IT Due Diligence: What to Check Before You Buy a Business

December 15th, 2026

Financial diligence gets a full team. Legal diligence gets a checklist and a lawyer. IT often gets a single question near the end of the process: do they have backups? That gap is expensive, because every technology problem in the seller's business becomes the buyer's problem on day one.

IT due diligence is not a hunt for perfect systems. Most small and mid-sized businesses carry some technical debt. The goal is to find out what the debt actually is, what it will cost to fix, and which problems could interrupt operations, expose customer data, or block integration after closing. Those answers belong in the purchase price and the closing documents, not in a surprise invoice six months later.

Why IT Due Diligence Matters

An acquired company's technology can hide liabilities that do not appear on the balance sheet. Servers running unsupported operating systems, software installed beyond its license count, a firewall no one has updated since the previous IT provider left, and a phone system tied to a contract with two years remaining are all real costs. So is a security incident that was never disclosed.

The buyer also inherits risk. If customer records are exposed after closing, the new owner answers for it. If payroll or ordering systems fail during the transition, the new owner owns the outage. If the seller's IT provider controls the domain, the email tenant, or the backup account, the new owner may not have the access needed to run the business.

Good diligence answers three questions:

• What is here? Assets, systems, contracts, data, and people.
• What is broken or risky? Security gaps, unsupported technology, compliance exposure, and single points of failure.
• What will it cost to fix? Remediation, integration, and the first year of operations under new ownership.

What to Request

Ask for evidence, not assurances. A seller who says backups are tested is giving an opinion. A seller who provides the last twelve months of backup logs is giving a fact. The list below covers the areas that most often produce surprises.

Asset Inventory and Documentation

• A current list of servers, workstations, network devices, and mobile devices, with age, warranty status, and location.
• Network diagrams, IP addressing, administrator credentials, and vendor support accounts.
• Documentation for line-of-business applications, including versions, customizations, and the person who supports each one.
• A list of cloud services in use, including the ones purchased outside IT.

If no inventory exists, treat that as the first finding. You cannot secure, budget for, or integrate what nobody has counted.

Network and Infrastructure

• Internet and wide-area circuit contracts, bandwidth, and remaining terms.
• Structured cabling condition, WiFi coverage, and access point age.
• Firewall model, firmware support status, and configuration ownership.
• Remote access methods, VPN equipment, and who holds the credentials.

Aging network hardware is common in businesses that have grown without a technology plan. Replacing access points and firewalls is a predictable cost, but only if it is identified before the price is agreed.

Security Posture and Incident History

• Multi-factor authentication coverage for email, remote access, banking, and administrative accounts.
• Endpoint protection, patch management, and the percentage of devices actually covered.
• Email authentication records, spam filtering, and any recent phishing incidents.
• Known breaches, ransomware events, business email compromise attempts, and the response to each.
• Dark web exposure for company domains and key accounts.
• Cyber insurance coverage, limits, and claims history.

Ask for the last two years of security incidents in writing. A verbal "nothing serious" is not a disclosure. Insurance applications and prior claims can reveal incidents that never appeared in a board report.

Software, Licenses, and Cloud Tenancy

• Ownership of the Microsoft 365 or Google Workspace tenant, the domain registrar, and the DNS account.
• License counts, renewal dates, and whether licenses are transferable at closing.
• Software that is out of support or past end of life, including operating systems and line-of-business applications.
• Any custom software, scripts, or integrations with no documented owner.
• Data processing agreements and terms that restrict moving data to a new owner.

Tenant ownership is one of the most important items on the list. If the seller's IT provider owns the tenant or the domain, the buyer can face a slow and expensive recovery after closing. Confirm ownership before signing, and plan the transfer as a closing condition.

Data, Backups, and Recovery

• Where business data lives, including local servers, cloud applications, and employee devices.
• Backup frequency, retention, locations, and encryption.
• Evidence of a successful restore test, not just a successful backup job.
• Recovery time and recovery point objectives, if they are documented.
• Data that would be difficult or impossible to migrate, such as custom databases or paper records.

A backup that has never been restored is a hope, not a recovery plan. Ask for the most recent test and what was learned from it.

Telecom and Voice

• Carrier contracts, monthly spend, and termination terms.
• Whether the phone system is owned, leased, or provided as a service.
• Number ownership and portability, including toll-free numbers.
• Call recording, voicemail, and contact center integrations that may not transfer.

Voice contracts often carry multi-year terms and early termination fees. A system that looks inexpensive month to month can become a stranded asset if the buyer plans to consolidate vendors.

Contracts and Vendor Agreements

• Every agreement that touches technology: managed services, software subscriptions, cloud hosting, telecom, printing, and security monitoring.
• Change-of-control clauses, assignment restrictions, auto-renewal dates, and termination fees.
• Service levels, credits, and support obligations the buyer will inherit.
• Any contract where the seller is a reseller or the license is registered to a parent company.

Read the termination and assignment language carefully. A contract that cannot be transferred, or that renews automatically thirty days after closing, changes the economics of the deal.

IT Staff and Providers

• Who performs IT work today: internal staff, an outsourced provider, or a mix.
• Key-person dependencies and whether those people are staying after closing.
• Managed service agreements, response times, and the provider's willingness to continue.
• Documentation quality and the location of administrative credentials.

