In House IT, Break Fix, or a Managed Partner? How Nonprofits and Law Firms Can Decide

• In house IT works well when you have enough work to keep one or more people busy, and the money to pay them well and cover their time off.
• Break fix works for very small offices with simple needs and little sensitive data. It gets risky as soon as you hold client or health records.
• A managed partner fits many organizations with about 10 to 250 staff that need steady care, security, and planning without building a full team.
• A fractional CIO (a part time senior technology leader) can sit on top of any of these. More on that below.

When it makes sense

• You have many staff, many sites, or special systems that need someone on the ground every day.
• You can hire at least two people, or you have a backup plan for vacations, sick days, and the day your IT person leaves.
• You have a leader who can set direction, not just fix things.

Where it gets hard

One person cannot be an expert in help desk, networks, cloud email, security, backups, and compliance. They also cannot be at work every hour of every day. When they leave, they often take the passwords, the diagrams, and the know how with them. Hiring a replacement takes time.

What it costs to compare

Salary is only part of the bill. The U.S. Bureau of Labor Statistics (BLS) reports that benefits made up about 30 percent of total employer compensation costs for private industry workers in June 2026 [1]. Nonprofits and law firms may differ, but it is a fair starting point.

Here are the latest national pay numbers from BLS for May 2025:

Role	National median pay	Rough total cost if benefits are about 30% of the total
Computer support specialist (help desk)	$62,890 per year [2]	about $90,000
Network and computer systems administrator	$99,130 per year [3]	about $142,000

The last column is our own math (pay divided by 0.70). It is an illustration, not a BLS number.

New York pays more than the national average. BLS reports that workers in the New York metro area earned a mean of $41.50 per hour across all jobs in May 2025. In the computer and math group, the mean was $67.04 per hour. [4] That works out to about $139,000 a year for a full year, which is our calculation, not a published figure.

Then add the costs that salary tables leave out: software and security tools, training, time spent hiring, and the cost of covering that person's time off. These vary too much for us to give one number.

Break fix means you call a technician when something stops working and pay for that visit or those hours.

When it works

• You have a small office, simple tools, and few staff.
• You do not hold sensitive client, case, or health information.
• Someone on your team is willing to keep a list of your accounts and devices up to date.
• You can live with a day or two of downtime now and then.

When it fails

Break fix only helps after the problem shows up. Nobody is watching for failed backups, missing updates, or odd sign in activity. Nobody owns the plan. The bills also move around, so a bad month can blow a grant budget or a firm's monthly forecast.

For a law firm, the bigger problem is duty. The American Bar Association says lawyers must make reasonable efforts to prevent unauthorized access to client information, and what is reasonable depends on the facts [5]. For a behavioral health or human services nonprofit, the HIPAA Security Rule already expects a risk analysis and ongoing safeguards. "We fix it when it breaks" is hard to defend when a funder, insurer, or regulator asks what you did to prevent the problem.

A managed partner takes day to day responsibility for your devices, accounts, updates, backups, and security tools, and gives your staff someone to call. You pay a regular monthly fee, usually based on the number of people or devices.

What a good partner should do

• Keep a current list of your devices, accounts, and software.
• Apply updates on a schedule and tell you what is out of date.
• Run security tools that watch for threats, not just old style antivirus.
• Set up backups and test that they restore.
• Help staff sign in safely, including stronger two step sign in.
• Give you a plain report on what was done and what needs a decision.
• Help you plan and budget, not only react to tickets.

What a good partner should not do

• Hold your accounts hostage or keep you in the dark.
• Make decisions about your money, your policies, or your data without you.
• Promise that nothing bad will ever happen. No one can honestly promise that.
• Hide extra charges until after you sign.

A managed partner is not free of trade offs. You share control, you depend on their people and processes, and a poor fit can cost you more than it saves. That is why the questions in the next section matter so much.

Bring this list to every conversation, including ours. Ask for answers in writing.

