Co-managed IT responsibilities belong in a written matrix that names one owner for every task: your IT team keeps the users, the local knowledge, and the daily priorities, and the provider owns infrastructure health, security, uptime, and the technology roadmap.
Last updated: October 15, 2026
Here’s a call I never want an IT manager at one of our dealerships to have to make. It’s a Saturday, the service drive is full, and the DMS is crawling at two stores. The IT manager has been chasing it since 7:30, so they call the outside provider the group pays every month, and the answer that comes back is some version of “that’s the network at your store, so that’s on you.”
That answer should never happen. A co-managed partner who says “that’s broken, that’s on you, IT” isn’t really a partner. They’re a vendor with a contract and a good excuse, and your IT person is now alone on a Saturday with both the problem and the bill.
A good co-managed partner says the opposite. I’m going to take ownership of all of it. That’s how I’d describe Helion’s side of every co-managed account we run, and after nearly 30 years and 2,000-plus dealerships I can say it pretty plainly: we consider ourselves ultimately responsible for all of the infrastructure. Your IT manager doesn’t stop running IT when we show up. Not at all. They stay in charge of their store and their people, and there’s simply no piece of the network, the security, or the hardware that both sides can point away from.
Getting there takes paper. Our page on co-managed IT for dealerships says the split gets worked out before anything starts, and this post is what that worked-out version looks like, area by area. Use it with us or with whoever you’ve got. The matrix works either way.
What a Co-Managed IT Responsibility Matrix Is
A co-managed IT responsibility matrix is a written table that lists every IT task at a dealership and names who does the work, who answers for the result, who gets consulted, and who just needs to know. It covers the internal IT team and the outside provider together, so no task ends up with two owners or none.
Project managers will recognize it as a RACI chart, which stands for responsible, accountable, consulted, and informed. I’d keep it simpler than that for most stores. You need one column for who does the work and one for who answers for it when it breaks at 8 o’clock on a Saturday, and everything else is detail you can add later if you want it.
The NIST Cybersecurity Framework 2.0 says the same thing in government language. Its GV.RR-02 outcome asks that roles, responsibilities, and authorities for cybersecurity risk be “established, communicated, understood, and enforced.” Four verbs. Plenty of co-managed arrangements get the first one right, sign the contract, and never really get to the other three, which is how a Saturday call turns into an argument about whose network it is.
If it isn’t written down, it isn’t owned.
Two Ways We Split the Work
Every co-managed account we run fits one of two shapes. In the first, Helion runs the day-to-day help desk and the high-level work, and the internal team handles what needs hands and local knowledge. In the second, the internal team keeps the help desk and Helion does only the high-level, strategic work.
What doesn’t change between them is the list of things we own. I’ll give it to you the way I said it on a call this month, because I don’t think I can say it better: “The health of the system, the security of the system, the stability, the uptime, the scalability, the purchasing recommendations, the technology recommendations.” That’s our column. It doesn’t move.
The reason that list sits with us is scale. All of our clients are on the same roadmap, and the firewall, wireless, and PC configurations we recommend have been deployed tens of thousands of times before they ever reach your building. They’re tried and true. An internal team of two can be very good and still never see a configuration fail across a few thousand stores, which is the kind of experience you only get by doing this for a lot of dealers at once.
| Question | Model 1: Help desk plus strategy | Model 2: Strategy only |
|---|---|---|
| Who answers staff calls and tickets | Helion’s help desk, live 6 a.m. to midnight Eastern, Monday to Saturday | Your IT team, with Helion behind every escalation |
| Who does hands-on work at each rooftop | Your IT team, plus Helion field support when needed | Your IT team |
| Who owns infrastructure health, security, stability, and uptime | Helion | Helion |
| Who makes purchasing and technology recommendations | Helion, approved by your IT lead | Helion, approved by your IT lead |
| Who your leadership calls about the IT program | Your IT lead, as the single point of contact | Your IT lead, as the single point of contact |
| Usually fits | A small internal crew buried in tickets | A capable team with the hours for users but not for planning |
IT people aren’t always thrilled to hear from an outside provider, and I get it. So the way I put it to them isn’t that they can’t do the work, because most of them can. It’s what I said on that same call: “the strategic stuff, the planning, they tend to not have time around that.” That’s the angle we always take, because it’s true. It’s not attacking anybody. It’s more like, hey, we can help with the part that keeps getting bumped.
