An IT due diligence checklist helps acquirers understand the technology, security and compliance risks of a target company before a deal closes, and plan the integration that follows. It covers infrastructure and cloud environments, Microsoft 365 or Google tenants, applications and data, cybersecurity posture and incident history, compliance obligations, licensing and contracts, and the IT team. Findings can influence valuation, deal terms, and the budget and timeline for integration.
Key Takeaways
- Cybersecurity issues discovered after closing become the acquirer’s problem.
- Assess identity, email and endpoint security early, since they drive breach risk.
- Licensing and contract transfers can create unexpected costs.
- Tenant and domain consolidation needs its own plan.
- Plan Day 1 connectivity and access before closing.
The IT Due Diligence Checklist
1. Infrastructure and cloud
- Datacenters, servers, network and end-of-support systems.
- Azure, AWS or GCP subscriptions, spend and architecture.
- Backup and disaster recovery capability and test history.
2. Identity and collaboration
- Active Directory and Microsoft Entra ID structure.
- Microsoft 365 or Google Workspace tenants, domains and data volumes.
- MFA coverage and Conditional Access policies.
3. Applications and data
- Business-critical applications, ownership and support.
- Custom software, source code ownership and technical debt.
- Where sensitive data lives and how it is classified.
4. Cybersecurity posture
- Security policies, controls and recent assessments or penetration tests.
- EDR coverage, patching levels and vulnerability exposure.
- Incident history, breach notifications and cyber insurance claims.
- Third-party and vendor risk.
5. Compliance
- SOC 2, ISO 27001, HIPAA, PCI DSS or other obligations.
- Privacy compliance in relevant jurisdictions (US states, UAE, EU).
- Open audit findings and remediation plans.
6. Licensing and contracts
- Microsoft and other software licenses, transferability and true-up exposure.
- Telecom, hosting and MSP contracts, terms and change-of-control clauses.
7. People and processes
- IT team size, key-person dependencies and outsourced functions.
- Documentation quality and change management.
Risk Rating Summary
| Area | Red flag examples |
|---|---|
| Identity | No MFA, many global admins, shared accounts |
| Endpoints | Unsupported OS, no EDR |
| Data | Unknown locations of sensitive data |
| Backups | No immutable backups, untested restores |
| Compliance | Undisclosed incidents or open regulatory issues |
| Licensing | Under-licensing or non-transferable agreements |
From Due Diligence to Integration
- Day 1: secure connectivity, cross-tenant collaboration, email routing, urgent security fixes.
- First 100 days: identity consolidation, security baselines, licensing alignment.
- Integration: tenant-to-tenant migration or Google Workspace to Microsoft 365, application rationalization and infrastructure consolidation.
Use a Zero Trust roadmap to bring the acquired environment up to your security standard.
How Skytech Enterprise Helps
Our M&A IT integration service performs IT and security due diligence and executes integration, with virtual CISO oversight for organizations in the USA and UAE. Talk to our M&A team.
Frequently Asked Questions
What is IT due diligence?
It is the assessment of a target company’s technology, security, compliance and IT operations to identify risks and costs before a merger or acquisition.
Why is cybersecurity due diligence important?
Undetected compromises, weak controls or past breaches can transfer liability and remediation costs to the acquirer.
When should IT due diligence start?
As early as possible in the deal process, ideally once a letter of intent is signed and data room access is available.
What happens to Microsoft 365 tenants after an acquisition?
They may be kept separate with cross-tenant collaboration, or consolidated through a tenant-to-tenant migration based on integration strategy.
Can licenses transfer to the acquirer?
It depends on the agreements. Some licenses transfer, while others require new purchases or vendor consent.
How long does IT integration take after an acquisition?
Day 1 essentials take days to weeks; full integration commonly takes several months to over a year.