IT Due Diligence Services
The purchase price does not tell you whether the company owns its domain, can restore its data or depends on one unsupported server. Put those questions into a documented technology review before the handover.
The short answer
IT due diligence is the review of a target company's technology, security, licensing and operational dependencies before an acquisition closes. NetSys scopes an evidence-led review of systems, access, licenses, support and recovery arrangements, then identifies integration work and unresolved questions. The review is limited to authorized access and available evidence; legal, financial and regulatory opinions remain with your advisers.
A seller's software list is a starting point. A useful review asks who owns the accounts, which contracts transfer, what the business needs to keep running and where the evidence is missing. The answer can affect the transition plan even when it does not change the deal itself.
Define the transaction stage, deadline and permitted access first. A document-only review and a hands-on technical assessment have different limits. We record those limits, distinguish confirmed findings from questions, and prioritize the issues that could disrupt operations or make integration harder after closing.
Evidence and assumptions stay separate
The proposed deliverable is a technology inventory, a prioritized risk register, a list of evidence gaps and an initial integration worklist. Each material finding should show its source, business impact and recommended next step. Cost and effort estimates state their assumptions; they are not a substitute for vendor quotes or a financial valuation.
Technology due diligence review areas
Systems and ownership
Identify what the acquired business needs and who controls it.
- Infrastructure, applications, identity and key vendor inventory
- Domain, tenant, administrator and support ownership
- License and contract questions for the buyer's legal and procurement advisers
Security and resilience
Review the available evidence behind the security and backup claims.
- Access controls, endpoint management and known support gaps
- Backup scope, restore-test evidence and recovery dependencies
- Prioritized risks, missing evidence and separately scoped testing needs
Licensing and contracts
Find out which software and services actually belong to the business.
- Software licenses and subscriptions: whose name they are in and what they cost
- Microsoft 365 tenant, billing and administrator ownership
- Support and vendor contracts, notice periods and renewal dates
- Transfer questions flagged for the buyer's legal and procurement advisers
Integration planning
Separate closing-day needs from later consolidation projects.
- Day-one access, communications and support responsibilities
- Microsoft 365, network and application integration dependencies
- Sequenced worklist, planning assumptions and ownership of next actions
Deliverables and evidence
Confirmed findings kept apart from questions still open.
- A technology inventory and a prioritized risk register
- Each material finding with its source, business impact and recommended next step
- A list of evidence gaps: what was asked for and not provided
- Cost and effort estimates with their assumptions stated
Know what has been checked and what is still unknown.
Tell us the acquisition deadline, approximate business size and what information the seller can provide. We will define a review scope that fits the available evidence and your decision timeline.
Who does the work: meet the NetSys team on our About page.
- A bounded technical scope agreed with the buyer and authorized stakeholders
- Findings separated from assumptions and inaccessible evidence
- A practical handover and integration worklist tied to operational needs
IT Due Diligence Services FAQs
What is IT due diligence?
IT due diligence is the technology part of checking a business before you buy it: what systems it runs, who controls its accounts and domain, whether its licenses and contracts are in order, whether its data can be restored, which security gaps exist and what integrating it will take. It ends in written findings that separate confirmed facts from open questions, so the buyer and its advisers can act on them.
What is included in an IT due diligence review?
A review of infrastructure, applications, identity and key vendors; domain, tenant and administrator ownership; licenses and support contracts; access controls, endpoint management and backup evidence, including restore tests; and integration dependencies. The deliverables are a technology inventory, a prioritized risk register, a list of evidence gaps and an initial integration worklist. Penetration testing is included only when separately authorized.
How does an IT due diligence engagement start?
With the acquisition deadline, the approximate size of the business and what information the seller can provide. We agree the transaction stage and the access permitted, because a document-only review and a hands-on technical assessment have different limits, then a secure way to share documents. The seller's inventories, license records, network documentation and backup evidence come first.
What affects the cost of IT due diligence?
The size of the target's environment, meaning its sites, users, systems and vendors; whether the review is document-only or hands-on; how much access the seller grants and how tight the deadline is; any separately authorized testing; and how far the integration worklist needs to go. We quote a bounded scope once those are known, and estimates in the report state their assumptions.
Who handles support and escalations during and after the deal?
NetSys engineers do the review and report to the buyer and the stakeholders the buyer authorizes, while legal, financial and regulatory questions go to your advisers. Day-one support after closing is part of the integration worklist; NetSys can take it on under a separate managed IT agreement, with the help desk staffed seven days a week from 4 a.m. to 11 p.m. Eastern time and emergency service 24/7.
When should IT due diligence happen?
Ideally while the buyer can still ask questions and agree transition responsibilities. The specific review depends on the transaction stage, access permissions and deadline. A short document review can identify unanswered questions; a deeper technical assessment needs additional authorization and time.
What information should the seller provide?
Start with system and application inventories, support and license records, network documentation, account-ownership details and backup or restore-test evidence. Agree a secure sharing method before sending documents. Do not put passwords, confidential deal terms or sensitive records into the initial website enquiry.
Does IT due diligence include penetration testing?
Only when testing is separately authorized and explicitly included. Reviewing available security evidence does not prove the absence of vulnerabilities. The free remote external penetration test has its own agreed external scope and does not replace a transaction-wide technical review.
Can you help integrate the business after acquisition?
Integration work can be scoped separately using the review findings: access handover, Microsoft 365 or cloud migration, network changes and support transition. The plan identifies which systems should remain separate, what can move and what needs vendor confirmation first.
Is this a legal or financial due diligence service?
No. NetSys reviews technology and operational dependencies within the agreed scope. Your legal, financial and regulatory advisers evaluate contractual rights, transaction value and legal obligations. Technical findings can inform those advisers without replacing their work.
Guides on this topic
- IT questions to ask when buying a business
- Scope post-acquisition IT implementation separately from pre-deal review
- Plan Microsoft 365 tenant consolidation or separation after a transaction
- Microsoft 365 migration scope
- Support and access handover
- IT audit of your own business
- Security risk assessment, scoped separately
- multi-divisional IT consolidation case study
- IT consulting for Houston businesses
- IT consulting for Long Island businesses
- Portland IT consulting services
Bring the deadline and the questions that affect the deal.
Share the business size, transaction stage and available evidence. We will propose a bounded review and explain its limits before work starts.