IT Due Diligence: What to Check Before You Buy a Business

An IT due diligence checklist covers six areas of the target company before closing: its assets, identity and admin access, security posture and incident history, software licensing and contracts, regulated data, and key-person dependence. You request the documents, verify a sample with a technical review, and price what you find into the deal. For a business under 100 employees, the review typically takes one to two weeks.

When you buy a company, you buy its network. That includes the servers nobody has patched since 2019, the shared admin password four ex-employees still know, and any breach already sitting quietly inside it.

Financial and legal due diligence are standard. IT due diligence usually isn't, and that's where the expensive surprises live.

The short version:

• IT due diligence is a pre-close technical review that finds liabilities and integration costs before the price is fixed.
• The three findings that most often move a deal are unlicensed software, unsupported systems, and a breach the seller never disclosed.
• Start it the day you sign a letter of intent, not the week before closing.
• Across the reviews we run, a sub-100-seat target takes one to two weeks, a rounding error against the purchase price.

Why does this matter? Ask Marriott.

Marriott acquired Starwood in September 2016. According to the UK regulator's penalty notice, an attacker had installed a web shell on the Starwood network on July 29, 2014, more than two years before the deal closed.

Nobody caught it until an alert fired on September 8, 2018. Marriott disclosed that November, first estimating up to approximately 500 million guests affected. The figure was later revised to an estimated 339 million guest records.

The UK's data protection regulator fined Marriott £18.4 million, roughly $24 million at the time.

Marriott didn't cause that breach. It bought it.

What does IT due diligence actually cover?

IT due diligence is a pre-close review of the target company's technology, security, contracts, and licensing to find liabilities and integration costs before the price is fixed. It answers three questions: what do they actually own, what's already broken or compromised, and what will it cost to fold it into your business?

You're looking at:

• Assets. Every server, firewall, laptop, and phone. Age, warranty status, and whether the operating system still gets security updates.
• Identity. Who has admin rights. Whether MFA is on everywhere. How many accounts belong to people who left.
• Security posture. Endpoint protection, patching cadence, backups someone has actually restored from, and any incident history.
• Contracts and licensing. Software the seller is running but not licensed for. Auto-renewing MSP and telecom agreements with painful termination clauses.
• Data. What regulated data they hold, where it lives, and who can reach it.
• Key-person risk. Whether one person is the only one who knows how anything works.

IT due diligence checklist

Work through each line and record what you verified, what the seller only claimed, and what it will cost to fix. The table copies cleanly into a spreadsheet: add columns for status, evidence received, finding and estimated cost, and you have a working template.

Area	What to verify	Evidence to request
Ownership	The company, not a former employee or outside vendor, owns the domain, the Microsoft 365 or Google tenant, and the admin accounts	Registrar account, tenant billing and global admin list
Assets and lifecycle	Age, warranty and support status of every server, PC, firewall and switch	Asset inventory with operating system versions
Identity and access	MFA on every account, no shared admin passwords, leavers disabled	MFA report, admin account list, last access review
Security posture	Endpoint protection on every device, patching current, logging turned on	EDR console export, patch report, security tool list
Backups and recovery	Backups cover what the business runs on, and a restore has actually been tested	Backup job reports and the date of the last test restore
Incident history	Any breach, ransomware, wire fraud or insurance claim in the last three years	Written incident statement and the cyber insurance application
Licensing	Every installed product is licensed to the company and transfers on closing	License records and SaaS subscription list
Contracts	Renewal dates, notice periods and termination costs for the MSP, telecom and software vendors	The contracts themselves, not a summary
Regulated data	Which customer, health or payment data the company holds and under which rules	Data map, compliance reports, vendor agreements
Key people	Whether one person or one outside vendor holds all the knowledge and passwords	Documentation, runbooks and interview notes

How does the IT due diligence process work?

1. Scope it after the letter of intent. Agree the deadline, the stage of the deal and what access the seller allows. A document-only review and a hands-on technical assessment have different limits, and both sides should know which one is running.
2. Send the document request. The list in the next section, through a secure sharing method rather than email attachments.
3. Interview the people who run IT. The seller's IT person or outside provider usually knows where the undocumented problems are.
4. Verify a sample. Review the Microsoft 365 or Google tenant, check a handful of devices, and run external checks, with written permission for anything that touches the network.
5. Write the findings. Each finding gets its source, business impact, a recommended next step and a cost estimate with its assumptions stated, kept separate from open questions the seller hasn't answered.
6. Negotiate with it. Price the red flags, or move them into representations, warranties and a holdback with your attorney.
7. Plan day one. Turn the findings into the first-30-days list further down this page.

Why IT due diligence gets skipped

Time, mostly. In a Forescout survey of 2,779 IT and business decision makers, only 36% strongly agreed their IT team got adequate time to review a target's cybersecurity standards. The same study found 53% had hit a cybersecurity issue during a deal serious enough to jeopardize it.

The other reason is that IT feels like a post-close problem. It isn't.

A survey of 250 M&A professionals published in 2019 by (ISC)² found 57% had seen an acquirer surprised by an unreported data breach. Nearly half, 49%, had watched a deal collapse because of it. Notably for smaller buyers, 47% of those respondents worked at companies with 250 employees or fewer.

Both are vendor and trade-body surveys, and both are dated now. The underlying incentive isn't: sellers still don't volunteer breach history.

What should you ask for before you sign?

Put these in the document request. A seller who can't produce them is telling you something.

