Guide
Switching Managed IT Providers: A Transition Checklist for Financial Firms
Changing IT providers does not have to mean downtime or lost access. Here is how to plan the move, what to secure before you give notice and how to keep client data protected along the way.
Key takeaways
- Make sure your firm, not the provider, owns every administrator account, domain, license and backup before you give notice.
- Run the transition in stages: document, take over access, move backups and security tools, then remove the old provider.
- Keep old backups and email archives until your compliance team confirms they are no longer needed for recordkeeping.
- Update your written security program, vendor list and incident response contacts when the new provider takes over.
Signs it is time
Signs it is time to switch IT providers
- Support tickets wait hours or days, and the same problems keep coming back
- Nobody can show you documentation of your network, accounts or backups
- Security basics such as multi-factor authentication and endpoint detection and response are missing or sold as extras
- You struggle to answer exam, audit or cyber insurance questions about your IT controls
- Invoices are unpredictable, with frequent charges for work you thought was included
- The provider does not understand your regulators, your software or your busy seasons
If several of these sound familiar, start with our guide on how to choose a managed IT provider so you know what to look for in the next one.
Before you give notice
What to secure before you give notice
Read your current agreement first. Note the notice period, any automatic renewal date, termination fees and what the provider has agreed to hand over when you leave. Then confirm that your firm controls the accounts the business depends on:
- Domain registration and DNS: the registrar account for your website and email domain should be in your firm’s name, with your own login.
- Microsoft 365 or Google Workspace: at least one administrator account that belongs to your firm, protected with multi-factor authentication.
- Licenses: who bills your Microsoft 365 and software licenses, and when annual subscriptions renew.
- Firewalls, Wi-Fi and network equipment: administrator passwords and any vendor support contracts.
- Backups and archives: where they are stored, whose account they are in and how long they are kept.
- Business applications: vendor contacts and administrator access for portfolio management, tax, accounting or core banking software.
The transition plan
A step-by-step plan for switching IT providers
- Discovery and documentation. The new provider inventories users, devices, servers, applications, network equipment, licenses and backups, and records how each one is set up.
- Access handover. Administrator credentials are transferred and then changed. Shared passwords are replaced with named accounts protected by multi-factor authentication.
- Licenses. Microsoft 365 and other subscriptions move to the new provider or to your firm. Annual Microsoft subscriptions can usually be cancelled only shortly after purchase or renewal, so plan around renewal dates.
- Backups first. New backups are running and a test restore succeeds before the old backup service is cancelled.
- Security tools. Endpoint detection and response, email security and monitoring are swapped device by device, so no computer is left unprotected in between.
- Remove the old provider. Uninstall its remote management agents, disable its accounts, remove its partner relationship and delegated admin access in Microsoft 365, and change any passwords it knew.
- Introduce the new help desk. Tell your team how to reach support, and schedule cutover work outside busy periods such as tax season or month-end close.
- Review after 30 days. Confirm that open issues are closed, documentation is complete and reports arrive as agreed.
Compliance
Keep your records and your compliance program up to date
A change of IT provider touches several parts of a financial firm’s compliance program:
- Records you must keep: old backups and email archives may hold books and records your firm is required to retain. Do not let the old provider delete them until your compliance team agrees. See our email archiving requirements guide.
- Vendor oversight: add the new provider to your vendor list, complete your due diligence and update contracts for confidentiality and incident notice. See our Regulation S-P compliance checklist.
- Written security program: update your WISP or information security policy, asset inventory and incident response contacts. See our WISP guide for accounting and tax firms.
- Cyber insurance: keep the controls your policy relies on, such as multi-factor authentication, endpoint detection and response and backups, in place throughout the switch. See our cyber insurance requirements checklist.
- Business continuity: update the IT contacts and recovery steps in your business continuity plan. Broker-dealers can use our FINRA business continuity plan guide.
Switching to FinFortify
How FinFortify handles the switch
We plan the transition with you, document your current environment first and schedule changes around busy periods such as tax season or month-end close, so your team keeps working while we take over. As a Microsoft Cloud Solution Provider partner we can manage your Microsoft 365 licenses, and our US-based engineers bring every new client onto the same security baseline, with 24/7 support plans available.
Learn more about our managed IT services for financial firms and IT support and help desk, or request a quote to start planning your move.
FAQ
Switching IT providers: frequently asked questions
How long does it take to switch managed IT providers?
Most of the time goes into discovery, access handover and moving backups and security tools. A small, well-documented firm can move faster than a multi-office firm with servers and specialized software, so ask the new provider for a written schedule.
Will we have downtime when we change IT providers?
A planned transition should not cause downtime. The work is done in stages, new backups and security tools are confirmed before the old ones are removed, and changes that could interrupt users are scheduled after hours.
Do we need our current provider to cooperate?
It makes the move easier, and most agreements require some handover. If your firm already owns its domain, its Microsoft 365 administrator account and its backups, a new provider can take over even when the old one is slow to respond.
What should we do with old backups after switching providers?
Keep them until your compliance team confirms they are not needed for recordkeeping or legal holds, and make sure they stay in an account your firm controls.
Ready to switch IT providers?
Tell us about your firm and your current setup, and we will plan a transition that keeps your team working.
