How to switch MSPs without disruption: a Modesto 150‑person consolidation case

BLUF: If a 150‑person Modesto company is consolidating two offices and plans to switch MSPs before its contract lapses, you can avoid downtime by treating the move as a staged infrastructure project: map dependencies, validate backups with a full-restore drill, run a co‑managed overlap for 30–60 days, and lock contingency playbooks to tested recovery steps. Follow the checklist below and bring your new MSP in as a named team, not a faceless vendor.

Why this matters: the Modesto consolidation we planned

A 150‑person distribution company headquartered in Modesto, CA, asked us to take over IT while it consolidated two legacy offices onto a single routed network and unified help desk triage. The client had three constraints that make a clean MSP switch nontrivial:

• Physical network reconfiguration across two sites with different WAN circuits and firewall models.
• A quarterly full restore backup drill scheduled by finance to validate invoice history and GL continuity.
• A hard contract renewal date (60 days) and a requirement that business operations can’t drop below a 99.5% availability SLA during the migration.

That combination — multi‑site network, mandated restore test, and a fixed cutover window — is a common pattern we see across Modesto and the Central Valley. The approach below is the one Datapath uses for these projects in Modesto and nearby markets (/locations/modesto-california/, /locations/fresno-california/) and for regulated verticals like healthcare and public safety where tested contingency plans are required.

Short answer: eight actions that stop disruption (30–60 day timeline)

• Map apps, owners, and dependencies within 7 days.
• Schedule and run a full-restore backup drill (see why below).
• Stand up a co‑managed overlap week for knowledge transfer and parallel monitoring.
• Keep a named Datapath team assigned — no rotating engineers.
• Freeze changes to critical systems 48 hours before cutover.
• Use MFA, scoped admin accounts, and an audited handoff for passwords/keys.
• Run final pre‑cutover simulation with business owners.
• Execute cutover in small waves, verify, then decommission old MSP access.

For customers who want our structured approach, see our managed services and co‑managed offerings (/services/managed-it-services/, /services/co-managed-it-services/) and consider adding an incident‑response retainer to shorten mean time to restore (/services/incident-response-retainer-services/).

What compliance and testing requirements shape the plan?

• If you operate under HIPAA, the Security Rule explicitly requires a contingency plan (45 CFR 164.308(a)(7)) that includes backup and disaster recovery policies and testing; migration plans must preserve those capabilities and test restores before decommissioning the incumbent system ¹.

• For public‑safety or law‑enforcement systems that handle Criminal Justice Information (CJI), the FBI CJIS Security Policy defines controls for handling, storing, transmitting, and protecting CJI — and contingency planning for availability and controlled access is part of that framework ².

• The NIST Cybersecurity Framework’s Recover function specifically calls out recovery planning and testing to restore capabilities after an incident; use that guidance to structure your restore‑test acceptance criteria and to measure readiness before cutover ³.

• CISA guidance on ransomware readiness emphasizes doing full restores from backups (not just file‑level checks) during testing so you discover hidden dependencies and broken playbooks before a real outage ⁴.

(These four external authorities guide the specific tests and acceptance criteria that avoid disruption.)

Step‑by‑step workflow (detailed)

H2 — Week 0: discovery and risk mapping

• Inventory: record servers, SaaS apps, network gear, on‑prem storage, EHR/ERP owners, and the business owner for each app.
• Dependency mapping: identify services that block others (e.g., AD, DNS, MDM, firewall rules).
• Recovery‑time targets: assign a business recovery target to each service (e.g., critical: 4 hours; important: 24 hours; nonessential: 72 hours).

Why this matters: you can’t plan a phased cutover without knowing which systems must move together — for example, your accounting server and SQL instance may need the same migration wave.

H2 — Week 1: backup validation and the full‑restore drill

Run a fully documented, full‑restore backup drill on a nonproduction weekend. This means restoring the entire system image or database to a separate environment and validating: app integrity, transaction logs, issuing a sample business transaction (invoices, bell schedule events, dispatch calls), and confirming the restoration meets the recovery targets.

• Use a checklist that includes DNS updates, certificate validity, service account permissions, and external integrations.
• If you are a healthcare customer, ensure ePHI access controls remain intact during the restore and follow HIPAA contingency expectations ¹.

Why a full restore? Partial file checks miss service‑level dependencies. CISA recommends full restores because they reveal hidden linkages and configuration errors that only appear when systems are rehydrated ⁴. NIST recovery guidance also treats end‑to‑end recovery exercises as the gold standard for proving readiness ³.

