How to Switch IT Providers Without Losing Access or Data

TL;DR: To switch IT providers without losing access or data, get the keys before you give notice. Read the contract, list every account and system, move admin and billing logins into the business's name, run the old and new provider side by side, then change every password the old provider knew. Keep any disagreement calm, written and tied to the contract.

How to switch IT providers is a question owners usually ask late, when they are already frustrated and want it over with. When you switch IT providers, the move itself is not hard. What makes it hard is finding out, halfway through, that the domain, the firewall login or the backup account was never in your name.

Most businesses that switch IT providers do it for ordinary reasons: a business grew, a provider got bought, the fit changed. Treat it like moving offices, not like a breakup.

How do you switch IT providers without losing access or data?

Keys first, moving second. The whole plan to switch IT providers:

1. Read the contract. Notice period, termination assistance, data return.
2. List everything. Every domain, account, license, backup, configuration and vendor login the business depends on.
3. Take ownership of admin and billing accounts. Before notice, while everyone is still on good terms.
4. Pick the new provider and plan an overlap. Both providers working for a few weeks, with a written handover list.
5. Cut over one system at a time. Low-risk systems first, email and the firewall last.
6. Change every credential the old provider knew, remove its remote tools, and close its accounts.

The federal guidance points the same way. NIST's Cybersecurity Framework 2.0 has a line for this exact moment: plans should "include provisions for activities that occur after the conclusion of a partnership or service agreement." (NIST CSWP 29, February 2024) NIST's own examples for it include verifying "that supplier access to organization resources is deactivated promptly when it is no longer needed" and that "assets containing the organization's data are returned or properly disposed of." (NIST CSF 2.0 Implementation Examples)

Two questions, then, whenever you switch IT providers: can you get in without them, and is your data out of their hands when it is over?

What does your current contract say about leaving?

Read it before you tell anyone you plan to switch IT providers. You need four answers:

• Notice period. How many days, delivered how, and whether the contract renews on its own if you miss the window.
• Termination assistance. Whether the provider has to help you move, for how long, and at what rate.
• Data return. What comes back, in what format, by when, and whether they confirm deletion afterward.
• Who owns what was bought. Licenses, hardware, and the domain, if the provider registered it for you.

If the notice window is 60 days and your renewal is in 75, you have 15 days to decide, not two months.

My wife Amelia, Kief Studio's co-founder and CEO, has already written the deep versions of this, so I will not repeat them here: the contract exit terms that decide what leaving costs (opens in a new tab) and what an MSP scope of work should actually say (opens in a new tab).

What should be on the inventory before you give notice?

A joint advisory from CISA, the NSA, the FBI and cyber agencies in the UK, Australia, Canada and New Zealand tells customers to "understand the access their MSP has to their network and the data it houses." (CISA AA22-131A, May 2022)

Before you switch IT providers, make a spreadsheet with one row per item and three columns for each. Whose name is on it? Whose email address recovers it? Whose card pays for it? Those are three different questions, and they often have three different answers.

The rows, in rough order of how much it hurts to lose them:

• Domains and DNS. Registrar, DNS host and renewal date for every domain, including the ones you forgot.
• Admin accounts. Email and office software, cloud accounts, the password manager, and any single sign-on system.
• Firewall and network gear. Admin logins and an exported copy of each configuration.
• Backups. Where they live, whose account the storage sits in, and when someone last restored a file to prove they work.
• Licenses and subscriptions. Which ones are billed to you, and which sit under the provider's own agreement. If a subscription ends with the provider, check what happens to your data when you cancel software (opens in a new tab) before the account closes.
• Documentation. Network diagram, device list, and the notes that explain why things are set up the way they are.
• Vendor accounts. Internet, phones, copiers, your industry software, the website host. The provider often holds these logins because it was the one calling support.
• Remote access tools. Every monitoring or remote control program the provider installed, by machine.

Count the rows where the answer to "whose name" is the provider's. That number is your real risk when you switch IT providers. Kief Studio wrote a plain guide to who owns the website and the login, and the same logic covers every row above.

Who should own your domain, and how do you check?

Your business should. Whoever controls the domain controls your email and website.

Start with ICANN's free lookup tool. ICANN made the Registration Data Access Protocol, which its Lookup service reads, "the definitive source" for generic domain registration data as of January 28, 2025. (ICANN, January 2025) It shows the registrar, expiry date and locks. The owner's name may be hidden, so ask the registrar whose name and email are on the registrant record.

That record matters because ICANN's transfer rules give their protections to the registrant on file, not to whoever paid the bill. Under ICANN's Transfer Policy, a registrar must give the Registered Name Holder the transfer code and remove the transfer lock "within five (5) calendar days" of the first request, unless the account lets you do it yourself. It also "must not refuse" to release the code solely because of a payment dispute between the registrant and the registrar. (ICANN Transfer Policy, updated February 2024)

Two practical notes:

• Fix the registrant early. Changing the registrant's name, organization or email triggers "a 60-day inter-registrar transfer lock," unless the registrar offered an opt-out and you took it first. ICANN's registrant FAQ says the same. (ICANN, FAQs for Registrants) If the provider is listed as registrant, get it corrected months before you plan to move the domain, not the week of.
• Use a role address. Put the registrant email on an address at your own domain that more than one person reads, never on the provider's.

Why take ownership of admin and billing accounts first?

Because of the recovery chain, the part people miss when they switch IT providers. Picture it: the registrar account recovers through an email address on your domain, the domain's DNS is hosted in the provider's account, and the email admin login belongs to one of the provider's technicians. Pull one link and the rest follow.

