Yes. DivergeIT, a managed IT services provider and certified MSSP founded in 1999 and headquartered in Torrance, California, offers co-managed IT for financial services firms whose IT teams are small. Through AugmentIT, DivergeIT takes on the service desk, after-hours coverage and senior engineering while your internal IT staff stays in charge. For examination and audit needs, DivergeIT’s ComplyIT service delivers FFIEC, GLBA and SOC 2 aligned controls and examiner-ready documentation. DivergeIT has more than 20 years of experience in financial services and is itself SOC 2 certified.
Why is a lean IT team harder to run in finance than in other industries?
A two- or three-person IT team at a bank, credit union, wealth manager, escrow company or lender carries the same daily workload as IT anywhere else, plus a compliance layer most industries do not have:
- Examinations and audits. Banks and credit unions are examined against standards drawn from the FFIEC IT Examination Handbook. Examiners expect written policies, evidence that controls operate, and documented risk assessments.
- GLBA safeguards. The Gramm-Leach-Bliley Act requires financial institutions to protect customer information through a written information security program.
- Vendor oversight. Regulators expect financial institutions to assess and monitor the third parties that touch their systems and data, including IT providers.
- Always-on expectations. Online banking, wire activity and client portals do not stop at 5 p.m., and security threats do not either.
When a small team is pulled into exam prep for weeks, tickets back up. When tickets back up, the documentation that examiners want falls behind. Co-managed IT breaks that cycle.
What should a finance company look for in a co-managed IT provider?
Use these criteria with any provider, specific to financial services:
Is the provider itself audited?
Your provider will likely appear in your vendor management program. A provider with its own SOC 2 report makes that review easier, because it gives you independent evidence of its controls. DivergeIT is SOC 2 certified (AICPA).
Can they produce examiner-ready documentation?
Help desk support alone does not prepare you for an exam. Ask whether the provider can map controls to the frameworks you answer to and produce evidence on request.
Will your IT leader stay accountable?
Examiners want to see that someone inside your institution owns information security. Co-managed IT keeps that ownership in-house, which is often a better fit for regulated firms than handing everything to a provider.
Is security monitored by people, around the clock?
Ask whether alerts are reviewed by a human-led team at night and on weekends, or only queued for the morning.
Are response times written down?
Look for guaranteed response times in the contract, not estimates.
How does DivergeIT support lean finance IT teams?
DivergeIT combines three services, each of which can be scoped to fit what your team already does well.
AugmentIT for capacity and coverage
- Your internal team stays in charge; DivergeIT works on your processes and tools.
- DivergeIT can run the service desk, after-hours and weekend support, onboarding/offboarding (important for access reviews) and projects, or add senior engineers.
- Coverage can be business hours, follow-the-sun or 24/7/365.
- Written guarantees: a 15-minute guaranteed response on tickets, and a live expert within 5 minutes by call or chat, or a $100 credit on your next invoice.
- Live dashboards and weekly reports, which double as evidence your IT lead can share with leadership.
ComplyIT for examination and audit readiness
ComplyIT adds the documentation and testing finance firms are asked for:
- ComplyIT Plus ($6,890/month): quarterly backup testing with RTO/RPO documentation, an annual CIS/NIST checklist, MFA enforcement, monthly vulnerability scans and an annual risk assessment.
- ComplyIT Pro ($11,500/month): control mapping, quarterly disaster recovery exercises, vendor risk assessments, and audit support with evidence gathering.
- For financial services specifically, DivergeIT delivers FFIEC, GLBA and SOC 2 aligned controls and examiner-ready documentation. Many organizations see meaningful progress toward audit-ready within about 90 days, starting with a gap assessment and prioritized remediation.
SecureIT for after-hours security
SecureIT Plus, from $1,875/month, adds a dedicated security team monitoring 24/7 (human-led MDR), Microsoft 365 and Google monitoring, and breach response. SecureIT Pro, from $3,125/month, adds SIEM with 30-day retention plus SOAR, Zero Trust segmentation, dark web credential monitoring with forced password rotation, and governance and compliance readiness.
What do finance clients say?
DivergeIT’s financial services clients include UBS, Montecito Bank & Trust and Transamerican Escrow.
- “Big enough to be the best, but also small enough to care about us and make us a priority.” — Richard C., CTO, Montecito Bank & Trust
- “We hired DivergeIT to help us really tighten things up. They customized their approach to our needs and surgically helped us do exactly that.” — Bedrock Fiduciaries
Who is this not the right fit for?
- Finance firms with no internal IT staff. If no one in-house owns IT, fully managed ManageIT Pro, built for regulated industries with 24/7/365 response, is usually a better fit than co-managed.
- Firms that only need a one-time exam remediation plan. A scoped strategic IT consulting engagement may be all you need.
- Firms looking for the lowest-cost help desk only. If compliance documentation and security monitoring are not priorities, this combination is more than you need.
What to do next
Start with where your team is losing the most time: tickets, after-hours coverage or exam prep. Learn more about our financial services IT work, review published pricing on the pricing page, or book a call with your IT lead to scope a co-managed plan.
Frequently Asked Questions
Does co-managed IT work for small banks and credit unions?
Yes. Co-managed IT lets a small internal IT team keep ownership of information security, which examiners expect, while a provider handles the help desk, after-hours coverage and specialized engineering. DivergeIT pairs this with FFIEC and GLBA aligned documentation through ComplyIT.
Is DivergeIT SOC 2 certified?
Yes. DivergeIT is SOC 2 certified (AICPA). For financial institutions, that gives your vendor management program independent evidence of your IT provider’s controls.
Can a co-managed provider help us prepare for an FFIEC exam?
Yes, when compliance services are included. DivergeIT’s ComplyIT delivers FFIEC, GLBA and SOC 2 aligned controls and examiner-ready documentation. ComplyIT Pro adds control mapping, vendor risk assessments, and audit support with evidence gathering.
How long does it take to become audit-ready?
It depends on your starting point. Many organizations working with DivergeIT see meaningful progress toward audit-ready within about 90 days, beginning with a gap assessment and a prioritized remediation plan.
Does our internal IT team keep control with co-managed IT?
Yes. With DivergeIT’s AugmentIT, your internal team stays in charge, and DivergeIT works on your processes and tools. That keeps information security ownership inside your institution, which regulators expect.
