Leaving a managed security provider: exit terms, log export, tool ownership and a safe handover

Leaving a managed security provider is safe when four things are settled before you give notice: what data you will receive (logs, incident records, reports, configurations) and in what format; who owns the tools, tenants, licences and admin credentials; how long the old and new providers will overlap so nothing goes unmonitored; and how you will continue to meet record-keeping duties, such as the 24-month breach records under PIPEDA and Quebec's incident register. Most exit problems come from contracts that never addressed these points, so the best time to negotiate an exit is at signing. If you are already in a contract without exit terms, start the conversation at least a quarter before the notice deadline.

This guide is part of managed security failures and official sources. Costs are illustrative; contract and privacy questions may need a lawyer.

What you need to take with you

Item	Why you need it	Format to ask for
Raw logs within retention	Investigations of incidents discovered later; evidence	Standard formats your next platform can import, or an archive you can search
Incident records and reports	PIPEDA breach records (24 months), Quebec register, insurer and client questions	PDF reports plus structured case data
Detection rules and tuning	Avoid relearning which alerts matter	Exported rules, exception lists and notes
Firewall and device configurations	Rebuilding is slow and risky	Configuration backups
Asset inventory	Proves scope; starting point for the next provider	Spreadsheet or export
Runbooks and contact lists	Continuity of response	Documents
Vulnerability and pen-test findings	Remediation history	Reports and status list

Ask what the export costs and how long the provider will keep your data after the contract ends before deleting it, and require written confirmation of deletion.

Who owns the tools

Ownership is often where exits stall:

EDR or antivirus console. If the tenant is the provider's, agents must be removed and new ones installed on every device. If the tenant is yours, the new provider can be given access.
SIEM or log platform. A provider-owned platform means your logs leave with the data export, not with the platform.
Firewalls. Firewall-as-a-service hardware is usually returned; owned hardware stays, but you need admin credentials and the configuration.
Licences. Licences bought through the provider may not transfer; check whether they can be moved to your name.
Admin accounts. Make sure your organisation holds break-glass administrator credentials for every system, not only the provider.

Write ownership into the contract at signing; see firewall and EDR pricing and the due-diligence checklist.

Planning the overlap

Running both providers for a period avoids gaps while agents are swapped and log sources reconnected.

Illustrative example. A 70-person Burlington firm pays its current MDR provider $2,100 a month and the new provider $2,300 a month. It plans six weeks of overlap and a one-time log export fee.

Item	Calculation	Cost
Overlap with old provider	$2,100 × 1.5 months	$3,150
New provider onboarding	one-time	$4,000
Log export from old provider	one-time	$1,500
Archive storage for exported logs, 12 months	$75 × 12	$900
Internal IT time	40 hours × $85	$3,400
Total switching cost		$12,950

The new provider is $200 a month more expensive, so the switch is justified by better scope or response, not savings. If the new provider had been cheaper, the payback calculator would show how long the $12,950 takes to recover.

Step-by-step exit plan

Read the contract: term, renewal date, notice period, termination fees, exit assistance, data return and deletion clauses.
Choose the new arrangement using how to choose a provider.
Give written notice on time; ask for confirmation.
Request exports in writing with formats and dates.
Secure admin access: change shared passwords, confirm your break-glass accounts, remove the old provider's accounts at the cutover.
Install new agents and connect log sources; confirm in the new provider's asset report that every device and source is visible.
Remove old agents only after the new ones are working.
Cut over monitoring on a date both providers acknowledge, with a named contact for incidents found in the overlap.
Receive and verify exported data; check you can open and search it.
Get written confirmation of deletion by the old provider after the agreed period.
Update your incident response plan, insurer contacts and privacy policy if storage locations changed; see SOC data residency.

Incidents during the transition

If a possible incident appears during the overlap, decide in advance which provider leads. Both may hold relevant evidence; your contract with the old provider should require cooperation after termination for incidents that started during its term. Your breach-assessment and reporting duties continue; see breach reporting.

Frequently asked questions

Can the old provider refuse to give me my logs?

It depends on the contract. Many agreements give you a right to your data; some charge for export. Negotiate this at signing.

How long should I keep exported logs?

Long enough to support investigations and your record duties. PIPEDA breach records must be kept for 24 months, and the CAI says register information is kept at least five years; logs themselves follow your retention policy and contracts.

Is there a penalty for leaving early?

Often, a fee for the remaining months or a set percentage. Read the termination clause and negotiate if service levels were missed.

Should I tell my insurer?

Check your policy; a change of security provider may be a material change you must report. Ask your broker.

Sources

Office of the Privacy Commissioner of Canada — breach records and service-provider accountability
Justice Laws Website — Breach of Security Safeguards Regulations
Commission d'accès à l'information du Québec — incident register
Canadian Centre for Cyber Security — guidance on outsourced IT services