IT Department Structure For A Small Team: Who Owns What

For a team of one to five people, an IT department structure is a list of jobs, not an org chart. It names seven areas of work, gives each one owner and one backup, and writes down what goes to an MSP.

This guide comes from the team behind SherpaDesk, a helpdesk and professional services automation (PSA) tool a small IT team can run alone.

Key takeaways

• One owner per area, plus a different backup. Build The Matrix
• Seven areas are a starting map. Split or add rows to fit your team. The Areas A Small IT Department Owns
• Size changes the names, not the rows. See The Example
• Hand over tasks, not ownership. When To Bring In An MSP

What Is An IT Department Structure?

On a large team, the structure of an IT department is an org chart of managers and specialists. On a small team, it's who owns which work, because one person may hold three jobs.

The tool for that is a responsibility matrix, often called RACI.

Responsible people do the work. The Accountable person owns it and signs off. Consulted people give input first, and Informed people are kept in the picture. Each task should have only one Accountable person.

The Areas A Small IT Department Owns

Write the matrix by area of work, not by job title. Otherwise the work lands on whoever answers the phone. The only IT person at a 50-employee company described it on r/sysadmin: "I handle everything, servers, email, cybersecurity, onboarding, printer rage therapy, all of it."

NIST's Cybersecurity Framework asks that cybersecurity roles and responsibilities be "established, communicated, understood, and enforced."

Treat these seven areas as a starting map of the IT functions a small support team runs, and split or add rows to fit yours. Most relate to published guidance.

A task that fits two rows goes to the row whose A can fix it: a dead email server is devices, a locked mailbox is accounts.

What You Need Before You Start

• A month of closed tickets
• Your vendors and contracts, with renewal dates
• Your admin accounts and who holds each credential
• Your people, their hours, and vacation cover

How To Build The Responsibility Matrix

1. Write one row per area

   Start with the seven areas. Split a row only when two people really own different halves.

   Example: accounts and access covers starters, leavers, admin rights, and MFA.

   Common mistake: one row per person. That's a job description, and it hides the work nobody holds.

2. Name one accountable person

   Put exactly one A in every row. CIO's RACI checks flag a step with no A; more than one A, CIO says, invites slow, contentious decisions.

   Example: on a team of three, the senior tech is A for accounts and access.

   Common mistake: writing "IT team" as the owner. Nobody can call a team at 7 p.m.

3. Add a backup to every row

   The backup does the row's urgent work and its routine decisions when the owner is out. Only work the A agreed in advance waits; bigger decisions go to leadership.

   In a one-person IT department, the backup sits outside. Name an MSP contact for urgent contracted tasks, and a manager who can decide and knows where emergency admin credentials are stored.

   Common mistake: a backup who is the A, or who is out the same weeks.

4. Mark what goes outside

   For each row, write what the MSP, MSSP, or vendor does and what stays with you. NIST asks that cybersecurity roles for suppliers be "established, communicated, and coordinated internally and externally."

   Example: the MSSP watches alerts after hours; you keep patching and backups.

   Common mistake: "the MSP handles security." Name the tasks instead.

5. Publish it and review it

   Put it where every tech and your manager can read it. Review it when someone joins or leaves, and each quarter.

   Example: accounts and access, reviewed Nov 8, next review Feb 8.

   Common mistake: a long Consulted list. CIO warns that a lot of C's on a step "really slows down the project."

Responsibility Matrix Template

Copy it or download the text file; brackets mark what you fill in.

RESPONSIBILITY MATRIX TEMPLATE
For an IT department of 1 to 5 people
Team: [company, school, or MSP]
Last reviewed: [date] · Next review: [date]

ROLES
  A = accountable: owns the row (one per row)
  R = responsible: does the work
  C = consulted: gives input before the work
  I = informed: kept up to date on progress

ONE BLOCK PER AREA (copy for each of the seven)
Area: [queue, devices, accounts, vendors,
  projects, security, or documentation]
  A: [one name]
  R: [names]
  C: [names, or none]
  I: [names, or none]
  Backup: [who does urgent work and decides
    when A is out]
  Can wait: [work agreed to pause when A is out]
  Outside help: [MSP, MSSP, vendor, or none]
    They do: [named tasks]
    We keep: [named tasks]
  Admin access held by: [names, and where
    the credentials are stored]

CHECKS
  Every row has exactly one A.
  Every task in a row has an R.
  Every backup is a different person from the A.
  Every outside task is written in a contract.

Filled in for accounts and access on a three-person team:

• A: senior tech. R: junior tech for starters, leavers, and resets; senior tech for admin rights and MFA.
• C: HR, before each start date. I: department heads, when access changes.
• Backup: IT lead.
• Can wait: quarterly access review, if the A is out that week.
• Outside help: the MSP does after-hours password resets; we keep everything else.
• Admin access: senior tech and IT lead, in the vault.