1. Who owns the admin accounts? The answer should be you. You should hold your domain, your Microsoft or Google admin access, and your backup accounts. The provider may have access, but they should not be the only ones who do.
2. What is written down? Ask to see sample documentation: network layout, account lists, and recovery steps. You should receive current copies, not have to ask twice.
3. What is the exit plan? What happens if you leave? How long does the handoff take, in what format do you get your documents, and are there fees?
4. Is security included or extra? Ask exactly what is covered: threat monitoring, email protection, two step sign in, backups, staff training, and incident help. Get the list in the agreement, not in a sales call.
5. Who covers after hours? Ask what "after hours" means, who answers, and whether it costs more. Do not accept a vague "we are always available." Ask what the agreement actually says.
6. How do they handle a security incident? Who tells you, who decides, and who talks to your insurer, funder, or clients? New York's breach law sets a 30 day deadline, after discovery, to notify affected New Yorkers [6], so this plan should exist before you need it.
7. Who actually works on your account? Ask about the people, not just the company. Ask how they train and back each other up.
8. How do they treat your private data? Where does it live, who can see it, and how do they keep one client's information away from another's? For law firms, this connects to the duty to supervise outside help.
9. What is not covered? Projects, new hardware, travel, and big migrations are often billed separately. Ask for examples.

Be careful if a provider:

• Will not tell you who owns the admin accounts, or keeps the passwords "for safety."
• Has no sample documentation or no written exit plan.
• Pushes you to sign a long contract before they have looked at your setup.
• Promises perfect security, zero downtime, or a fixed response time before they know your environment.
• Cannot say what is and is not covered, or answers every question with "it depends."
• Uses fear to close the sale.
• Bills for "security" but cannot name what is actually running.
• Is unwilling to put what they say in writing.

A CIO is the leader who connects technology to the mission. A fractional CIO does that job part time. They help you set a plan, a budget, and rules for risk. They also check the work of whoever runs your daily IT.

This helps in three common cases:

• You have an IT person but no strategy. A fractional CIO can guide the plan so your person is not making big calls alone.
• You use a managed partner. An independent view helps you hold them accountable. It also helps when the partner and the CIO are the same company, as long as you can still see who does what and why.
• You use break fix. A fractional CIO can help you decide when it is time to move off it.

For a sense of cost, BLS reports that computer and information systems managers in the New York metro area earned a mean of about $224,990 a year in May 2025 [4]. That is for a full time employee. Many organizations do not need a full time leader, and that is the point of the part time model.

NIST, the federal standards group, added a "Govern" function to its Cybersecurity Framework 2.0. It puts leaders in charge of setting risk direction. NIST also publishes a Small Business Quick Start Guide that smaller organizations can use [7]. A fractional CIO can help you turn that into a few clear decisions.

Use these questions as a start.

1. How sensitive is the information we hold? The more client, case, or health data you have, the less break fix fits.
2. How many people do we have? Under about 10, break fix may be enough. Between 10 and 250, many organizations lean toward a managed partner. Above that, in house staff often make sense.
3. Can we cover absences and exits? If one person is a single point of failure, fix that first.
4. Who sets the direction? Someone must own the plan and the budget. That could be you, a board member, or a fractional CIO.
5. What do funders, insurers, or malpractice carriers ask us to show? Their questions often tell you what level of care you need.

A mix is also fine. Plenty of organizations keep one internal person for day to day help and use a partner for security, after hours, and planning.

If you want a second opinion, we offer a free 30 minute Technology Readiness Review. It is a conversation, with no access to your systems needed.

• HIPAA Security Rule update. HHS proposed a stronger Security Rule in January 2025. As of October 2026, we found no final rule. The federal regulatory agenda lists final action for July 2027, but dates have moved before [8]. Until then, the current rule still applies, and risk analysis is still expected.

1. U.S. Bureau of Labor Statistics, Employer Costs for Employee Compensation, June 2026 (released Sept 9, 2026). bls.gov/news.release/ecec.nr0.htm
2. BLS Occupational Outlook Handbook, Computer Support Specialists (May 2025 pay). bls.gov
3. BLS Occupational Outlook Handbook, Network and Computer Systems Administrators (2025 median pay). bls.gov
4. BLS, Occupational Employment and Wages in New York Newark Jersey City, May 2025 (released June 5, 2026). bls.gov
5. American Bar Association, Model Rules of Professional Conduct, Rule 1.6(c) and Comment [18]. americanbar.org
6. New York General Business Law section 899-aa (30 days after discovery). nysenate.gov
7. NIST, Cybersecurity Framework 2.0 Small Business Quick Start Guide. nist.gov
8. Office of Information and Regulatory Affairs, Unified Agenda, HIPAA Security Rule (RIN 0945-AA22). reginfo.gov; proposed rule, Federal Register, Jan 6, 2025: federalregister.gov
9. Full source list and how we check claims: bitralynx.com/research sources