Most businesses don't switch IT providers because everything is fine. Here's what the first 90 days of managed IT typically look like, from the first audit to a steady routine.

This is a composite example, not a specific client. It combines patterns we commonly see when a small professional services firm moves from break/fix IT to managed IT services with NerdSquad Managed IT Services, a Managed Service Provider (MSP) based in Naples, Florida. Your own first 90 days will depend on your environment, your plan and what the audit finds.

The starting point

Picture a small accounting and financial planning office. A few partners, some support staff, and an office manager who has quietly become the unofficial IT person because she's the most patient one in the room when the printer acts up.

Their IT has been handled break/fix: a provider who shows up when called but doesn't watch anything in between. In an office like this we commonly find:

• No central monitoring of computers or servers
• Basic antivirus that varies from machine to machine
• Backups going to a device in the office that nobody has test-restored in a long time
• Microsoft 365 set up for convenience rather than security, with no multi-factor authentication
• No written record of the network, vendors or passwords

None of this is unusual. It's what years of "call us when it breaks" tends to produce in a growing office.

What usually prompts the call

In our experience, the trigger is often a security incident or the departure of the person who knew how everything worked. In this example, a ransomware infection reaches a shared drive, and the office discovers during recovery that its on-site backup had stopped working weeks earlier without anyone noticing. They recover part of the data from email attachments and copies clients send back, lose productive time across the office, and decide they don't want to go through that again.

Days 1 to 30: audit and foundation

Every engagement starts with an onboarding audit. In an office like this, the findings usually look something like:

• Workstations without modern endpoint protection
• Users without multi-factor authentication (MFA)
• Microsoft 365 security defaults switched off at some point to fix a login problem and never turned back on
• A lapsed cloud backup subscription and an on-site backup that isn't completing
• Out-of-date firewall firmware and default admin passwords
• Computers still running Windows 10, which reached end of support on October 14, 2025
• No documentation of the network, vendors or recovery steps

The first month focuses on the items that reduce the most risk:

• Protect the endpoints. Deploy endpoint detection and response (EDR) and monitoring on every computer.
• Lock down accounts. Turn on MFA for every Microsoft 365 user, restore security defaults or conditional access policies, and change shared and default credentials.
• Fix backups. Set up backup with a test restore to confirm it actually works.
• Patch and harden. Bring workstations and the firewall up to date, and plan replacements or upgrades for unsupported Windows 10 machines.
• Write it down. Build network documentation, a vendor list and a recovery runbook.
• Set up support. Introduce the team, show staff how to reach the help desk and agree on a maintenance window.

The full sequence is described in how NerdSquad's managed IT onboarding works.

Days 31 to 60: tightening up

With the basics in place, the second month is about filling gaps and settling into a routine:

• Email archiving set up to support the firm's record-keeping obligations
• Single sign-on (SSO) rolled out where the firm's applications support it, so access can be managed in one place
• Security awareness training started for staff
• A replacement plan for aging hardware, so upgrades are budgeted instead of surprises

Days 61 to 90: steady state

By the third month, the work shifts from fixing to maintaining. In a typical example like this one:

• Problems are caught earlier. Monitoring flags failing disks, missed backups and security alerts so tickets open on our side, often before staff notice.
• Suspicious sign-ins get stopped. If a staff member's password shows up in a breach from some unrelated website and someone tries to use it, MFA and Microsoft 365 sign-in protections block the attempt, and we follow up with the user to reset the password.
• Backups are tested, not assumed. Restore tests are part of the routine.
• The office manager gets her job back. IT questions go to the help desk instead of the person at the next desk.
• Documentation exists. The firm's compliance lead has a current device inventory, access list, vendor list and backup overview to work from, instead of rebuilding it from memory each year.
• Spending is planned. IT costs become a predictable line item under the service agreement, and hardware replacements are on a schedule.

Managed IT doesn't make problems disappear. It makes them smaller, earlier and less disruptive, and it makes the next one easier to recover from.

The pattern

When we onboard an office that has run on break/fix for years, the audit findings are usually more extensive than the owner expected, and the fix list is usually more manageable than they feared. The incident that prompts the call is rarely the first sign something was wrong. It's just the first one nobody could ignore.

To see what an ongoing plan covers, read what's included in a NerdSquad managed IT plan. If you're still deciding, how to know if your business is ready for managed IT and managed IT vs. break/fix are good next reads. Accounting and advisory firms can also see our IT support for financial firms.

Talk to NerdSquad

Already a client? Call (239) 465-0079 or submit a ticket. If something is down, call so we can start right away.

Not a client yet? NerdSquad Managed IT Services is a Managed Service Provider (MSP) based in Naples, Florida. We support businesses onsite across Southwest Florida and remotely nationwide. Book a discovery call or call (239) 465-0079.

Related: Managed IT services and plans