Briefing
Most IT handovers are uneventful. The painful ones share a pattern: the outgoing provider holds the admin passwords, the domain registration is in their name, and documentation arrives in pieces or not at all.
You can avoid most of that by collecting a short list of access and records before you give notice. These are your accounts; asking for them is reasonable at any time, not only when leaving.
One item deserves special attention: remote access tools. CISA has warned that legitimate remote monitoring and management software is abused by attackers. When a provider leaves, every one of their agents should be removed, and you should know which ones were installed.
What to do
- Global admin credentials for Microsoft 365 or Google Workspace, plus a break-glass account in your name.
- Domain registrar and DNS hosting logins, with the domain registered to your business.
- Firewall, switch and Wi-Fi admin access, including any cloud dashboards such as UniFi or Meraki.
- Backup console access and the location of every copy.
- A list of licenses and subscriptions with renewal dates.
- Admin access for line-of-business software and vendor contacts.
- Any network diagram, device list and written documentation.
- A list of every remote access and monitoring tool installed on your devices.
How to verify
- Log in to each admin account yourself before announcing the switch.
- Confirm in the registrar that the domain owner is your business.
- After the switch, check a few computers for leftover remote access agents.
Sources
- CISA, Protecting against malicious use of remote monitoring and management software (AA23-025A)
- CISA, Cyber Essentials
Want help putting this in place? Contact Computer Plus or compare our plans.