H2 — Week 2–4: co‑managed overlap and knowledge transfer

Bring the new MSP in as co‑managed staff with scoped privileges. Datapath recommends at least a 30‑ to 60‑day overlap for mid‑market firms consolidating offices: this buys time for the new team to absorb runbooks, event histories, and vendor contacts, and it lets the incumbent continue handling unfamiliar edge cases.

• Keep the incumbent’s access until sign‑off on the restore drill and a security review.
• Maintain a single ticketing workflow (PSA/RMM) and run weekly triage calls with named leads.

This is where Datapath’s vCIO service (/services/vcio-services/) helps align business priorities with cutover timing and ensures you keep accountability for uptime.

H2 — Cutover week: freeze, simulate, move

• Freeze nonessential changes 48 hours prior.
• Run a pre‑cutover simulation with business owners (login, sample transactions).
• Execute cutover in small waves (e.g., network, core servers, apps, workstations), validate each wave, then proceed.
• Keep the incident‑response retainer on standby and log every step for audit trails (/services/incident-response-retainer-services/).

H2 — Post‑cutover: decommission, audit, and handover

• Remove incumbent admin accounts only after 7 days of clean operations and a final audit.
• Archive evidence of the restore drill, configuration baselines, and signed acceptance from owners.
• Convert the emergency runbook into a living document for the new MSP team.

Common buyer questions

H3 — How long should the co‑managed overlap be?

We recommend 30–60 days for 100–300 employee mid‑market customers undergoing consolidation; smaller orgs can be as short as 14 days if they have fewer interdependencies. The overlap duration should be proportional to the number of critical services and the number of third‑party integrations.

H3 — What testing is non‑negotiable?

At minimum: a full‑restore backup drill, AD failover simulation, and a failback test for your core database. For healthcare customers, these must map back to your HIPAA contingency expectations (45 CFR 164.308(a)(7)) and be documented ¹. For CJIS‑dependent systems, ensure CJIS‑level access and audit controls are preserved during the transition ².

Decision matrix: cutover approach comparison

Approach	Best fit	Specialty / strengths	Location	Key Datapath differentiator
Big‑bang swap	Single‑site, low dependencies	Fastest single‑date cutover	Modesto, Manteca	Rapid execution but needs extensive pretesting; Datapath named cutover squad
Phased waves	Multi‑site consolidation (150+ staff)	Lowest user impact	Fresno / Central Valley	Staged validation and restore drills tied to business owners (/locations/fresno-california/)
Co‑managed transition	Complex integrations or regulated systems	Parallel ops, knowledge transfer	Modesto / California markets	We act as a named extension of your team (vCIO + vCISO support) (/services/co-managed-it-services/, /services/vciso-services/)

Practical checklist (must‑do before you pull the plug)

• • Inventory + dependency map completed and signed off.
• • Full‑restore backup drill passed with business acceptance.
• • Co‑managed overlap contract and named engineers assigned.
• • Freeze window scheduled and communicated to all users.
• • MFA and admin credential handoff documented and audited.
• • Incident retainer and recovery SLA confirmed (/services/incident-response-retainer-services/).

Tools and controls we use (real operational tech)

• RMM + PSA for ticketing and device management.
• Image‑based backups + Veeam/scale backups for full restorable images.
• Microsoft 365 backup and restore for mailbox/SharePoint continuity (/services/microsoft-365-backup-services/).
• MFA, SSO (Azure AD), and role‑based admin accounts during cutover.

Final recommendations and how Datapath helps

If you’re in Modesto or the Central Valley and are considering an MSP switch during a consolidation or planned migration, ask for a named Datapath cutover squad, a 30–60 day co‑managed overlap, and a documented full‑restore drill before you remove the incumbent’s access. We provide the technical work plus the compliance mapping for HIPAA and CJIS customers (/services/hipaa-compliant-it-services/, /services/cjis-compliance-services/) and can run your restore testing as a service. Book a consult and we’ll draft a 30–60‑day transition plan tailored to your network and business priorities (/contact/).

---

Sources cited inline: HIPAA contingency rule, FBI CJIS policy, NIST Recover guidance, and CISA ransomware/restore guidance are used to set the test and acceptance criteria in this plan⁵.

---

Need a partner for this work? Explore Datapath’s managed IT services or contact our team.

Footnotes

1. Administrative Safeguards - HIPAA Security Series #2 ↩ ↩² ↩³

2. Criminal Justice Information Services (CJIS) Security Policy ↩ ↩²

3. Recover | NIST ↩ ↩²

4. StopRansomware Guide ↩ ↩²

5. NIST SP 800-53 Rev. 5 “Security and Privacy Controls for … ↩