Most managed service providers learn that a company changed IT providers after it happened. The record of that decision usually exists earlier, in public: a firm files to move its main office, a tenant pulls a renovation permit, two firms announce a merger, a small IT company files to dissolve. All of them mean someone is about to make an IT decision, usually on a date the firm did not choose.
This page covers nine signals from our pillar guide, 18 buying signals that show a company is about to change IT providers, grouped by what they tell you: where a firm is going, how it is being restructured, and what deadline is forcing its hand.
Public records predict an IT-provider decision because they record events that force one. An office move or build-out means new cabling, network, firewall, printers, door access, and a rewrite of the firm's written security plan. A breakaway, a merger, or an out-of-state firm opening a local office means email, devices, and document systems must be set up or combined by a fixed date. A firm growing past the size where a stricter regulator takes over inherits that regulator's cybersecurity exams. Paid tax preparers confirm every renewal season that a written information security plan is required by law. A defense contract award names a company that must hold its cybersecurity status on record. When a small IT company dissolves or is bought, its clients may soon need a new provider. Each event is filed in public before the IT work begins, which gives an outbound system a dated reason to reach the owner while the decision is still open.
1. Places: moves, build-outs, and arrivals
Office move. A regulated firm that changes its main office address has to tell its regulator, and the change appears in a public register. A move is an IT project: cabling, network, firewall, door access, and the security plan all get redone. The owner decides who does it while the filing is fresh. By hand, the register changes one record at a time across hundreds of firms, and nobody re-reads it. The first message: "Saw the new address on file. Who is handling the network at the new space?"
Office build-out. A tenant filing for an interior renovation has committed money to a space. Months later it needs cabling, a network, and a firewall. The permit is public the day it is filed. Few IT sales teams read permits, because by hand it means checking every city in your territory. An outbound system can watch for that. The first message: "Saw the permit for the new space. Who is running cabling and the network before move-in?"
Firm arriving in a new state. When an out-of-state company registers to do business locally, it appears in a public filing. The ones opening a real office need local hands on day one. The filing does not tell you which kind it is. A phone call or a short note does. By hand, these sit among every other new business filing, and nothing marks the ones with an office. The first message: "Saw you registered here. Is anyone local setting up the office?"
2. Structure: breakaways, mergers, regulatory lines, and providers closing
Breakaway firm. Professionals leave an established firm to open their own, and the new firm's registration is public. The founders have weeks to stand up email, devices, document management (where the firm's files live), and security from nothing, and they usually cannot take the old firm's IT provider with them. By hand, it looks like any other new business until you notice where the founders came from. The first message: "Congratulations on the new firm. Are email and document systems sorted yet?"
Merger. Two firms combine, and someone must merge two email systems and two document systems by a closing date. The IT integration is often planned after signing, so the owner chooses who does it right after the announcement. One incumbent provider usually loses. By hand, the announcement is one line in a press release, and nobody connects it to an IT decision. The first message: "Saw the merger. Who is combining the two email systems before closing?"
Crossing a regulatory line. Some firms grow past the size where a stricter regulator takes over. For an investment adviser, that means moving from state to federal oversight. The SEC's examination priorities for fiscal year 2026 name governance, data loss prevention (controls that stop files leaving the firm), access controls, oversight of third-party vendors, and controls against new risks from artificial intelligence. The amended Regulation S-P (the SEC's privacy and safeguards rule) requires a written incident response program and customer notice after a breach. The firm's current provider may never have documented any of that. By hand, spotting this means reading each adviser's public filing and knowing where the line sits. The first message: "Looks like you are moving to federal oversight. Has anyone walked you through what the exam covers?"
IT providers closing or bought. When a small IT company files to dissolve or is bought, its clients are about to be handed off. Some will stay. Many will use the change as a reason to shop. By hand, a dissolution filing names the IT company, never its clients, so nobody connects the two. The record is public, and the message is simple: your provider just changed hands, here is who we are.
3. Deadlines: tax-season security plans and defense work
Tax-season security plan. Paid tax return preparers renew their preparer identification number every year, and on the renewal form they check a box to acknowledge that the law requires them to create and maintain a written information security plan (a WISP) for taxpayer information. This is a deadline, not a buying signal. But renewal season puts security on the owner's desk every year. By hand, there is nothing to spot: every preparer renews in the same season, so the only way to learn who lacks a plan is to ask. The first message: "Renewal season again. Do you have a written security plan on file?"
Defense work. Contracts carrying the Department of Defense cybersecurity clause (DFARS 252.204-7012) require the contractor to protect covered defense information (the sensitive but unclassified data the contract touches) under NIST SP 800-171 (a federal security standard) and to pass the clause down to subcontractors. The CMMC clause (Cybersecurity Maturity Model Certification) adds that the contractor must hold a current CMMC status at the contract's level for the life of the contract. A new award naming a small contractor is a dated record of a company about to face those requirements, and the owner is choosing help now. By hand, awards sit in a public record that few people outside government contracting read, with small contractors mixed in among large ones. The first message: "Saw the award. Do you have someone lined up for the cybersecurity requirements it carries?"
4. Two caveats before you build a list on this
Nobody buys the day the event happens. The move is filed months before the boxes arrive. One email sent the week of the filing gets a polite no or silence. Follow-up runs over weeks, with the filing as the reason for each touch.
The sharpest signals are low volume. In any territory there are only so many breakaways, mergers, or defense awards at one time. Those go to the top of a list, but they are not the list. The list is built to the MSP's ideal-client definition: size, industry, geography, and buying role. That is how SiteSmith builds target lists around signals like these: definition first, signals on top.
Where to go from here
Filings are one of four signal groups. Next, read Systems-change signals: AI rollouts, vendor switches, and projects before launch. To put any signal to work, our guide to building an MSP outbound system covers sending infrastructure, messaging, and reply handling.
Sources and editorial note
SiteSmith publishes practical operating guidance and cites external sources for factual industry and security claims. This article is not legal, regulatory, or cybersecurity advice.
- DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting
- DFARS 252.204-7021, Cybersecurity Maturity Model Certification Requirements
- IRS, Instructions for Form W-12 (PTIN renewal), WISP acknowledgment
- SEC, amendments to Regulation S-P (May 2024)
- SEC Division of Examinations, Fiscal Year 2026 Examination Priorities