Switching IT Providers: What the First 30 Days Should Look Like

How hard is it to switch IT companies?

Not very, if you plan the handoff. The work that matters is getting your credentials, documentation, and accounts out of the old provider’s hands and into yours. The new provider can do almost everything else. What stops most firms from switching isn’t the new shop. It’s the fear that something breaks on the way out, and that fear is fair.

I have seen what a bad exit looks like. One client’s internal IT director resigned on a Friday and changed every domain admin password on his way out. 85 users, payroll due Wednesday. We got them back because our RMM agent was already on every machine. Another new client came to us after their IT person quit with no documentation, two days before an office move, with 23 Wi-Fi networks nobody had the passwords for.

Neither of those had to be an emergency. Both were handoff problems.

What should you get from the old provider?

Get every login that lets someone run your business, in writing, before you give notice. This list is general practice. Ask for it whoever you hire next, us or anyone else.

• Admin credentials. Domain admin, local admin, firewall, Wi-Fi, switches, servers, NAS, backup console, and any line-of-business app admin accounts.
• Microsoft 365 or Google Workspace. Global admin access in your name, not just theirs.
• Domain registrar and DNS. Who the registrar is, the login, and where DNS is hosted. If your website and email depend on a domain only the old shop can log into, that is the first thing to fix.
• Licensing. What you own, what they resell to you, and when each renews. Find out which licenses stay with you and which leave with them.
• Documentation. Network diagram, IP ranges, firewall rules, backup schedule, vendor contacts, and anything they wrote down about how the place is wired.
• Remote access. Every remote access tool they installed, so it can be removed. Their agent should not still be on your machines a month from now.

If the old provider is slow to hand this over, don’t let that hold you hostage. A new provider can recover a lot from the machines themselves. It’s slower and it costs you time you didn’t need to spend.

What happens in week one?

Discovery. The new provider should look at what you actually have before they touch anything. When we onboard a client, we start from the outside: a standard external pass of public IPs, open ports, certificates, mail authentication, and anything listening that shouldn’t be. That scan is day-one work on every onboarding.

Then the machines come under management. Every managed endpoint in our managed IT and security service runs the same security baseline: EDR, anti-malware, email filtering, and password management, with 24/7 monitoring and patching across Windows and third-party apps. Nothing in that baseline is optional or upsold separately.

From that point the help desk is yours to use. Critical issues get a response in under 15 minutes, standard requests in 1-2 hours. User onboarding, offboarding, and password resets are part of the service.

I won’t promise you a day-by-day calendar here. Every office is different, and the order depends on what discovery turns up. A wide-open firewall gets fixed before anybody’s printer.

What do we usually find?

Leftovers. Remote access someone set up “just for this project” years ago. A firewall rule nobody remembers approving. Passwords living in places they shouldn’t.

Two real examples from our reports:

Open RDP on day one. During discovery for a new East Tennessee client, our external scan found Windows Remote Desktop (TCP 3389) open to the whole internet. It was a leftover remote-access path from before we managed the environment. No sign of a breach. We removed the firewall rule the same day and put admin access behind a VPN or jump host. The full report has the timeline. Nobody had done anything malicious. It was just habit that outlived the person who set it up.

Passwords in spreadsheets. A financial services client in a SOC 2 audit had a password manager deployed and still couldn’t prove nobody kept a backup list on their desktop. We scanned 67 endpoints by filename. 23 files matched, and 8 held real working credentials, including banking logins and a forgotten shared service account sheet. That one was an audit, not an onboarding, but the password file audit is the same lesson. A tool being deployed doesn’t mean the habit is gone.

That’s the kind of thing a new provider should be telling you about. If you switch and nobody hands you a list of what they found, ask for one.

What does it cost to switch?

It depends on how many people you have, what’s in the building, and what discovery turns up, so we scope it on a call. No public rate sheet. What I can tell you: our managed IT is month-to-month, there are no multi-year contracts, and the minimum is 3 users. Add-ons and projects are scoped on a call too. No surprise line items.

Month-to-month matters more than it sounds like when you’re switching. If the handoff out of your current provider is painful because of a long contract, you don’t want to sign another one. You should be able to leave us the same way you came in.

What this looks like when we do it

You bring the list above, or as much of it as you can get. We run discovery, starting with the outside of your network, and tell you plainly what we found. Every managed machine gets the same baseline, and you get a help desk with a published response time. If something is left wide open, it gets closed first.

We work best with regulated firms of 5-100 users in Knoxville and East Tennessee, the ones who will eventually have to show an auditor or an insurer what’s in place. If that’s you, the full scope is on the managed IT and security page.

Thinking about switching? Book a 15-minute call and bring your current setup. I’ll tell you what the handoff should look like for your office.

Key takeaways