1. A current asset inventory: servers, endpoints, network gear, with OS versions.
2. A list of every admin account and who holds it.
3. Microsoft 365 or Google Workspace tenant details: license counts, MFA coverage, conditional access policies.
4. Backup configuration and the date of the last successful test restore.
5. Every software and SaaS contract, with renewal and termination terms.
6. The current MSP or IT vendor agreement, including notice period.
7. Any cyber insurance policy and the application they filled out. The application is often more revealing than the policy.
8. A written statement of any known security incident in the last three years.
9. Cabling, ISP, and phone contracts tied to the physical location.

Then verify a sample of it independently. A security assessment run against the seller's environment, with their permission, finds what the questionnaire misses.

The five red flags that should change your price

Five findings belong in the negotiation, not in your first-week to-do list:

• Unlicensed software. A direct liability. A vendor audit after close lands on you, not the seller.
• Unsupported operating systems. A hardware refresh you haven't budgeted for, due immediately. As of October 2026, Windows 10 has been out of support since October 14, 2025, and Windows Server 2016 leaves extended support on January 12, 2027.
• No MFA on email at a business that wires money. Assume you're inheriting an active business email compromise until you've proven otherwise.
• Backups nobody has restored from. Those aren't backups. They're a folder.
• An MSP contract with a twelve-month notice period. You'll pay two providers for a year.

Price these. Don't absorb them.

What goes in an IT due diligence report?

The report is what you take into the negotiation, so it should be short and specific. A workable template:

• Summary. The findings that affect price or closing conditions, on one page.
• Technology inventory. Systems, applications, vendors and who controls each one.
• Risk register. Each finding ranked, with its source, business impact and recommended next step.
• Evidence gaps. What you asked for and didn't receive, which is a finding in its own right.
• Cost estimates. One-time remediation and recurring costs, each with its assumptions stated.
• Integration worklist. Day-one access and support, then the Microsoft 365, network and application work in order.

Your first 30 days after closing

Assume the seller's credentials are compromised until proven otherwise, and work in this order:

• Reset every administrative credential and revoke the departing owner's access on day one.
• Enforce MFA across the acquired tenant before you connect anything to yours.
• Inventory what's actually on the network, not what the spreadsheet said. Forescout found 53% of IT decision makers discovered unaccounted devices after integration was complete.
• Get endpoint detection onto every machine you just acquired.
• Keep the two networks separate until you've done all of the above.

Rushing the connection is how one company's problem becomes both companies' problem.

Only then start the real integration work: email, file shares, identity. Our guide to what drives Microsoft 365 migration cost covers the budget, and our tenant-to-tenant migration FAQ covers merging two Microsoft 365 tenants.

Who should run IT due diligence?

Not your deal attorney, and not the seller's IT person. You want an independent technical read from someone who'll still be there to fix what they find.

For most small acquisitions that's a virtual CIO engagement scoped to the deal: a week or two of review, a written findings memo, and a cost estimate for remediation and integration. The NetSys Group runs these for buyers on site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, Connecticut, and remotely everywhere else. Our IT due diligence service page sets out the scope and deliverables.

Set against a purchase price, it's a rounding error. Set against inheriting someone else's breach, it's the cheapest line item in the deal.

Frequently asked questions

How long does IT due diligence take?

One to two weeks for a company under 100 employees, in our experience, from document request to findings memo and assuming the seller cooperates. Scanning and interviews take a few days. Waiting on the seller to produce contracts and inventories is what usually stretches it.

Can we do IT due diligence without alerting the seller's staff?

Partly. Document review, contract review, and external footprint checks are quiet. Anything touching the network needs written permission and one person on the seller's side who knows it's happening, which is how most sellers prefer to handle it anyway.

What if the seller refuses to share IT details?

Treat refusal as a finding. If they won't confirm whether MFA is enabled or whether they've had an incident, price the deal as though the answers are bad, or push the risk into representations and warranties with a holdback. Silence on security questions is rarely good news.

Does the seller's cyber insurance transfer to us?

Usually not in a way that helps. Most policies are claims-made and tied to the named insured, and a change of control often ends coverage for anything after close. Assume you need your own policy in force on day one.

Do we need this for an asset purchase rather than a stock purchase?

Yes, though the liability picture differs. In an asset deal you can leave some contracts and legal exposure behind. You still inherit the hardware, the data, the licensing questions, and any malware sitting on the machines you bought.

What does a NetSys IT due diligence review include?

A review of infrastructure, applications, identity and key vendors; domain, tenant and administrator ownership; licenses and support contracts; access controls, endpoint management and backup evidence, including restore tests; and integration dependencies. You receive a technology inventory, a prioritized risk register, a list of evidence gaps and an initial integration worklist. Penetration testing is included only when separately authorized, and legal, financial and regulatory opinions stay with your advisers.

What affects the cost of IT due diligence?

The size of the target's environment (its sites, users, systems and vendors), whether the review is document-only or hands-on, how much access the seller grants, how tight the deadline is, any separately authorized testing, and how far the integration worklist needs to go. We quote a bounded scope once those are known.

Who supports the business after closing?

Day-one support is part of the integration worklist. NetSys can take it on under a separate managed IT agreement, with the help desk staffed seven days a week from 4 a.m. to 11 p.m. Eastern and emergency service 24/7, or hand the findings to your own IT team.

Get the review scoped

Book a call if you have a deal in progress, or one you're considering, and we'll scope an IT and security review against the target and give you a written findings memo you can take into the negotiation.