Selling an IT services or MSP company

Managed IT has what investors want in a services business. Clients pay monthly under multi-year agreements, and switching is painful because you hold the credentials, documentation and history of every system. Many small and midsize companies cannot justify an IT department, and the Bureau of Labor Statistics notes that smaller organizations with modest IT needs may find an outside firm cheaper than in-house network support staff³.

Security has made the service more essential. BLS projects employment of information security analysts to grow 21 percent from 2025 to 2035⁴, a skill few small businesses can hire on their own. It also raises the stakes. In 2022, cyber agencies in the United States and four allied countries jointly warned that attackers were going after MSPs as a route into many customer networks at once⁵.

Add a field of mostly owner-run regional firms and engineers who are hard to hire, and consolidation follows. Thrive bought Michigan's Worksighted in November 2025, its fifth acquisition that year¹. Evergreen, which keeps the MSPs it buys rather than reselling them, announced its 100th MSP acquisition in June 2025². Intelligent Technical Solutions (ITS), a Tower Arch Capital portfolio company, said it had acquired ten managed IT and security providers since May 2022 when it added Dallas-based Velocity IT in August 2026⁶. In October 2026, CompassMSP, backed by Agellus Capital, bought SecureNet Solutions, a California provider serving real estate, healthcare and professional services firms⁷.

Buyers also reach into neighboring services. Managed detection and response provider CyberMaxx bought security firm Avertium in September 2026⁸. Tegria, owned by healthcare investor Altaris, bought CloudWave, a cloud hosting and managed IT provider for hospitals, in October 2026⁹.

Whether a buyer sees you as a platform or an add-on shapes the process. A platform buyer pays for leaders and systems that can absorb more acquisitions. An add-on buyer pays for your clients, engineers and market, folds them into its own help desk and back office, and checks hard for anything that might not carry over.

The buyers you are likely to meet:

• Private equity backed MSP platforms adding cities, clients and engineers. For most owner-run MSPs, this is the likeliest buyer.
• Long-term holders such as Evergreen, which says it never sells the businesses it acquires and lets them keep their names and teams².
• Sponsors starting a platform, which usually want a larger company with managers who can run it without the founder.
• Security, cloud and industry specialists buying skills or client bases.
• Larger regional MSPs, and independent sponsors who raise money deal by deal and whose financing you should test early.

Recurring revenue sits at the center of every conversation. Buyers split your revenue into monthly managed services, recurring cloud and license subscriptions, projects, and hardware or software resale, and value each differently. When New Charter Technologies added Florida-based ICG in April 2026, it noted that ICG runs on a fully recurring revenue model¹⁰. Projects count for less because they must be won again, and resale is usually judged on gross profit.

Regulated clients add value if your paperwork matches the work. HIPAA's definition of a business associate can reach an outside firm that maintains or transmits health information for a healthcare client¹¹, so buyers will ask for your signed business associate agreements. The FTC's Safeguards Rule requires the financial institutions it covers to bind service providers to safeguards by contract and to assess them periodically¹².

Expect early requests for these, mostly from your PSA, RMM and accounting systems:

• MRR: managed services revenue by month for three years, its share of revenue and gross profit, and the trend.
• Contracts: the share of clients on signed agreements, term, auto-renewal, notice, termination rights and price escalators.
• Seats and endpoints: users and devices under management, and revenue per seat or device.
• Retention: clients and MRR gained and lost each year, with reasons, and growth from existing clients.
• Concentration: your top 10 clients as a share of MRR, and your largest industry.
• Margins by line: managed services, security, cloud, projects and resale, with engineer time charged to each.
• Tool stack: your RMM, PSA, documentation, backup and security tools, and whether every client runs the same standard.
• Vendor partnerships: partner tiers, certifications and distributor terms, and whether they carry over.

Owner dependence comes first. If you still close every new client, design every network and take the call when a server fails at night, a buyer has to price in what happens when you step back. The usual answer is a longer transition or more of the price tied to future results.

Security is the risk that sets this industry apart. An MSP holds privileged access to every client at once, so the joint agency guidance tells providers to require multifactor authentication on all accounts that reach into client environments and to treat them as privileged⁵. CISA has also warned that attackers use legitimate remote monitoring and management software as a backdoor¹³. Buyers will ask how your own access is locked down, whether you have had an incident and what your cyber insurance covers.

Other issues that come up often:

• Project-heavy revenue from migrations, buildouts or hardware refreshes that must be sold again every year.
• Resale booked at full price, which inflates revenue and thins margins. Buyers will restate it.
• Handshake clients: month-to-month terms, expired agreements or contracts that allow exits on short notice.
• Underpricing: legacy per-seat rates or flat fees that no longer cover the work.
• Tool sprawl and thin documentation: a different stack for each client, shared admin passwords, tool licenses in your personal name, or environments that live in one engineer's memory.
• Security gaps: admin accounts without MFA, untested backups, an incident never fully closed out, or cyber coverage with surprise exclusions.
• Key-engineer risk: one or two engineers who own your biggest relationships, with nothing in place to keep them.

