Validate MRR quality, assess key-man risk, and uncover cybersecurity liability before closing on your MSP acquisition.
Find IT Managed Services Provider Acquisition TargetsAcquiring an MSP requires scrutinizing contractual recurring revenue, technical staff dependency, and cybersecurity exposure. This guide walks buyers through the critical phases to validate a $1M–$5M MSP and avoid costly post-close surprises.
Validate that reported MRR is contractually obligated, transferable upon ownership change, and supported by low historical churn rates.
Confirm every recurring revenue dollar is backed by a signed, written agreement. Flag month-to-month arrangements; they represent churn risk and reduce defensible recurring revenue at close.
Review all managed service agreements for assignment clauses. Many MSP contracts require client consent upon ownership transfer, which can delay close or trigger cancellations.
Request 36 months of MRR data by client. Calculate gross and net churn annually. Sub-5% annual churn supports premium valuation; above 10% signals service delivery or relationship issues.
Evaluate tool stack standardization, documented processes, and whether operations can run independently of the current owner post-close.
Assess PSA (ConnectWise, Autotask) and RMM (NinjaRMM, Datto) configuration maturity. Well-configured, documented tooling signals scalability; fragmented stacks complicate roll-up integration significantly.
Verify existence of written escalation procedures, onboarding/offboarding workflows, and NOC processes. Absence of documented SOPs means the business cannot operate without the selling owner.
Confirm Microsoft CSP, Datto, and other key vendor agreements are assignable. Partner tier status may not transfer automatically and loss can materially impact margins.
Identify key-man dependencies, assess technical staff retention risk, and quantify cybersecurity exposure embedded in client contracts.
Map which clients and technical functions rely solely on the owner. Identify certifications held personally vs. by the business entity. High owner dependency compresses multiples and complicates earnout structures.
Review all MSAs for indemnification clauses holding the MSP liable for client breaches. Confirm active E&O and cyber liability insurance with adequate per-occurrence limits.
Calculate each client's percentage of total MRR. Any single client above 20% of revenue requires earnout protections or escrow provisions to protect buyer against post-close loss.
Verify the IT Managed Services Provider acquisition qualifies for SBA financing, the purchase price is supportable by the verified cash flow, and the deal structure protects the buyer's downside.
Confirm the IT Managed Services Provider meets SBA 7(a) eligibility requirements: the business is for-profit, U.S.-based, within SBA size standards, and the buyer meets personal financial requirements. Some industries have specific SBA restrictions — verify before LOI.
Model verified normalized EBITDA against projected SBA loan payments at current rates. A $1M SBA 7(a) loan at 10.5% over 10 years costs approximately $13,000/month. The IT Managed Services Provider must generate at least 1.25x debt service coverage after a market-rate manager salary to pass underwriting.
Confirm the seller note is properly subordinated to the SBA loan and goes on 24-month standby as required by SBA rules. If an earnout is included, define exact measurement metrics, time period, and dispute resolution process before signing the purchase agreement.
Before signing a Letter of Intent, request these documents from the seller. Missing or incomplete items are a red flag — not a reason to proceed without them.
MRR contract quality is paramount. Verify every recurring revenue dollar is backed by a signed, transferable agreement. Informal month-to-month arrangements can evaporate immediately after close.
Map all client relationships and technical functions to specific individuals. If the owner holds the primary relationships for top accounts, structure earnout payments tied to client retention post-transition.
Review client MSAs for broad indemnification clauses, confirm active E&O and cyber liability insurance, and request disclosure of any prior breach incidents, client disputes, or regulatory investigations.
A single client above 20% of MRR significantly compresses multiples. Buyers typically respond with escrow holdbacks, earnout provisions tied to that client's retention, or a reduced upfront purchase price.
More IT Managed Services Provider Guides
DealFlow OS surfaces targets with seller signals and motivation scores — so you know before you start diligence. Free to join.
Start finding deals — freeNo credit card required
For Buyers
For Sellers