Managed IT or an In-House IT Department? Costs, Availability and Risks Compared

A printer stops working, a new colleague needs access, the next security update is pending – and at some point the question arises: do we hire someone for IT or hand it over to a service provider? Many small businesses have no one in-house for this. According to Eurostat, only 15.6 percent of German companies with 10 to 49 employees employed their own ICT specialists in 2024.

This guide compares both options objectively: what an in-house IT position actually costs, where its limits lie, what managed IT can deliver – and why the best solution is often a combination. All figures refer to Germany.

What an in-house IT position really costs

The starting point is salary. The pay atlas (Entgeltatlas) of the German Federal Employment Agency shows a median gross monthly salary of €5,536 for full-time IT system administrators, based on data as of the end of 2025. This includes one-off payments such as vacation or Christmas bonuses. For IT specialists for system integration (Fachinformatiker), the median is €5,189. Actual salaries vary considerably depending on region, experience and company size.

Employer social security contributions come on top. Below the contribution assessment ceilings, they total around 21 percent of gross salary in 2026: 9.3 percent for pension insurance and 1.3 percent for unemployment insurance (German Pension Insurance), 8.75 percent for health insurance based on the average additional contribution, and 1.8 percent for long-term care insurance (Federal Ministry of Health). Statutory levies and the contribution to the employers' liability insurance association are added on top.

The total cost of a single IT position is therefore likely to exceed €80,000 a year. But salary alone says nothing about whether the position can be filled at all.

Skilled staff are scarce – administrators in particular

According to Bitkom, Germany's digital industry association, around 79,000 IT positions are vacant in Germany in 2026. That is significantly fewer than in previous years, yet 78 percent of the companies surveyed still see a shortage of IT specialists. Specialists for IT administration and systems operations are the most sought after (Bitkom Research). In the previous year, it took an average of 7.7 months to fill a vacant IT position, according to Bitkom (Bitkom 2025).

One person is not a team: the availability problem

Even when the position is filled, a structural problem remains: a single IT specialist is not always there. By law, they are entitled to at least 20 days of paid leave based on a five-day week (Section 3 BUrlG, Federal Leave Act), and often more under collective or individual agreements. In addition, employees in Germany took an average of 14.6 days of sick leave in 2025 (Destatis) – plus public holidays, training and appointments away from the office.

Assuming, for example, 30 vacation days, ten public holidays, the average number of sick days and five training days, around 200 of roughly 260 working days remain on which the specialist is actually at work. On the remaining days, cover is needed – or problems are left unresolved.

Working hours also set limits: the German Working Hours Act generally allows eight, at most ten hours per working day and requires an uninterrupted rest period of at least eleven hours after the end of work (Section 3 and Section 5 ArbZG). A single person cannot permanently cover an outage at the weekend or a security incident at night.

Another risk is dependence on one person's knowledge. If documentation is incomplete, illness or resignation quickly becomes an operational risk.

IT is getting broader – and more demanding

The IT of a mid-sized company today includes end devices, network and firewall, servers or cloud services, Microsoft 365, backup, email archiving, telephony and information security. Hardly any single person is equally proficient in all of these areas.

At the same time, requirements are increasing. Germany's NIS2 Implementation Act has been in force since December 6, 2025. It covers companies in certain sectors with as few as 50 employees or more than €10 million in annual turnover and balance sheet total (Section 28 BSIG) and requires them, among other things, to implement risk management measures and to register with the Federal Office for Information Security (BSI). Responsibility lies with management: it must implement the measures and monitor their implementation (Section 38 BSIG) – regardless of whether IT is managed internally or externally. Companies that are not directly covered may also feel the requirements through customers and supply chains.

The case for an in-house IT department

• Proximity and short communication paths: An in-house specialist is available on site and can resolve small issues immediately.
• Knowledge of processes: They often know business applications, processes and users better than any external provider.
• Steering: They can drive projects forward, set priorities and coordinate service providers.

For companies with many locations, extensive in-house infrastructure or highly customized software, internal IT is therefore often indispensable – though rarely as a one-person department.

The case for managed IT

• Predictable costs: a fixed monthly price per device or employee instead of salary, ancillary costs and the risk of absence.
• A team instead of one person: vacation, illness and staff turnover no longer put your company at risk of outages.
• Broad specialist knowledge: from network and security to Microsoft 365 and backup.
• Preventive operations: monitoring, updates and endpoint protection run continuously instead of only reacting when something breaks.
• Scalability: support grows with the number of workstations.

Managed IT also has its limits: the provider is not on site all the time, first has to get to know your processes and works within agreed service hours. Projects, hardware and licenses are usually not included in the monthly price. Look for a clear service description – in particular the difference between response time and resolution time.

And: you can outsource technical operations, but not responsibility. The service provider supplies and operates the right IT. The company itself remains responsible for data protection, information security and legal obligations – as well as for decisions about which risks it is prepared to take.

Cost comparison: an example for 25 employees

The following comparison is a simplified model calculation. It compares the personnel costs of an internal full-time position with published fixed prices for external support. The scope of services of the options is not identical.

* Published prices of the oneCorp Professional and Complete plans, as of October 2026, net plus VAT, 12-month term, service hours Monday to Friday, 8 am to 6 pm. Hardware, licenses and projects are not included in any of the options.

In this example, external support costs significantly less than a full-time position and solves the cover problem at the same time. In return, an in-house specialist can take on tasks that no plan covers, such as projects or support for custom business applications. The comparison only becomes meaningful once your actual needs and the scope of services have been defined.

The middle way: an internal contact plus an external provider

For many companies, a combination works well: an internal contact person knows processes and users, takes in requests and sets priorities. The service provider handles operations, monitoring, security and specialist topics – and steps in when the internal person is unavailable.

This keeps knowledge in-house without one person having to shoulder everything alone. A clear division of tasks is important: who takes incident reports, who decides on changes, and who maintains the documentation?

Decision guide: which model fits?

The size indications are for guidance only and are not fixed thresholds.

Checklist before you decide

• How many users, devices, servers and locations do you support?
• Which systems are business-critical – and what does an hour of downtime cost?
• Who covers your IT today during vacation and illness?
• Is your IT documented, including access credentials and emergency procedures?
• What security requirements and evidence do customers, insurers or legislators expect?
• How will your company develop over the next few years?

Conclusion

The question “Managed IT or in-house IT department?” is less about salary than about availability, cover and breadth of knowledge. For many small and medium-sized businesses, a single in-house IT position is a risk – not because of the person, but because one person alone cannot replace a team. External support provides predictable costs and resilience, while an internal contact person keeps IT close to the business.

oneCorp supports companies with 10 to 100 employees with fixed monthly prices, a dedicated team and agreed response times – from a basic plan for maintenance and protection to a fully outsourced IT department (Managed IT). Whether and in what form this fits your company can be clarified in the free IT Quick-Check: in around 45 minutes, we go through 25 checkpoints in seven areas, and you receive a traffic-light overview with the most important recommendations.

As of October 2026. Salary data: median according to the Entgeltatlas of the German Federal Employment Agency (data as of December 31, 2025, full-time, including one-off payments). Contribution rates for 2026 with the average additional health insurance contribution. All calculations are simplified models and do not replace an individual calculation. The legal information is provided for general information only and does not constitute legal advice.