IT due diligence before you buy another company
IT due diligence reviews a target company's systems, licenses and contracts before you buy. Group every finding by what it does to the price. Deal structure decides what transfers, and the evidence window is short, because Microsoft Entra ID Free retains only seven days of sign-in logs.
- Deal structure decides what you inherit. Federal rules treat a novation as unnecessary when a stock purchase leaves the contracting party unchanged, and require one when the assets transfer instead.
- The breach evidence window closes before you sign. Microsoft Entra ID Free keeps audit and sign-in logs for seven days, and upgrading the license later recovers nothing that already expired.
- Licenses do not travel with the company. Microsoft tells acquirers to have enough licenses in the target tenant before anyone migrates, so the seat count is a day-one cost, not a saving.
- Price the unpatched estate instead of just noting it. Verizon found exploitation of vulnerabilities is now the most common initial access vector for breaches, at 31 percent.
- Group findings by consequence, not by technology. Deal killers, price cuts, day-one cost, and merely annoying. That grouping is what makes an IT finding usable in a negotiation.
What does IT due diligence cover when you buy a company?
IT due diligence covers four things inside the company you are buying. The asset register, the license position, the contracts, and the security history. Financial and legal diligence are standard on a small acquisition. IT diligence usually is not, so the buyer meets the estate for the first time after closing.
Group every finding by what it does to the price rather than by the technology it sits on. Four buckets carry the whole exercise. Findings that kill the deal, findings that cut the price, findings that become day-one integration cost, and findings that are merely annoying. That grouping is the difference between a report your lawyer can use in a negotiation and a 60-page scan nobody opens.
You inherit everything you do not check. An unpatched estate, a license position that does not transfer, a contract you cannot assign, and occasionally an undisclosed breach that is still running. IBM measures an average of 247 days to identify and contain an active breach across all industries and puts the global average cost of a data breach at USD 4.99 million. A compromise that began nine months before closing is a compromise you now own.
This is a buyer's guide to reading a target company's IT estate, not legal advice. Best IT MSP is an independent directory and not a law firm, so have a lawyer in your state review the actual agreements, the deal structure and any notification duty before you act on a clause. What follows is the checklist you can run yourself or commission, grouped by what each finding does to the number you sign.
Deal structure decides whether you inherit the contracts
Deal structure decides whether the target's contracts come with it. An asset purchase moves named assets, so each contract you want needs the counterparty's consent. A stock purchase buys the company that already holds those contracts, so the contracting party never changes and most agreements continue untouched.
The cleanest public statement of that principle is the rule the US federal government writes for its own purchasing, because it is free to read and it handles both structures in one place. The Anti-Assignment Act prohibits transfer of Government contracts from the contractor to a third party. The buyer's own regulation then recognizes a successor only when in its interest, and only where that interest arises from a transfer of all the contractor's assets, or the entire portion of the assets involved in performing the contract. It names the transactions that qualify, including a sale of these assets with a provision for assuming liabilities and a transfer of these assets incident to a merger or corporate consolidation.
Then comes the sentence worth copying into your own deal checklist. A novation agreement is unnecessary when there is a change in the ownership of a contractor as a result of a stock purchase, where there is no legal change in the contracting party and that party keeps control of the assets and performs the work. Read the two rules together and a practical rule falls out. Buy the shares and the contracts stay where they are. Buy the assets and every contract you need gets re-papered with somebody else's permission.
Consent is a veto, which is why contract assignment belongs in the price rather than in an appendix. Where the federal buyer does not concur in a transfer, the original contractor remains under contractual obligation. The target's largest customer holds that same power over revenue you are about to pay for. So total the revenue sitting behind consents you have not secured, name who signs each one, and find out what they want in exchange before you agree a number.
Read the change of control clause before the termination clause
To test whether a share purchase really is clean, read the change of control clause in every material contract. That clause lets a counterparty terminate or renegotiate when ownership moves, which turns a share sale back into a consent problem on the agreements that carry it. Customer contracts, the premises lease, the lender's facility and the software subscriptions are where it hides. Treat nothing as transferable until somebody has signed.
- List every contract worth more than one month of profit, with its counterparty, term and renewal date.
- Mark which agreements are assignable, which need consent, and which say nothing at all.
- Quote the change of control language verbatim into one column, so your lawyer reads the text rather than your summary.
- Name the person who signs each consent, because a consent with no named signatory is a schedule risk.
- Price the revenue behind unsecured consents, then hold that money back or put it in escrow.
- Ask the seller which single contract they would least like you to read.
The last question works more often than it should. For the exit and assignment mechanics inside your own managed IT agreement, which point the opposite way, read termination for convenience.
Which IT findings kill the deal?
Three IT findings kill a small acquisition outright. An undisclosed breach nobody can scope, a license position that costs more to legalize than the business earns, and a contract that is both the revenue and not assignable.
