We are a small non-profit using CiviCRM. We are currently being charged a lot for security upgrades and monitoring. We are trying to understand pricing and what we actually need. We want to change companies. Will we have to spend a lot on 'migration'? What elements do we need to get in a quote to compare apples to apples?
It can be time consuming and thus expensive to do security upgrades, especially on a site that has custom code. Monitoring requires some setup and sometimes an ability to respond quickly when something goes wrong.
Some providers bundle these services with hosting. Others provide them without the hosting.
I would compare the full cost of migration + hosting + security upgrades + monitoring between providers. You might also find that your site doesn't need every security upgrade - ask about options here since some providers want to upgrade all sites on every security release, while others will evaluate if the security vulnerability applies to your site given its configuration. And you might be willing to risk your site having troubles or being offline for a while before you notice in order to save some money on monitoring.
Migrating a site to a new server can be fairly simple, or sometimes not, depending alot on the server setups and the age of the site. Moving from an old server with an old CMS to a new one might cause issues with version of PHP for some custom or old Drupal 6 modules, etc. However, some hosting providers are willing to do the migration for free on the expectation that the costs can be amortized over the length of your time hosting with them.