Last month we looked at the one-page AI usage policy. This month, a decision that owners tend to put off until something breaks: changing the company that runs your IT.
Switching managed IT providers is rarely hard because good providers are scarce. It is hard because many owners are not sure what they own, what the current contract says, or what to ask. Here are the questions, in the order they matter.
Start with what you own, not who you hire
Before you talk to any new provider, find out how much control you have today. Five things to check:
- 1. Administrator access. Can you log in as an administrator to your email platform (Microsoft 365 or Google Workspace), your firewall, your backup console and your Wi-Fi? Or does only your provider hold those logins?
- 2. Domain and DNS. Who is the registered owner of your domain name, and who controls its DNS records? It should be your company. Your email and website depend on it.
- 3. Licenses. Are your software licenses in your company’s name, or inside your provider’s account?
- 4. Documentation. Do you have a current list of devices, accounts and systems, and do you know where passwords are stored?
- 5. Your contract. What is the term, does it renew automatically, how much notice is required, and what does it say about handing over your information when it ends?
If the only people who can log in as administrator to the systems that run your business work for someone else, you are renting your IT, not controlling it. Asking for administrator accounts and documentation in your own name is an ordinary request, and a good provider will say yes.
Eight questions for any provider you are considering
Ask every candidate the same questions and ask for the answers in writing. How a provider answers tells you as much as what it says.
- 1. What exactly is included? The services, support hours, response and resolution targets, and a list of what is billed separately. “Unlimited support” means little without a defined scope.
- 2. How will you onboard us, and how long will it take? Ask who does what, in what order, and what happens before anything changes. A typical transition takes two to four weeks, so be wary of a one-day cutover.
- 3. What security baseline do you apply? Multi-factor authentication on email and administrator accounts, patching, endpoint protection, least-privilege administration and a password manager are reasonable to expect. Ask them to show how each is set up, not just to say yes.
- 4. How are backups handled, and when did you last test a restore? What is backed up, where it is stored, how often, and who is told when a backup fails. A backup that has never been restored is an assumption.
- 5. How do you access our systems? Named accounts with multi-factor authentication, not a shared login. Ask who on their team can reach your data and what happens to that access when one of their employees leaves.
- 6. Who owns the documentation, credentials and licenses? The answer should be you, in your name, and the agreement should say so.
- 7. If we handle regulated data, what will you sign? Healthcare practices should ask whether the provider will sign a Business Associate Agreement, how quickly it must notify you of a security incident, and where your data is stored. Law firms and financial firms should ask how the provider supports their confidentiality and records-retention duties.
- 8. How does this end? The term, renewal, notice period, and what help you receive on the way out. The best time to ask how a relationship ends is before it begins.
You can see the security practices we follow on our Trust page. Hold any provider to the same standard of putting it in writing.
A note for healthcare practices
Under HIPAA, a vendor that creates, receives, maintains or transmits electronic protected health information on a practice’s behalf is generally a business associate, and the practice is expected to have a written agreement with it. A managed IT provider with access to systems that hold patient data usually fits that description. The definition is in 45 CFR 160.103 and the Security Rule’s requirement for business associate contracts is in 45 CFR 164.308(b). Whether a specific arrangement qualifies is worth confirming for your practice. The agreement should be in place before the new provider is given access.
Plan the handover so nothing drops
A clean switch has an overlap period. This order keeps your email, backups and security tools running while the work happens:
- 1. Get administrator access in your own name first. Nothing else should change until you have it.
- 2. Let the new provider run discovery. They should inventory devices, accounts, licenses and backups before touching anything.
- 3. Move the tools first and the plumbing last. Monitoring and support tools go in early. Email routing and DNS changes go last, in a quiet window.
- 4. Keep the old provider reachable through cutover. Agree a date and a handover list in writing.
- 5. Remove the old provider’s access the day the transition ends. Disable their administrator accounts, remote-access tools and VPN profiles, remove any delegated partner access in Microsoft 365 or Google Workspace, and change every password they knew.
Warning signs during the process
- Reluctance to give you administrator credentials or documentation.
- “Proprietary” tools that stop working, or lock up your data, when you leave.
- No written scope or price, or prices that change by the month.
- No stated exit terms.
- A promise that you will be “fully compliant.” An IT provider can support a compliance program, but compliance also depends on your own policies, people and risk decisions. Be cautious of anyone who says otherwise.
Where to start this week
Do three things. Find your current contract and write down the renewal date and notice period. List every system you cannot log into as an administrator. Then send two providers the eight questions above and ask for written answers.
Evaluating alternatives is not the same as giving notice, so read the notice terms before you tell anyone anything. If you want a broader comparison first, our look at managed IT versus break-fix covers how the two models differ on cost.
Common questions
How long does it take to switch managed IT providers?
A typical transition takes two to four weeks. The time depends on the size of the office, how well the current setup is documented, and how quickly you can get administrator access in your own name.
Do I have to tell my current provider before I talk to a new one?
No. Evaluating alternatives is not the same as giving notice. Read your contract’s term, renewal and notice provisions first, and give notice only when you have decided and the contract requires it.
Should I have administrator access to my own systems?
In general, yes. Administrator accounts for your email, domain, firewall and backups should exist in your company’s name, and your documentation should be available to you. Check what your contract says about both.
Does a new IT provider need to sign a Business Associate Agreement?
If you are a healthcare practice and the provider can access systems that hold electronic protected health information, it is generally a business associate and a written agreement is expected. See the note above for the rules.
This article is general information about changing IT providers, not legal advice. Ask your own attorney about the terms of your contract.