A Real 30/60/90-Day Plan for Switching IT Providers

The first month isn't about new projects. It's about building an accurate map of your environment, because most businesses switching providers don't have one. The outgoing vendor either won't hand over documentation cleanly or the documentation never existed.

Week 1: Access and inventory

Get full administrative access to every system: domain controller, firewall, M365 tenant, backup console, DNS registrar, and any line-of-business software with admin rights. Change every shared password. This sounds obvious, but it's the step most businesses skip because it feels rude to the outgoing provider. It isn't rude. It's basic security hygiene, and credential abuse shows up in 39% of breaches according to Verizon's 2026 DBIR, so stale or shared credentials aren't a theoretical risk.

Weeks 2-4: Asset and risk discovery

A competent new provider runs a full discovery pass: every endpoint, every server, every piece of software with a license attached, every network segment. You want a written report, not a verbal summary. This is also when you find the stuff nobody mentioned in the sales conversation, like the unpatched server running a line-of-business app from 2014, or the open RDP port facing the internet. Expect a prioritized list of findings ranked by actual risk, not a generic checklist.

This phase should also include a first pass on cybersecurity basics: multi-factor authentication coverage, backup verification, and a review of who has administrative access and why. If you're a healthcare practice or handle financial data, this is also the point to map current controls against HIPAA or FTC Safeguards Rule requirements, because "we think we're compliant" and "we can prove we're compliant" are very different positions to be in during an audit.

By day 30 you should have a prioritized list. Days 31 through 60 are for working through it, starting with anything that represents real exposure.

• Patch and remediate known vulnerabilities, especially anything on CISA's known exploited vulnerabilities list. Verizon's 2026 DBIR found the median time to fully remediate a KEV-listed vulnerability is now 43 days from detection, up from 32 the prior year, which tells you most organizations are moving too slowly on the stuff attackers actively target.
• Clean up administrative access. Remove former employees, contractors, and vendors who still have logins. Implement least-privilege access so day-to-day users aren't running with domain admin rights they never needed. This is where a privileged access management approach pays off, because it stops a compromised regular account from turning into full network control.
• Verify backups actually restore. Not "the job shows green." Actually test a restore of a file, a folder, and ideally a full server image. A backup nobody's tested is a backup nobody can trust.
• Document network topology, firewall rules, and VPN configurations if that documentation didn't exist before. You want this on paper so the next transition, whenever it happens, doesn't start from zero again.

If you're in the 20-to-99-employee range, this window matters for another reason. Texas SB 2610 gives you protection from exemplary damages in a breach lawsuit if you've implemented the CIS Controls IG1 safeguard set, but that protection only holds if the controls are actually in place, not aspirational. Getting these baseline safeguards locked down in the first sixty days isn't just good practice, it's a legal hedge worth having on record, per Texas SB 2610.

This is also a natural point to review your broader managed IT services setup: monitoring coverage, ticket response times, and whether your new provider's tools actually match what your business runs day to day, especially if you're heavy into Microsoft 365 or leaning on cloud infrastructure for anything mission-critical.

The last third of the transition is where things stop being reactive. You've fixed the fires, secured access, and validated backups. Now it's time to build forward.

Network and infrastructure review

Look at whether your network architecture actually supports the business you have now, not the one you had five years ago. Bandwidth needs change, remote work changes traffic patterns, and a lot of Texas businesses are still running network gear sized for an office that doesn't operate the same way anymore.

Standardize monitoring and reporting

By day 90 you should have continuous automated monitoring in place, meaning something is watching your network and endpoints around the clock even when nobody's in the office, paired with business-hours support and after-hours emergency response for anything that actually needs a human. You should also be getting regular, plain-language reports on patching status, backup health, and security posture, not a pile of jargon nobody on your team can act on.

Set a quarterly cadence

Good IT partnerships run on a rhythm: quarterly business reviews, a documented roadmap for hardware refreshes, and a running list of projects tied to actual business goals, not just "keep the lights on." If your new provider isn't proposing this by day 90, ask why.

The most common failure isn't technical, it's timing. Businesses try to switch providers during a busy season, or they let the outgoing vendor drag out access transfers for weeks because there's no signed offboarding agreement. Get exit terms in writing before you sign with anyone new, including a hard date for full access handoff and documentation transfer.

The second most common failure is treating the new provider like a vending machine instead of a partner. A transition works best when your team is involved, particularly around passwords, MFA enrollment, and any workflow changes. Nobody enjoys re-enrolling in an authenticator app, but a rushed rollout without communication creates more support tickets than the switch itself.

How long should switching IT providers actually take from decision to full cutover?

Ninety days is realistic for a mid-sized business with a handful of locations. Smaller, simpler environments can compress this to 45-60 days. Anything rushed under two weeks usually means shortcuts on documentation and access review, which shows up as problems three months later.

Should we keep our old provider on retainer during the transition?

Only if you can get it in writing with a defined scope and end date. Open-ended overlap tends to create confusion about who's responsible for what, and it can slow down the new provider's discovery work.

What's the single biggest mistake businesses make during a provider switch?

Not changing shared credentials immediately. Old vendors, former employees, and forgotten service accounts are a real exposure, and credential misuse remains one of the most common threads in actual breaches.

Do we need a full security audit before switching, or can that happen during onboarding?

It can and should happen during onboarding, ideally in the first 30 days. Waiting for a separate audit engagement just delays fixing the things that actually put you at risk.

If your current setup feels like a black box, or you've inherited someone else's mess and don't know where to start, get a straightforward look at where you stand with a free IT assessment or reach out through our contact page to talk through what a real transition would look like for your business.