An undisclosed breach nobody can scope
An undisclosed breach kills a deal because the duty to disclose it does not expire at closing. New York requires any person or business which owns or licenses computerized data which includes private information to disclose a breach in the most expedient time possible and without unreasonable delay, and in any event within thirty days after the breach has been discovered. Health data runs on a longer clock, with individual notice due without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. A firm covered by the FTC Safeguards Rule must tell the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event where the event involves the information of at least 500 consumers.
Which entity owes that notice after closing depends on your structure and your state, and a lawyer decides it. The commercial point holds either way. In a share purchase you buy the business that owns the data, so the clock, the regulator and the notification cost arrive with it. Ask the question in writing, get the answer as a representation in the agreement, and tie an indemnity to it.
A license position that does not survive a head count
A license position kills a deal when legalizing it costs more than the business earns. Microsoft's Enterprise Agreement settles up once a year, and the true-up order reconciles all the qualified devices, users, and processor units added or used by your organization. That order must be received by Microsoft in the period between 60 days and 30 days prior to the anniversary of your agreement, so the correction lands on a date you do not control. Verify seats against entitlements during diligence, not after.
A contract that is the revenue and is not assignable
A single contract can be most of the value, and the clause that moves it may not exist. That is the arithmetic from the section above, applied to the one customer who pays for everything. You also inherit the target's suppliers, which is the quietest of the three findings. Verizon reported breaches involving a third party now accounting for 48 percent of all breaches, with third-party supply chain breaches up 60 percent. So ask which vendors hold administrative access to the target's systems today, and whether any of those agreements is one you cannot assign.
Why the breach evidence window closes before you sign
To find out whether the target has already been breached, pull the sign-in logs in week one, because on a free license the window is seven days wide. Microsoft Entra ID Free retains audit logs and sign-ins for seven days, against 30 days on P1 and P2.
Then read the part that reorders your whole timetable. Microsoft states that log retention changes aren't retroactive, that on upgrading from Free to a premium tier only data still within the free retention period is available, and that data that has already expired can't be recovered unless it was previously archived. You cannot buy your way backwards. Whatever happened in month three of the target's year is gone unless somebody archived it at the time.
Most buyers run IT diligence last, after price and legal, which is exactly when the evidence has aged out. IBM's average of 247 days to identify and contain an active breach is longer than many small deals take from first conversation to completion, so a compromise that started before you made an offer can still be undetected on the day you sign. Request the log export in week one, in writing, and record the date you asked.
The request itself is diagnostic. A target that produces twelve months of sign-in history from a central logging tool has been managed properly. A target that offers seven days has told you its license tier, its log retention and its provider's posture in one answer. Neither reply proves a breach. One of them is a reason to pay for the extended review, priced against the global average cost of a data breach at USD 4.99 million.
The five requests to send in week one
- Request twelve months of administrator sign-in logs, plus the history of conditional access policy changes.
- Request the current identity license tier, because the tier sets how much history exists at all.
- Request the incident log, including anything ever reported to an insurer, a bank or a customer.
- Request the last two vulnerability scan or penetration test reports, with remediation status per finding.
- Request the list of every third party holding administrative access today, with the date each was granted.
A seller who can hand you twelve months of sign-in history has answered a question you did not have to ask. A seller who can hand you seven days has answered a different one.
Which findings cut the price?
Findings cut the price when you can attach a dollar figure and a deadline to them. Technical debt is the main category. An unpatched estate, a missing asset register and an untested backup are all quotable, so they move the number instead of ending the conversation.
Start with the unpatched estate, because it is the route attackers use most. Verizon found exploitation of vulnerabilities is now the most common initial access vector for breaches, at 31 percent, and that only 26 percent of critical vulnerabilities in the CISA Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38 percent the year before. Almost every one of those organizations already owns a patching tool, so owning one proves nothing.
Then price the clock, because exposure is measured in days. The same report puts the median time to fully remediate one of those critical vulnerabilities at 43 days, up from 32 the year before. Six weeks of exposure on an internet-facing system is a number you can write into a schedule. Ask when the firewall and the hypervisor were last patched, and ask for the evidence rather than the assurance.
A missing asset register is the finding that hides every other one, because you cannot price an estate nobody has listed. The FTC Safeguards Rule makes the inventory a named control, requiring a covered firm to identify and manage the data, personnel, devices, systems, and facilities that enable you to achieve business purposes. Ask for the register, then reconcile it against the firewall's device list and the last three months of invoices. Anything on an invoice and absent from the register is a system nobody manages. For the fields a usable one carries, read the IT asset register you can demand from your MSP.
Two more price-cutters deserve a line each. A data inventory nobody maintains makes both breach response and any customer security questionnaire slow and expensive. A backup nobody has restored from is not a backup, it is a receipt. Neither finding is fatal and both are cheap to fix, which is exactly why they belong in the price. Turn each into a contractual commitment the seller funds before closing, or a credit you keep.
