IT due diligence checklist for mergers and acquisitions

Set materiality and transaction context

Clarify whether the target will integrate, remain independent, or be separated from a parent. Identify deal timeline, access restrictions, critical revenue processes, sensitive data, regulatory obligations, and tolerance for operational interruption.

Agree on materiality with legal, finance, operations, security, and transaction leaders. A minor obsolete application may be material if it controls billing or cannot be transferred.

Build an evidence-based asset picture

Request inventories for users, devices, servers, network equipment, locations, applications, cloud services, domains, certificates, data stores, integrations, and administrative accounts. Identify owners, support status, architecture, criticality, and dependencies.

Reconcile management lists with invoices, directory data, cloud consoles, network information, and interviews. Record unknowns instead of silently assuming completeness.

Review ownership, contracts, and transferability

Confirm that licences, domains, source code, cloud tenants, phone numbers, data, support agreements, and administrative accounts belong to the entity being acquired or can be transferred. Identify change-of-control clauses, minimum terms, renewals, termination fees, and dependencies on the seller.

Map suppliers and subcontractors that access systems or process important data. NCSC supply-chain guidance recommends maintaining an up-to-date picture so cyber risks and due diligence can be managed.

Assess cyber risk and incident history

Review identity controls, privileged access, updates, endpoint protection, email security, backups, logging, vulnerability management, security testing, policies, training, insurance, and incident response. Ask for evidence such as configuration reports and test results.

Review known incidents, claims, notifications, unresolved findings, and indicators of compromise. Define a pre-close response path if a serious issue is discovered.

Evaluate continuity and technical debt

Identify unsupported systems, fragile integrations, single points of failure, undocumented configurations, key-person dependencies, and equipment near end of life. Examine backup restoration evidence and recovery dependencies.

Estimate the cost and sequence to stabilize material risks. Avoid treating deferred maintenance as a generic future IT expense when it is required to operate the acquired business.

Understand data and integration risk

Map sensitive and regulated data, location, retention, access, sharing, and deletion requirements. Determine whether the buyer will combine directories, networks, mail, collaboration, finance, customer systems, or reporting data.

Plan transitional service agreements when systems cannot separate by close. Define service levels, security responsibilities, access, evidence, change controls, cost, and exit dates.

Model cost and Day 1 priorities

Build a cost model for licence changes, contract exits, devices, connectivity, security remediation, migrations, integration, separation, training, and temporary support. Distinguish one-time transaction costs from the future operating run rate.

• Day 1: secure administrative control, monitoring, escalation, and business continuity.
• First 30 days: validate inventory, identities, backups, critical suppliers, and known high risks.
• First 100 days: execute the costed integration, separation, and remediation roadmap.

Report for transaction decisions

Summarize material findings by evidence confidence, business impact, transaction relevance, action, owner, cost range, and timing. Possible responses include price adjustment, indemnity, closing condition, transitional service, insurance discussion, post-close remediation, or explicit risk acceptance with counsel.