If one person holds every administrator password and has no deputy, the business has a single point of failure. If the seller's IT provider owns the tools and accounts, the buyer may need a transition services agreement to keep operations running while access is rebuilt.

Compliance and Industry Requirements

• Industry rules that apply to the business, such as HIPAA, PCI DSS, CMMC, or state privacy laws.
• Current licenses, audit findings, and remediation plans.
• Customer contracts that require specific security controls or certifications.
• Data residency or retention obligations that affect migration.

California businesses also need to account for the California Consumer Privacy Act and its amendments. If the target handles personal information, confirm what data it holds, where it came from, and whether the buyer can legally continue using it.

Budget and Deferred Projects

• Actual annual IT spend for the last two or three years, including software purchased outside the IT budget.
• Deferred hardware refreshes, upgrades, and security projects.
• Known projects the seller postponed, and why.
• Headcount and contractor costs that will need to be replaced or absorbed.

Deferred projects are a common way for sellers to improve short-term financials. A server refresh that was pushed out two years does not disappear at closing. It becomes the buyer's capital expense.

Integration and Day-One Requirements

• Email, identity, and collaboration platforms on both sides.
• Accounting, payroll, CRM, and operating systems that must be merged or kept separate.
• Customer-facing systems that cannot tolerate downtime during the transition.
• Regulatory or contractual barriers to moving data between organizations.

Integration cost is often larger than remediation cost. Two companies can each run healthy IT environments and still face a difficult merge if their identity, email, and line-of-business systems are incompatible.

Questions That Expose Problems Fast

1. Who owns the domain registrar, DNS, and the Microsoft 365 tenant?
2. When was the last successful restore test, and what was restored?
3. How many administrator accounts exist, and is MFA required on all of them?
4. Has the company had a breach, ransomware event, or wire fraud attempt in the last five years?
5. Which software and operating systems are out of support?
6. Which contracts have change-of-control or assignment clauses?
7. What breaks if the IT manager or the current provider leaves?
8. What is the real annual IT spend, including subscriptions bought with a credit card?

The answers matter less than the evidence behind them. Ask for reports, screenshots, contracts, and invoices that support each response.

How to Run the Process

Start with a lightweight review before the letter of intent if possible. A desktop review of the asset list, contracts, and security posture can reveal issues that should shape the offer. Save the deeper technical work for the exclusivity period, when the seller is more willing to open systems and share documents.

Use an independent adviser. The seller's IT provider has a relationship with the seller and may not be objective about the condition of the environment. An independent technology assessment gives the buyer a plain-language report with findings, risk ratings, and a remediation estimate.

Keep the process proportionate. A ten-person service business does not need the same review as a company with regulated data, multiple locations, or custom software. Focus on the systems that generate revenue, hold customer data, and cannot be down for a day.

Document everything in one place. Findings should be specific enough to become deal terms: a failed backup test, an unsupported firewall, a license shortfall, a contract with a large termination fee. Vague concerns are easy to negotiate away. A repair estimate is not.

Red Flags

• No asset inventory and no network documentation.
• A single administrator with no backup and no documented credentials.
• Unsupported operating systems, servers, or firewalls.
• Backups that have never been tested.
• Software licenses registered to a predecessor, a parent company, or the IT provider.
• Domain or email tenant controlled by an outside vendor.
• Deferred upgrades stretching back several years.
• Security incidents that were handled informally or never documented.
• Custom integrations that no one currently employed understands.

One red flag is not automatically a deal breaker. Several together usually mean the remediation budget is larger than the seller's description suggests.

Turning Findings Into Deal Terms

IT findings should change the contract, not just the conversation. Common mechanisms include:

• Price adjustment for identified remediation and integration costs.
• Escrow or holdback released when specified fixes are completed.
• Transition services agreement that keeps the seller's IT provider or staff available for a defined period.
• Representations and warranties about security incidents, license compliance, and contract assignability.
• Closing conditions for tenant ownership, domain transfer, and access to administrative accounts.
• A written 100-day plan with owners, dates, and a budget.

Do not accept a promise to fix critical issues after closing without money set aside to enforce it. Once the deal closes, the buyer has far less leverage.

Day One and the First 100 Days

The first day is about control, not transformation. Confirm ownership of domains, tenants, and administrative accounts. Rotate credentials that the seller or departing staff controlled. Verify that backups run and that at least one restore works. Confirm the security basics on every device and account that touches customer data or money.

Then move to stabilization: patch critical systems, close the highest-risk findings, document what was inherited, and build an integration plan with realistic dates. Resist the urge to migrate everything at once. A controlled sequence protects revenue systems and gives the new team time to learn how the business actually runs.

This is also the point to decide what the IT operating model will be after closing. Some buyers absorb the target into an existing managed IT services program. Others need an interim outsourced CTO to set direction while the permanent team is built. Either way, the decision should be made before closing, not discovered during the first outage.

Make IT Part of the Deal

IT due diligence is an investment in knowing what you are buying. The findings protect the purchase price, the closing documents, and the first year of operations. They also give the new owner a credible plan for IT support, cybersecurity, and cloud migration instead of a list of surprises.

ATS Communications performs technology assessments for buyers and sellers across Northern California. We review infrastructure, security, contracts, and integration risk, then translate the findings into a remediation budget and a day-one plan. Contact us before your next acquisition to schedule an assessment.

Tags: IT due diligence, IT assessment, mergers and acquisitions, cybersecurity

Posted in: IT Support