How to Switch IT Provider Without Losing Control
Introduction
The handover risk most organisations underestimate
Changing IT provider should mean better support, stronger security and more peace of mind. Yet most organisations put their effort into choosing the new provider and very little into the handover itself.
That's where things go wrong. Know-how gets lost, nobody is quite sure who is responsible for what, and gaps appear just when you need everything to keep running. So the real question isn't only "Is the new provider any good?" It's "Can we switch without losing control of our systems?"
Why This Matters
Why this matters for regulated organisations
In a regulated organisation, a messy handover isn't just inconvenient. Passwords, admin access, backups and know-how can fall through the gaps, and those gaps become your problem, not your provider's.
A rushed handover can leave you with:
Nobody clearly owning your devices, accounts and software
Former staff or your old provider still able to log in
Missing passwords, records and documentation
Confusion over who to call when something breaks
Gaps in security monitoring and backups
Awkward questions from your auditor, insurer or regulator
Regulators expect you to stay in control of anything you outsource. For example, FCA-regulated firms remain responsible for outsourced functions, and under UK GDPR you remain accountable for personal data your IT provider handles. Changing provider should never mean starting again.
Where it goes wrong
Where organisations commonly go wrong
Most problems happen because the switch is treated as a technical job, when it's really about making sure nothing important gets lost along the way. Common mistakes include:
Moving systems before capturing know-how
Systems can be moved in a weekend. Know-how can't. Who to call when the phone system fails, which supplier looks after the alarm, the workaround for the finance software: this usually lives in someone's head, not in a document.
Assuming everyone knows who does what
During the switch, it's easy to assume the old and new providers have agreed who handles what. Often they haven't. If something breaks, or you're hit by a cyber attack that week, the confusion costs time and money.
Forgetting your people
The switch isn't finished when the new provider has the passwords. Your staff need to know what's changing, when it's changing, and how to get help. Otherwise, support gets worse just when you expected it to improve.
Not planning the exit from your old provider
This is where organisations most often get caught out. Your current provider may hold the master login to Microsoft 365, control your domain name, or be the only one with your firewall passwords. Before you give notice, check your contract's notice period and exit terms, and agree in writing what they'll hand over and by when.
Business Risk
Why this is a business risk, not just an IT one
If the handover isn't managed properly, you can believe everything is working while hidden gaps remain: an old account still active, backups that quietly stopped, security alerts nobody is watching. For a regulated organisation, those gaps are your responsibility, regardless of who caused them.
What Good Looks Like
What a good switch looks like
A well-run handover has five ingredients:
One person in charge
Name someone in your organisation, such as a director, practice manager or IT lead, to own the switch, make decisions and sign it off. Your new provider should name their counterpart too.
A written plan
The new provider should follow a documented process: list your devices and accounts, check who has access, record how everything is set up, switch on monitoring and confirm your security settings. Ask to see it before you sign.
Know-how captured and tested
Don't just hand over documents. Check the new provider can actually use them. A simple test: ask them to walk you through how they'd restore a deleted file or unlock a staff account.
Keep your people in the loop
Tell staff what's changing, when, and how to get help from day one. A one-page "how to get support" sheet goes a long way.
A proper sign-off
Before you call it done, confirm that everyone knows who does what, documentation is complete, security and backups are working, and any remaining risks are written down and agreed.
Scaling Up
In larger organisations, the same five ingredients apply, just more formally: a transition steering group, a RACI matrix (who is Responsible, Accountable, Consulted and Informed) agreed by both providers, exit obligations written into the contract, and service acceptance criteria tied into your change and risk management processes. The principle doesn't change: no gaps, no assumptions, and you stay in control.
Before you switch IT provider: 10 questions to answer
1. Who holds the main admin login for Microsoft 365 (or Google Workspace)?
2. Who controls your domain name and website DNS, and when do they renew?
3. Do you have every password for your firewall, Wi-Fi and key systems?
4. Are your backups working, and has anyone tested a restore recently?
5. What notice period and exit fees are in your current contract?
6. Will your current provider hand over documentation, and by when?
7. Which ex-staff or old supplier accounts still have access?
8. Who will your team call on day one, and do they know?
9. Who in your business signs off that the switch is complete?
10. Does the change affect anything you report to your regulator or insurer?
How cyberISMS handles the switch
At cyberISMS, we treat onboarding as a controlled process, not just a technical handover. Before anything moves, we agree a written plan with you, name who is responsible at each step on both sides, and work with your outgoing provider to get access, passwords and documentation handed over properly.
During the switch, we list your devices and accounts, remove access that shouldn't be there, record how everything is set up and switch on monitoring and backups. Your staff get clear instructions on how to get help from day one.
We don't call it done until it's been checked. That means confirming who does what, that backups restore, that security alerts reach someone, and that any remaining risks are written down and agreed with you.
This is how we work under ISO/IEC 20000-1, the international standard for IT service management, which we're certified to by BSI. It expects changes to a service to be planned, documented and clearly owned, which is exactly what a good handover needs.
The aim is simple: you stay in control, with a stable footing from day one and a clear record of how you got there.
Conclusion
Choosing a new IT provider is a big decision, but the real test is the handover. Done badly, it brings uncertainty just when you expected things to improve, and in a regulated organisation the consequences land with you.
Whether you're a small practice or a larger organisation with several sites, the same principles apply. Insist on one person in charge, a written plan, staff kept informed and proof that everything works before anyone signs off.
A good handover isn't about giving away responsibility. It's about keeping control.
Call to Action
Thinking about changing IT provider, or not sure your current setup would survive a switch? Talk to cyberISMS. We'll help you work through the ten questions above, show you how we'd run your handover, and give you a clear picture of the risks before you commit to anything.
Comments