Either way, the infrastructure has one owner.
The Matrix, Area by Area
Here’s the version we start from when we sit down with a new co-managed client. I’d tell you to copy it and mark it up. Some of it won’t fit your store and that’s fine, but have the argument about the rest before you sign anything, because the argument is honestly the most useful hour you’ll spend on the whole arrangement.
| Area | Your IT team | Helion | Answers for it when it breaks |
|---|---|---|---|
| Help desk tickets | Walk-ups and hands-on fixes (all tickets in Model 2) | Calls and tickets in Model 1, plus every escalation in both | Whoever owns the ticket, start to finish |
| Patching and updates | Approves maintenance windows around month-end and sales events | Sets the patch standard, deploys, reports what’s missing | Helion |
| Security monitoring | Reports anything odd, enforces local policy | Around-the-clock monitoring through a US-based, live-staffed SOC, plus advanced endpoint detection and response | Helion |
| Incident response | First on site, follows the written plan | Leads containment and recovery | Helion, with your senior lead informed throughout |
| Network, firewalls, and Wi-Fi | Physical access, local changes by request | Design, configuration standard, health, and uptime | Helion |
| DMS (Tekion, CDK, Reynolds, Karmak, Procede) | User setup, permissions, store-level questions | Everything the DMS runs on, plus technical escalations to the DMS provider | The DMS provider for the application, Helion for the rest |
| Outside vendors (internet, phones, OEM equipment, cameras) | Day-to-day relationship and billing questions | Technical requirements, escalations, holding vendors to them | Helion for technical issues |
| Projects (new rooftop, acquisition, DMS conversion, PC refresh) | Local scheduling with managers and staff | Planning, design, and project management | Named per project, in writing |
| Purchasing and technology recommendations | Final approval with leadership | Specs, vetting, and testing new technology | Helion for the recommendation |
| Backups and recovery | Says which systems the store can’t live without | Runs backups and tests restores | Helion |
| User accounts, new hires, and departures | Approves access requests from managers | Applies the access standard and multifactor sign-in, runs access reviews | Your IT team approves, Helion executes |
| FTC Safeguards compliance | Senior oversight, policies, and staff follow-through | Security program controls, scanning, annual human-led penetration testing, reporting | The dealership, under the rule |
You’ll read most of those rows and nod. A handful are where the Saturday arguments actually come from, so I want to spend a little more time on them.
Help Desk
Settle this row first. In Model 1 your staff call us directly and get a live person in 82 seconds on average. We track that number on purpose, because every provider in this business says they answer fast and almost none of them will tell you what fast means. In Model 2 your own team takes the calls and hands us whatever they can’t close. The rule I care about is the same in both. Once somebody picks up a ticket, they own it until it’s done, and it doesn’t bounce back and forth between two companies while a salesperson waits.
Patching
Your people know the store. They know nobody in accounting wants a PC rebooting in the middle of month-end close, so they pick the window. We own the standard and do the actual patching, and every month we tell you in writing what’s still missing. Nobody assumes. That’s the whole trick to this row.
Security Monitoring
If you only fix one row, fix this one. When IT people tell us what’s hardest for them, it’s almost always security, and specifically running something like a security operations center, which is honestly a separate job from keeping the IT running. You can’t watch alerts all night and also be fresh for the 7 a.m. printer emergency. Nobody can. In CDK Global’s 2024 dealer cybersecurity survey, 35% of auto dealers reported a cyberattack or incident that year, and 92% of those said it caused real financial or operational damage. A breach stops your sales floor. The matrix should say, without any hedging, who’s watching when the store is closed.
The DMS
Whoever your DMS provider is, Tekion or CDK or Reynolds or a truck platform like Karmak or Procede, they own their software and they’re good at it. No argument there. The trouble is that when a salesperson yells that the DMS is down, half the time the DMS is fine. The store’s internet circuit dropped, or the Wi-Fi in the service drive is fighting with a scanner, and the DMS company was never going to touch either one. We own that layer and we make the escalation call to the provider when it really is their side, so your IT manager isn’t stuck relaying messages between two companies. We’ve already seen this exact problem at enough stores to know which side it usually is.
Vendors
Every rooftop has a phone carrier, an internet provider, a camera company, and OEM equipment that somebody installed years ago. Who owns that? In our matrix the relationship can stay with your team. The technical side is ours, and that means no finger-pointing between vendors when the phones drop on a busy Monday.