How The IT Department Structure Changes As You Grow

Say you run IT for a 120-person company. The rows stay the same as the team grows; the names change.

Three people means an IT lead, a senior tech, and a junior tech. Five adds a systems admin and a support tech.

At one person, you're A and R on every row, so the backups matter most. Agree which urgent tasks each outside contact covers while you're out.

For security, the MSSP contact handles alerts. The MSP contact handles urgent patches, restores from backup, and the incident steps its contract names. Your manager approves anything beyond that, such as taking a system offline; routine work, like the monthly patch review, waits for you.

At three, the IT lead hands devices to the junior tech and keeps the queue and the rows that need a decision. At five, the A's spread across four people.

NIST holds organizational leadership "responsible and accountable for cybersecurity risk." So let leadership name the A for security, and have that person report to them.

In a school district's IT department, add the principal as Informed on device rows and run the summer refresh as a project; see our IT Support For Schools guide.

Which IT Structures Fit A Small Team?

Here are four IT structures worth considering for a small IT department. They differ in who does the work, not in the rows: each still needs one A and a backup per row.

Write the boundary down before you pick a partner. One r/sysadmin member supported a 50-employee financial firm alone for over a decade, then brought in an MSP as it grew. Their advice: hire one "willing to work in a comanaged environment," because many "want to come in and replace everything with their own stack."

Even a fully outsourced IT structure needs someone inside who holds the A's, reads the reports, and signs the renewals. NIST's small business guide presents its checklist as a discussion prompt with whoever you've chosen to help, such as an MSSP.

Which Role To Hire Next

As the IT department grows, hire for the row that fails the vacation test, not for a title. Two federal job definitions help match a row to a role.

• A support tech for the queue and devices. At three, that's the junior tech; at five, a second support tech joins. "Computer support specialists maintain computer networks and provide technical help to computer users."
• A systems admin for accounts, security, and documentation. Network and computer systems administrators "install, configure, and maintain organizations' computer networks and systems."
• The IT lead keeps vendors and the matrix itself. Those rows need decisions and budget more than hands. Projects can move to a senior tech as the team grows, as the office move does at five.

That's why the example adds a junior tech at three, then a systems admin and a support tech at five. An r/sysadmin member put the second-hire test plainly: "When you do more help desk work than you do management work." That points to a support tech.

When To Hand Part Of It To An MSP

An MSP doesn't replace the IT department; it covers named tasks the department can't. Hand tasks from a row to an MSP when the work doesn't fit your hours, the same test as for a second hire.

One r/sysadmin thread asked when a solo IT person should ask for help. The top answer: "Whenever you can't get everything you need to do done without working past the time you are paid to work."

Make security monitoring the first task you consider moving. NIST's small business guide says to engage a service provider to monitor computers and networks "if you don't have the resources to do it internally." A three-person team on r/sysadmin wrote: "after-hours monitoring is basically impossible."

Hand over tasks, not the A. CIS Control 15 asks you to evaluate providers who hold sensitive data or run critical IT platforms, and NIST asks that supplier security requirements be written into contracts.

In an r/sysadmin thread on bringing in an MSP, one reply kept "the relationship stuff in-house (user support, onboarding)" and said to "establish clear boundaries upfront about who owns what."

If you run an MSP, build the matrix with each client at onboarding. Your rows are the tasks the contract names; the client's IT department keeps the rest, with its own A for each row.

Our MSP vs MSSP guide splits security work between the MSP, the MSSP, and you. For planning help rather than hands, consider a vCIO.

How To Tell The Structure Works

Check your IT department against these each quarter.

• No ticket waits unassigned past your first-response target.
• The vacation test: any row's A takes a week off; urgent work gets done, and only work agreed in advance waits.
• Hours are logged per row. One r/sysadmin member's advice to a solo IT lead: "Showing you have increased labor over a period is another thing."

Run The Matrix In SherpaDesk

How this works in SherpaDesk

Named owners and a seat for your outside tech

You can run SherpaDesk as an internal helpdesk for your own staff or as client-facing ticketing for businesses you support. Routing rules assign tickets by issue type, user organization, or severity to one agent or a group.

An outside tech can use a contractor license, a limited technician license linked to one account. They work only their assigned tickets there and add billable time and expenses. Projects track budgets and estimated completion, and To Dos carry a due date and a reminder.

A helpdesk and PSA a small IT team can run alone. No contract. No implementation project. No dedicated admin.

Base Camp is $45 per agent per month ($40 billed annually). The first agent is free, forever, so a team of three pays $90 a month ($80 billed annually). The trial is 14 days free with no card.

See Ticket Management →

See SherpaDesk Pricing →

Frequently Asked Questions

When should a one-person IT department hire a second person?

Should a small company hire IT staff or use an MSP?

What's the difference between responsible and accountable?

Who should own cybersecurity in a small IT department?

How often should you review the responsibility matrix?