If you support defense contractors or hold government contracts, buyers will spend real time on compliance. The Defense Department's CMMC program rule took effect on December 16, 2024, and the acquisition rule that writes CMMC into contracts took effect on November 10, 2025, starting a three-year phase-in¹⁴. Each phase begins a year after the last, so Phase 2, when the department intends to require third-party Level 2 certification at award on applicable contracts, is due in November 2026¹⁵.

For an MSP, the key term is External Service Provider. A provider counts as one when a client's controlled unclassified information, or security data such as logs and configuration files, sits on its systems¹⁵. Its services then fall inside the client's assessment and must be described in the client's system security plan and in the provider's service description and customer responsibility matrix. A provider may get its own CMMC assessment to lighten that load¹⁵.

Cloud services holding that information must be FedRAMP Moderate authorized or meet an equivalent standard¹⁵. FedRAMP is the government-wide program, housed at GSA, for assessing and authorizing cloud services that agencies use¹⁶.

In August 2026, McNally Capital made a majority investment in TENICA, a Virginia engineering and cybersecurity contractor for intelligence, space and defense missions, keeping its leadership in place²⁰. A day later, Veritas Capital agreed to buy Steampunk and merge it with MetroStar, a federal contractor it already owns²¹.

If you hold federal contracts directly, three rules shape the deal:

• Small business status: you must recertify size and program status within 30 days of a sale that changes controlling interest. Existing awards keep their terms, but if the buyer is not small, you generally lose new set-aside offers under multiple award contracts, and agencies stop counting your orders toward small business goals¹⁷.
• Novation: in an asset sale, the government has to agree to recognize the buyer through a novation agreement. A stock purchase that leaves the contracting company unchanged and performing the work does not need one¹⁸.
• Clearances: a cleared contractor must report a change of ownership or control, including stock transfers that affect control¹⁹.

An offer is a package. Judge it by the total you are likely to collect and how much of it depends on decisions you will not control after closing.

Ask every buyer what changes for clients and engineers: the name, tools, help desk, pay and local decision-making. Practices differ. Evergreen kept the name and leadership of Next7 IT, a 26-person Pittsburgh MSP it bought in August 2025, where the founder retired and the chief operating officer became CEO²³. New Charter said the president of ICG would keep running that business¹⁰, and CompassMSP said the founder of SecureNet would stay on⁷. Get the answers in the letter of intent.

The pieces you will usually see:

• Cash at closing, adjusted for debt, cash and working capital. Agree early how prepaid projects and subscriptions billed in advance are treated, since buyers may count unearned work as a liability.
• Rollover equity: many platforms ask you to reinvest part of your proceeds. ITS described its Velocity IT deal as a recapitalization done in partnership with the founder⁶, a structure that usually leaves the founder with a stake. Contributing property to a partnership in exchange for an interest in it is generally not taxed at that time²², one reason rollovers are often set up that way. Get your own tax advice.
• Earnouts on recurring revenue: part of the price is paid later if MRR or gross profit holds at an agreed level. Define MRR precisely, decide how clients lost after a buyer's price increase or tool migration count, and agree who controls pricing and staffing in the meantime.
• Holdbacks and escrow: money set aside for claims after closing, often a security incident that surfaces later.
• Consents: in an asset sale, client agreements, distributor accounts and tool licenses may need consent to assign. In a stock sale they usually stay with your company, though change-of-control clauses can still apply.
• Your role: plan to stay through a transition, longer if you lead sales or engineering, with title, duties, pay and time in writing.

Buyers review two or three years of history, so start early. Most of these steps pay off even if you never sell:

• Paper every client: signed agreements that state the term, auto-renewal, notice period, price increases and assignment rights.
• Separate your revenue: managed services, security, cloud, projects and resale as their own lines, with resale at gross profit and engineer time charged to each.
• Fix underpriced accounts a year or more ahead, so the higher MRR has a track record.
• Standardize the stack: one RMM, PSA, backup and security standard for every client, with every tool license in the company's name.
• Document every client: network diagrams, asset lists, runbooks and credentials in a password vault.
• Harden your own house: MFA on every admin and RMM account, least-privilege access, isolated backups you test, at least six months of retained logs and a written incident plan. The joint agency guidance for MSPs makes a useful checklist⁵.
• Review your cyber insurance: limits, exclusions and whether it covers a client incident that starts in your tools.
• Step back from sales and engineering: put a service manager, sales lead and senior engineer in place, and give them a full year to prove it.
• Secure key people: identify the engineers your largest clients rely on, and consider retention bonuses tied to a sale.
• Tighten the financials: accrual accounting, monthly closes, statements that tie to your tax returns and documented add-backs. If you serve defense contractors, keep a current service description and customer responsibility matrix¹⁵.