Purchasing
Early on, one of our dealer clients ran its techs’ electronic dispatch on a $50 home wireless router. It went down constantly. Techs couldn’t dispatch. I talked them into a corporate-grade device at 10 times the price, it worked, and the problem went away. I’ve lost deals since then to cheaper bids, and I’d make the same recommendation again tomorrow. I mean that. That’s why purchasing sits in our column with your IT lead holding the final yes. Somebody has to own the recommendation, and it should be the side that’s seen the cheap version fail.
Accountability Doesn’t Split the Way the Work Does
The FTC’s Safeguards Rule, which covers franchised dealerships because they arrange financing, already has an opinion about this. Under 16 CFR 314.4(a), a dealership can have its Qualified Individual employed by a service provider, but if it does, it must “retain responsibility for compliance” and “designate a senior member of your personnel responsible for direction and oversight of the Qualified Individual.” Read that twice. Paragraph (f) adds that you have to oversee your service providers and periodically assess them.
Read that next to the matrix and the bottom row makes sense. We carry the security program, the scanning, the penetration testing, and the reporting. Your senior person directs it and signs off. If you want the full list of what the rule expects, our FTC Safeguards Rule checklist lays it out element by element.
It’s also why the people side matters more than most dealers expect. CompTIA’s IT Industry Outlook 2026, a survey of 1,012 business and technology professionals, found that 52% name data security as an area where their workforce needs development. That tracks. Those skills are hard to hire for at any company, and harder still for one IT person at a dealer group.
You can share the work. The responsibility stays home.
What a Good Co-Managed Partner Sounds Like
The bad version is easy to spot once you’ve heard it. Something breaks, the provider checks whether it’s technically in their scope, and if it isn’t, your IT person gets told it’s theirs. That’s a rough call for anyone to take, and it usually happens at the worst hour of the worst day. The good version takes ownership of everything and asks one thing back, which is that your team works with the standard instead of around it. Do that, and the way I put it on the call, “your job’s gonna be easy.”
To be fair to every provider out there, the matrix cuts both ways. An internal team that makes changes outside the standard can break things the provider is on the hook for, and a good partner will say so politely and early. That’s not finger-pointing. It’s the matrix doing its job.
What it never means is pushing your IT manager out of the way. Co-managed is the path where that person stays employed and in charge, with a bench behind them instead of standing alone. Still choosing a model? Our in-house vs managed vs co-managed IT comparison lays all three side by side. Dealers notice that. Our client retention rate is 98%.
Ownership is the whole product.
How to Fill In Your Own Matrix
It takes an afternoon, not a project. Here’s the order I’d do it in.
| Step | What to do | Where to start |
|---|---|---|
| List every system | Inventory every system and device at each store, including the camera recorder and time clock nobody remembers buying | Our guide to every system in a dealership technology stack |
| Name one owner per row | Your IT manager and the provider go down the matrix together and write one name in “answers for it when it breaks” | Any row with two names, or with each side naming the other, gets settled first |
| Add an on-site column (groups) | Name whoever can physically reach the firewall and closet at each rooftop | Our page on IT for dealer groups |
| Match your incident plan | Copy the same names into the incident response plan so the two documents agree | Our incident response plan template |
| Review it | Every quarter, and after every acquisition, staffing change, or new vendor | A newly bought store brings its own closet and vendors |
What IT Managers Ask Before They Sign
Can the provider overrule my IT manager in a co-managed setup?
A system fails on a Saturday night. Who’s actually on the hook?
How detailed does this document really need to be?
Our IT person is great. Why would they want a co-managed partner at all?
Is the split locked in once we sign?
One Owner per Line
Leadership usually comes at this from a different side than IT does. The question a GM or a controller asks me is whether they’ve got the right security at all, or whether somebody should take a second look at how the money’s getting spent, and a lot of the time they just don’t know. That’s fair. The matrix answers both. It shows who’s doing what, and it shows the rows nobody was doing.
If you want that second look, start with our Complimentary IT & Cybersecurity Assessment. We go through what your team covers now and where the gaps are, and we lay it out plainly for your IT lead and your leadership. Our co-managed and managed cybersecurity teams can pick it up from there if you want them to, and if you don’t, you still leave with a better map than you had.
Every line gets one owner. Anything less is a guess.