Break the chain before notice day:

1. Two admin logins in the business's name for email and office software, the registrar, the DNS host, the cloud account and the firewall. Two, so one lost phone does not lock you out.
2. Recovery email and phone on every one of those set to addresses and numbers the business controls.
3. Billing moved to a business card on anything the provider pays and rebills. The account that pays is often the account the vendor treats as the owner.
4. Sign in with each one yourself. Do not take "it is set up" on faith.
5. Store them in a password manager the business owns, with at least two people who can open it.

Most providers will help without a fuss, and asking while things are routine keeps it routine. The FTC's advice for small businesses is the right frame: limit vendor access "to a need-to-know basis, and only for the time the vendor needs to do the job." (FTC, Cybersecurity for Small Business) A provider you are leaving still needs access until cutover. It does not need to be the only one with access.

When should you change passwords after the handover?

When you switch IT providers, change them after each system moves, not before. Change them during the overlap and you lock out the people still doing the work.

NIST's current password guidance is clear on the rule. The 2025 revision of SP 800-63B says services "SHALL NOT require subscribers to change passwords periodically," but "SHALL force a change if there is evidence that the authenticator has been compromised." (NIST SP 800-63B-4)

A departing provider is not a compromise. But a password that people outside the business know is no longer a secret only you hold, so I treat the moment you switch IT providers the same way: every password, service account, API key and Wi-Fi key the old provider could see gets changed once that system moves.

The same NIST section says passwords used on their own should be "a minimum of 15 characters," and services should "allow the use of password managers and autofill." Turn on multi-factor sign-in everywhere. The FTC asks vendors for "additional steps beyond logging in with a password." (FTC, Vendor Security)

Then remove the old provider's accounts and tools on purpose:

• Disable their user accounts in every system on the inventory. The CISA advisory warns that "disabling MSP accounts can be overlooked when a contract terminates."
• Remove their remote access tools from every computer and server, checked against the list by machine. CISA's remote access guide says to "audit remote access software and their configurations on devices on your network," and notes these tools can run as portable programs that do not need to be installed, so an installed programs list can miss them. (CISA and partners, June 2023)
• Take their addresses off every recovery path, billing contact and alert list.

Verizon's 2026 Data Breach Investigations Report found third-party involvement in 48% of the breaches it studied, up 60% from the year before. (Verizon, 2026 DBIR Executive Summary) The day you switch IT providers is the best chance you will get to clean up vendor access.

How long should the old and new provider overlap?

Long enough to move everything once and check it. When a small office needs to switch IT providers, I plan around six weeks after notice:

1. Week 1. The new provider gets its own named accounts, created with your admin logins, not borrowed from the old provider.
2. Week 2. Handover meeting with both providers if the old one will do it. The best question is not "how does it work" but "what is unusual here." Every network has a few quirks that never made it into the notes.
3. Weeks 3 and 4. Move the low-risk systems first: monitoring, the antivirus console, printers, line-of-business software support. Change credentials as each one moves.
4. Week 5. The high-risk items: email, DNS, the firewall, backups. Restore one real file from the new backups before you call it done.
5. Week 6. Remove the old provider's accounts and tools, take their addresses off everything, ask for the final data return and written confirmation of deletion.

That timeline is our working plan, not a standard. A three-person office with one cloud account might need two weeks; a server closet and a phone system need longer. However long it takes to switch IT providers, the order is what matters: ownership before migration, and revocation as a checklist, not a memory.

Amelia covers the buyer's side of the sequence in how to offboard a managed service provider (opens in a new tab). From the technical side, add one thing when you switch IT providers: decide your restore targets before cutover, so the new backups are judged against a number. Our guide to RTO and RPO explains the two you need.

What if the old IT provider will not cooperate?

Usually it is slowness, not malice. A provider losing a client has no paid hours set aside for helping you leave. Treat it calmly and on paper while you switch IT providers:

1. Ask in writing, specifically. "Please send the firewall configuration export and the admin credentials for the registrar account by Friday." A list with dates gets done.
2. Quote the contract. Point to the termination assistance and data return clauses by section number, and offer to pay the stated rate for transition hours if there is one.
3. Use the rules that already protect you. If the business is the registrant on file, ICANN policy requires the registrar to give you the transfer code on request. If a registrar wrongly denies a transfer, ICANN's FAQ says you "may file a complaint with ICANN."
4. Keep a log. Dates, what you asked, what came back. Stay factual, and never threaten.
5. Bring in an attorney if access or data is being withheld. Whether a provider can hold your systems over a bill is a legal question. The Massachusetts Bar Association's Lawyer Referral Service can match you with a lawyer and says "there is no cost to utilize the LRS" (the lawyer may charge for the first consultation). (Massachusetts Bar Association Lawyer Referral Service)

None of this is legal advice. It is how to keep the conversation short and the record clean until a lawyer, if you need one, takes it from there.

What to keep in mind when you switch IT providers in Central Massachusetts

A small business rarely has an in-house IT person to hold the keys, which is exactly how the provider ends up holding all of them.

If you keep personal information about Massachusetts residents, the state's data security regulation also has a say. 201 CMR 17.03 requires "taking reasonable steps to select and retain third-party service providers" that can protect that information, and "preventing terminated employees from accessing records containing personal information." (201 CMR 17.03, via Cornell LII) The rule names terminated employees, not providers. In my view the same habit belongs on a provider's last day. My employee offboarding checklist for IT access (opens in a new tab) works as a template for that day.

This article is general information, not legal advice. Kief Studio is not a law firm, and reading it does not create an attorney-client relationship. Laws and regulations change, so check the current text and talk with a licensed Massachusetts attorney about your situation.