Switching managed IT providers involves more than handing over support tickets. Behind the scenes, logins, permissions and responsibility for security are changing hands. A preparation checklist helps your business maintain protection and keep essential services running during that handoff.
Clarify what is actually changing
A support change and a workload move are not the same job. A support change means a new team manages your existing Microsoft 365 and firewalls where they already live. A workload move means data and systems shift to new hosting or new tools. Write down which one you are doing, because that scope drives every security task that follows.
Your old provider and your new provider should each have defined tasks. Name one in-house contact who can approve changes. Don’t leave either team guessing while admin rights are changing hands.
Put escalation in writing. Everyone should know who to call if logins fail or a server won’t come back. Keep that sheet somewhere staff can find it during the handoff.
Take inventory and confirm ownership
Start by getting a clear picture of what needs securing. Ask for a full inventory of accounts and devices. Add cloud subscriptions and firewall rules to the same list. Include integrations that run in the background, since those API connections and sync jobs are easy to miss. Check older backup agents too: they may still have access to systems even if nobody uses their dashboards.
Confirm who owns each asset and subscription. Keep domain registration under your business’s control and clarify any provider-owned hardware or bundled licenses. Ask for current documentation and arrange a secure transfer of network diagrams and relevant credentials to the incoming team. Avoid sending password vault exports through ordinary email.
Vet the new provider’s security controls
When you vet a new provider, ask how it handles monitoring and patching, along with backup checks and escalation, so you understand the coverage before you need it. Find out what tools watch endpoints and who responds when an alert fires. If managed detection and response is part of the plan, get it in writing before cutover. Those answers matter when support changes hands.
For example, Consilien is a security-first managed IT services provider based in Torrance, CA with a background in fully managed IT, co-managed IT, managed security, and backup and disaster recovery. Use that level of detail as your baseline for comparison. Ask any provider how it handles endpoint detection and response, as well as identity and access management. Ask where data is hosted and which subcontractors can access it.
A SOC 2 Type II report can help here. It won’t answer every question, but it does show that an outside auditor reviewed controls over time.
Review existing access policies rather than assuming they are suitable for the new arrangement. Check administrator permissions and device security requirements without unnecessarily disrupting ordinary employee access.
Agree on who responds if something fails mid-cutover. Both sides should know when the new team takes the lead. Make sure backups and failover steps have been checked before you switch.
Sequence credentials and cutover duties
Start with a credential inventory. Focus on admin logins and service accounts that touch backups or financial systems. Note which shared passwords the old provider used, since those are the ones to rotate first.
Change them in a planned order and test each system as you go. Don’t reset every employee at once, since most staff can keep their current logins and MFA methods. That avoids help-desk chaos and keeps attention on high-risk accounts. We recommend testing service accounts right after rotation so a missed dependency doesn’t break a nightly job.
At the agreed handoff point, revoke the old provider’s accounts and remove its remote access tools once the incoming team’s access is tested. If temporary overlap is necessary, approve specific permissions and an expiry time. Keep both providers available for the handoff, with clear ownership until you sign off.
Close out access, backups, and proof
If files must move, use encrypted transfer for transit and confirm encryption at rest on the new side. Do a test restore before you call the job done. Select representative data from critical systems, such as shared files and cloud email, and restore it to an isolated test location. Confirm that it is usable and record how long recovery takes. Avoid overwriting live data during the test.
Save what you’ll need later. Export firewall configurations and relevant security reports before old access ends. Agree on which audit logs and ticket records to retain, then store them securely with appropriate access restrictions and retention periods. This keeps useful records available without depending on a former provider to retrieve them.
Agree on data retention and deletion in writing. Establish which copies the old provider holds, what contractual or legal retention obligations apply, and when remaining copies will be deleted. Request written confirmation when deletion is complete and keep it with your handoff records. Watch for leftovers in the weeks after cutover, like dormant admin accounts and unexpected remote sessions.
Map the work to the rules you already follow. If you handle card data or health information, keep evidence that controls stayed on during the move. Ask about hosting locations and subcontractors, since those details often matter for audits.
Keep a simple closure checklist. Record which accounts were revoked and whether deletion has been confirmed. Save returned documentation in one place. Share it with leadership so everyone knows the switch is finished.
Keep monitoring tight after cutover. Review new alerts with the new provider and compare them to old baselines. There’s no need to overreact to every notice, but don’t ignore a new admin login you can’t explain.
A careful handoff takes work. It also leaves you with cleaner access and better records. Keep those records available after the switch.
