response and resolution targets, hours and remedies
• Responsibilities for hardening, detection and incident response assigned
• MFA required on all MSP accounts, no shared admin credentials
• Incident notification terms written down
• Backup and recovery requirements and testing included
• Offboarding and data return terms agreed
• Contract reviewed by a lawyer

References

• Protecting Against Cyber Threats to Managed Service Providers and their Customers, CISA
• Computer Support Specialists, Occupational Outlook Handbook, Bureau of Labor Statistics
• Managed services pricing models, N-able