Small business security
What to get in an IT handover when you change IT provider
Changing IT provider, or saying goodbye to the person who "did the IT", is when businesses discover they don't control their own systems. The domain is in someone else's name, nobody has the admin password, and the backups belong to the old provider. A proper handover avoids all of that. Here's what to ask for.
The short version
The short version
- Make sure the business, not a person or provider, owns the domain, email tenant and key accounts.
- Get working admin access for every system before the old provider's access is removed.
- Collect a written record of equipment, network, services, renewals and backups.
- Then change the old provider's passwords and remove their access.
Ownership comes first
Before anything else, check who legally controls the things your business depends on. Each of these should be registered to the business, with a business email address that you control:
| Item | What to check |
|---|---|
| Domain name | The registrant is your business, and you can sign in to the registrar |
| Email and productivity tenant | Your business has a global administrator account in Microsoft 365 or Google Workspace |
| Website hosting | The hosting account is yours, or you have a written agreement |
| Software subscriptions | Licences are billed to and owned by the business |
| Backups | You can reach the backup account, and you know what happens to it when the provider leaves |
Our guide to protecting your domain name explains the domain side in more detail.
Admin access
Ask for working administrator access to every system, and test each one while the old provider is still helping you:
1. Email and cloud: a business-owned admin account with multi-factor authentication. 2. Network: router or firewall, Wi-Fi controllers and switches. 3. Computers and phones: device management tools, if used. 4. Security tools: antivirus or endpoint protection consoles. 5. Line-of-business software: accounting, CRM and booking systems. 6. Backup system: the console and the encryption or recovery key.
Test before you say goodbye
Sign in to each system yourself with the new details before the old provider's access is removed. Finding a missing password after they've gone is much harder.
Records to collect
A good handover includes written records, not just passwords:
- Equipment list: computers, network equipment, printers and phones, with serial numbers and warranty dates.
- Network diagram: what connects to what, internet details and Wi-Fi networks.
- Services and renewals: every subscription, who it's billed to and when it renews.
- Backups: what's backed up, where, how often, and the last successful restore test.
- Support instructions: how to do common tasks, and who to call for what.
- Open issues: anything known to be broken or due for replacement.
NovaSoft Labs has free tools that help you build these records yourself, including a client IT handover workspace and a network diagram builder. Everything stays in your browser.
Close the old access
Once you've confirmed you have everything:
1. Remove the old provider's accounts, or change the passwords on any shared ones. 2. Remove remote-access tools they installed, unless your new provider will use them. 3. Revoke any API keys or app connections in your email and cloud systems. 4. Update the contacts on your domain, hosting and key suppliers. 5. Keep a dated note of what was handed over and when access was removed.
Our guide to onboarding and offboarding covers the same steps when a staff member who managed IT leaves.
Questions to ask your new provider
A good incoming provider should be able to answer these before they start:
1. How will you confirm we own our domain, email tenant and key accounts? 2. Which admin accounts will you use, and will they be separate from ours? 3. Where will you keep passwords and documentation, and can we see it at any time? 4. How will you test our backups in the first month, and will you show us the result? 5. What will you hand back to us if we ever leave?
The last question matters most. A provider who documents everything for you from day one makes the next handover easy, whoever does it.
Common questions
Can the old provider refuse to hand over our passwords?
Check your agreement. Most providers will hand over access for systems you own, sometimes after final invoices are paid. This is why ownership of the domain and email tenant matters so much.
Is a spreadsheet of passwords a good handover?
It's better than nothing, but passwords should move into a secure password manager straight away, then be changed. See our shared passwords in a team guide.
How long should a handover take?
For a small business, a well-organised handover can take a few hours to a few days. Allow time to test access before the old provider's contract ends.
Can NovaSoft help with a handover?
Yes. Our managed IT service can take over from an existing provider, check ownership and access, and document what we find.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.