Switching IT Providers: A Business Handover Checklist

A structured handover protects your accounts, data and continuity when you change IT providers.

Changing IT providers is a business decision, not just a technology swap. The real risk isn’t the new provider, it’s the gaps that appear when passwords, licenses, domains and backups aren’t clearly accounted for during the move. Businesses that treat the handover as an afterthought often discover, weeks later, that an account they assumed they owned is actually controlled by someone else. This checklist walks through what to confirm, document and verify before, during and after a transition, so your business keeps control of its own systems at every step, whichever provider you choose next.

Assign a Decision-Maker and Define Scope

Put one person in charge of the transition, typically an owner, operations director, or IT manager. This person approves what gets transferred, confirms who has the authority to request changes, and signs off before access moves between providers. Define the scope up front: which locations, departments, systems and vendors are included, so nothing gets handled informally or skipped. A clear scope document also sets expectations with your outgoing provider about what they’re expected to hand over, and by when. Your managed IT support partner, whether working onsite in Greater Houston from a Stafford base or supporting your business remotely, should be able to work from that scope document from day one rather than reconstructing it from scratch.

Inventory Users, Devices and Applications

Before anything changes hands, build a current list of every user, device and business application in use. Include laptops, servers, mobile devices and the software each department depends on day to day. Note which applications are critical to daily operations versus which are rarely used, since that distinction affects how urgently each one needs to be verified. This inventory becomes the reference point for everything that follows: it tells you what needs new access, what needs independent verification, and what can be retired along the way.

Confirm Ownership and Control of Core Accounts

Not every account works the same way, and treating them all as identical ownership is where businesses run into trouble. Separate your accounts into four categories before the handover date:

• Customer-owned accounts: Microsoft 365 or Google Workspace tenants, domain registrations and similar accounts should be registered to the business, with the business holding the primary administrative credentials.
• Delegated administration: a provider may hold administrative access to manage these accounts on your behalf, but the underlying account still belongs to the business.
• Provider-managed licensing: some tools are licensed and billed through a provider’s own agreements. These need a documented transfer or an agreed replacement, not a simple password handoff.
• Network accounts and configurations: confirm who holds administrative access to your business network services, and verify that access is traceable to named individuals rather than shared logins.

Go through your inventory line by line and mark each account against these categories. Anything unclear needs a direct answer from your current provider while that relationship is still active.

Handover Checklist at a Glance

Use this quick-reference view alongside the detailed steps above when planning your own transition.

1. Confirm Microsoft 365 or Google Workspace ownership
   Responsible person: Business decision-maker
   Verification: Business holds the primary admin credentials
2. Inventory users, devices and applications
   Responsible person: Operations or IT manager
   Verification: Inventory list reviewed and signed off
3. Verify domain and network account control
   Responsible person: IT decision-maker
   Verification: Named individuals confirmed as account holders
4. Transfer access through an approved secure method
   Responsible person: Both providers’ admins
   Verification: Access confirmed through approved platform, not email or spreadsheet
5. Test backup and restore
   Responsible person: Backup administrator
   Verification: Test restore completed and documented
6. Confirm cutover contacts and rollback owner
   Responsible person: Decision-maker
   Verification: Named contacts and rollback plan agreed in writing
7. Review and remove outgoing access
   Responsible person: Decision-maker
   Verification: Removal follows the approved timing and agreed business risk, with immediate containment if a security incident requires it

Transfer Access Securely

Access should move through an approved password manager, identity platform, or your new provider’s secure onboarding process, never through a spreadsheet, checklist document or email. Listing credentials in a shared file creates a security exposure that outlasts the transition itself. Agree on the transfer method with both providers in advance, and confirm that multi-factor authentication is re-verified under the new administration before any old credentials are retired.

Verify Backup and Restore Readiness

Confirm where backups are stored, how often they run, and how long data is retained. Before cutover, arrange an approved test restore so you have evidence that recovery works, not just an assumption that it does. A managed backup and recovery review at this stage catches gaps while there’s still time to fix them.

Plan the Cutover

There’s no single correct timeline for switching providers. How long the transition takes, whether any overlap period is needed, and when access changes hands should be agreed around your specific environment, your contract terms with the outgoing provider, and the level of business risk involved. Before cutover day, agree in writing on:

• Named contacts at both providers for the day of the switch
• Who owns rollback if something doesn’t work as expected
• The acceptance checks that confirm the new provider’s access and tools are functioning correctly

Review and Remove Outgoing Access

Once acceptance checks are complete, review the outgoing provider’s access against your inventory and remove it at the time agreed with your decision-maker. That timing should reflect what the business has confirmed is working and acceptable, not an automatic rule that every system must first be proven fully operational. If a real security concern arises at any point, unauthorized access or suspicious activity, contain it immediately rather than waiting for the scheduled review.

Use the readiness checklist to work through these steps in order for your own business.

Frequently Asked Questions

How long does switching IT providers usually take?

There’s no fixed timeline. It depends on your environment’s complexity, your contract terms with the outgoing provider, and how much business risk is involved. Your decision-maker should agree on a timeline with both providers before cutover rather than relying on a generic estimate.

Should we remove the outgoing provider’s access right away?

Access should be reviewed and removed at a time your decision-maker agrees is appropriate, once acceptance checks confirm the new setup is working. The exception is a genuine security concern, unauthorized access or suspicious activity should be contained immediately rather than waiting for the scheduled review.

Do we need to own every software subscription directly?

Not necessarily. Some accounts should be customer-owned, like your Microsoft 365 or Google Workspace tenant, while others may involve delegated administration or provider-managed licensing. What matters is that each account is clearly documented so ownership and access are never in question.

Discuss Your IT Transition

Planning a switch and want a second set of eyes on your handover checklist? Discuss your IT transition with our team, or call us at (713) 325-0836. Eligible managed clients receive a guaranteed 15-minute remote support response within their agreed support scope.