Selling IT solutions and managed services to businesses: who buys, what triggers a purchase, and how to find them

This guide is for managed service providers (MSPs), IT consultancies, cybersecurity firms and value-added resellers, and for the salespeople who sell for them. It covers who buys IT services at each company size, the rules and events that create demand, a sales process built around an assessment, where to find prospects in public data, and a worked plan for one regulated segment. For the methodology behind consultative IT selling, see solution selling.

The market: who buys IT services

County Business Patterns, the Census Bureau's count of business locations with paid employees, counted 8,361,342 establishments in 2023. Size decides who owns IT and what they'll buy:

Your competition is large too. The same source counts 145,813 computer systems design and related services establishments (NAICS 5415), including 58,113 computer systems design firms and 6,374 computer facilities management firms. Most prospects already have someone. Your opening is a reason to reconsider, not an empty seat.

How businesses buy IT services

• They buy to reduce risk. Owners rarely want more technology; they want fewer surprises. Frame everything as risk removed, downtime avoided or a requirement met.
• The status quo is strong. Switching providers means handing over passwords, documentation and trust. Expect long consideration and a careful onboarding question: "How do you take over from our current provider?"
• The in-house IT person can block you. An IT manager may see an MSP as a threat to their job. Offer co-managed IT, where you take the after-hours and security work and they keep the strategy, and make them look good to their boss.
• Finance signs. Above about 50 employees the CFO or COO approves a monthly contract, so translate technical findings into cost and risk.
• References decide. A peer business of similar size in the same industry counts for more than any case study.

What triggers a purchase

The rules that create demand

This is general information, not legal advice.

• FTC Safeguards Rule (16 CFR Part 314). It applies to financial institutions under FTC jurisdiction, and its examples include tax preparers, mortgage brokers, auto dealerships that lease vehicles, appraisers and real estate settlement services. Covered firms must designate a Qualified Individual to run their information security program, and that person may work for a service provider. They must use multi-factor authentication for anyone accessing their systems, report in writing to their board or a senior officer at least annually, and, since 13 May 2024, notify the FTC within 30 days of a security event involving 500 or more consumers. Firms holding information on fewer than 5,000 consumers are exempt from some parts.
• HIPAA Security Rule. A health care provider may let a vendor create, receive, maintain or transmit electronic protected health information only with satisfactory written assurances, usually a business associate agreement. An MSP that manages a clinic's systems needs one before it starts.
• CMMC. The Defense Department's Cybersecurity Maturity Model Certification program (32 CFR Part 170) took effect on 16 December 2024, and the contract clause that enforces it took effect on 10 November 2025, starting Phase 1. Phase 2 begins one year later, on 10 November 2026, when DoD intends to require Level 2 certification by a third-party assessor in applicable contracts. Level 2's requirements are identical to NIST SP 800-171 Revision 2, and they flow down to subcontractors that handle controlled unclassified information.

An assessment-led sales process

1. Qualify the fit. Size, industry, location you can support on site, and a trigger. No trigger, no outreach yet.
2. Open with the trigger. Name the rule, event or change you saw, and ask one question about how they're handling it.
3. Run discovery. Ask what's broken, what they worry about, who supports them now and what that costs. The discovery call questions guide has a full list.
4. Offer a short assessment. A fixed-scope review of security controls, backups, devices and accounts, free or for a small fee credited against the contract.
5. Report findings in business terms. Rank the gaps by risk and cost: "Backups have not been tested; a ransomware event would mean days offline."
6. Propose a scoped monthly service. Per user or per device, with response times, what's included, what's a project, and how you'll take over from the current provider.
7. Plan the first 90 days. Onboarding, documentation and an early quick win make the renewal.

Public sources for an IT services prospect list

Finding the owner, COO or IT manager at each firm and reading what's changed there is the slow part at volume; Bebop finds matching companies and contacts and researches each account.

Segment the list

• Size. It decides the buyer and the offer (see the first table).
• Regulation. Safeguards Rule firms (County Business Patterns counts 28,762 tax preparation and 9,792 loan broker establishments), health care practices, defense suppliers.
• Current support. No IT staff, one generalist, or a full team. Each needs a different offer.
• Geography. Managed IT still needs people on site sometimes; sell where you can be within an hour.
• Trigger recency. Events in the last 90 days first.

Worked example: CMMC prospects in Ohio

Illustrative example. The MSP and its plan are fictional; the Ohio counts come from USAspending.gov contract data for fiscal 2025.

The seller: Ridgeline IT (ridgeline-it.example) is an MSP in Columbus with a compliance practice. The goal: defense suppliers that will need CMMC Level 2.

1. Size the segment. In fiscal 2025, 2,279 distinct recipients received Defense Department contract obligations for work performed in Ohio. 1,640 were small businesses, and 762 of those were small manufacturers, with $792 million in obligations between them.
2. Focus. Start with the 762 small manufacturers: they're the most likely to handle technical drawings and specifications marked as controlled information, and the least likely to have a compliance team. Subcontractors aren't in prime contract data, so ask each prime which of its suppliers face the same flow-down.
3. Do the arithmetic. If an illustrative 40% handle controlled unclassified information, that's about 305 firms. Contact them over two quarters. At an illustrative 8% reply rate, 24 conversations; if half take a gap assessment and a third of those sign, that's 4 new clients. At an illustrative 45 users each and $150 per user a month, that's $27,000 of monthly recurring revenue.
4. Write to the deadline. Lead with the date, not your services:

Subject: CMMC Level 2 and [company]'s DoD contracts

Hi [first name],

[Company] has Defense Department work performed in [city], so CMMC is probably on your list. Phase 2 starts on 10 November 2026, when DoD intends to begin requiring third-party Level 2 certification in contracts that involve controlled unclassified information.

Most manufacturers your size we talk to have the firewall and antivirus, but not the documentation, access controls and logging an assessor looks for.

We run a fixed-scope gap assessment against NIST SP 800-171 and give you a prioritized plan. Would a 20-minute call next week help you decide whether you need one?

[Your name]
[Phone]

Common mistakes

• Pitching tools instead of outcomes. Owners buy fewer surprises, not a security stack.
• Ignoring the incumbent. Plan the handover from the current provider; it's the buyer's biggest worry.
• Threatening the in-house IT person. Offer co-managed IT and make them the hero.
• Overstating compliance. Don't promise certification; assessors certify. Promise readiness and evidence.
• Selling outside your support radius. A client you can't reach on site in an emergency will leave.

Next step: pick one regulated segment and one territory, then use the ideal customer profile template to write down size, industry and trigger before you build the list.