Which findings become day-one integration cost?
Day-one integration cost is the work you have to do in the first 90 days whether or not you negotiated for it. Merging identity, moving email, re-licensing users, refreshing unsupported hardware and standing up one service desk all land here, and none of it is optional.
License transferability is the question nobody asks until day one. Microsoft's own guidance for mergers and acquisitions tells you to make sure you have sufficient licenses available in the target tenant before migration, and sets the dependency order, because Teams content depends on Exchange mailboxes. Nobody merges two tenants with a button. So budget the seats, the migration tooling and a coexistence period in which mail routing between tenants has to work in both directions while you migrate people in batches.
The fleet refresh is the most predictable line on the list. Windows 10 reached end of support on October 14, 2025, so every Windows 10 device you inherit is a dated replacement with a known price. Count them during diligence and decide who pays. For the four honest options on each piece of end-of-life software, read end of life software.
A transition services agreement buys you time for that work. In a carve-out or an asset purchase the seller keeps running email, payroll or the ERP for a stated number of months at a stated monthly price, and you migrate underneath it. Price the transition services agreement against your migration plan rather than against the calendar, and make the exit date a date you choose.
One day-one cost is pure risk rather than labor. The announcement that two companies are merging is a gift to anyone running an invoice redirection, because new bank details from a new finance team look normal for a few weeks. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints and $3,046,598,558 in losses in its latest annual report, about $123,005 per complaint. Re-verify every payment instruction by voice for 90 days after the announcement, on a number you already held.
Which findings are merely annoying, and which only look it?
Most IT findings are merely annoying, and listing them is still worth an hour. Four laptop brands, three password managers, a shared folder nobody has structured, no named owner on the phone system. None of it changes the price. All of it becomes your help desk's first hundred tickets, so write it down and staff for it.
Two findings look annoying and are not. The first is key person risk. Where one person holds every administrator password and is not staying past closing, you have a single point of failure with a resignation date on it. Do not delete that account on day one. Microsoft warns that after you delete a user the account remains in a suspended state for 30 days, and that once the window passes the permanent deletion process automatically starts and can't be stopped. Transfer the credentials, document them, and keep the account alive through the handover.
The second is what staff already run outside the estate. Verizon found 45 percent of employees are now regular users of AI on their corporate devices, up from 15 percent the previous year. A target with no policy has a data inventory problem that never appears in a license list, because the tools were never bought. Ask what people actually use, then read when your customer sends you a security questionnaire for how that answer gets scored once somebody else is asking.
What to ask for, and in what order
To run IT due diligence on a small acquisition, work the request list in this order, because the first two items expire and the rest do not.
- Pull the identity logs and the license tier in week one, before anything ages out.
- Confirm the deal structure with your lawyer, because it decides whether contracts transfer or need a novation.
- Inventory every device, system, subscription and third party holding administrative access.
- Reconcile seat counts against entitlements, and diary the date of the next true-up.
- Read the change of control clause in every material contract and mark who signs each consent.
- Quote the replacement cost of unsupported software and hardware as a purchase price adjustment.
- Agree in writing who runs IT on day one, and for how many months.
That last item is the one buyers postpone. Two companies arrive with two providers, two contracts and two sets of credentials, and the default is to keep both for a year and pay twice. Decide early instead, and get a verifiable answer on who holds the keys. Our directory lists 16 ranked managed IT providers in the median market, with 11 at the 25th percentile and 22 at the 75th, measured across 24,491 roster rows in 730 city datasets. We rank on verified rating and firmographic data, we label paid placement, and we do not sell IT services, so that count is a measurement rather than a pitch. If the combined business is now large enough to reopen the hire-or-outsource question, the arithmetic sits in MSP vs hiring IT staff.
IT due diligence does not need a specialist firm on a small deal. It needs four buckets, a request list, and the discipline to ask in week one rather than week nine. Deal killers are rare. Price cuts are common, and almost nobody prices them, which is why the seller usually keeps that money. Ask for the logs first. Everything else is still there next month.
FAQ
What is IT due diligence?
IT due diligence is the pre-purchase review of a target company's systems, licenses, contracts and security history. It answers four questions. What do they own, what are they licensed for, what transfers with the deal, and has anything already gone wrong. IBM puts the global average cost of a data breach at USD 4.99 million, which is why the fourth question matters most.
Do software licenses transfer when you buy a company?
Not automatically. Microsoft's guidance for mergers and acquisitions tells acquirers to make sure you have sufficient licenses available in the target tenant before migration, and an Enterprise Agreement settles the count in an annual true-up order that reconciles all the qualified devices, users, and processor units added or used by your organization. Treat inherited seats as a day-one cost.
Does a contract transfer automatically in an acquisition?
That depends on the deal structure and the clause. Federal rules treat a novation as unnecessary when there is a change in the ownership of a contractor as a result of a stock purchase, but recognize a successor after an asset transfer only when in its interest. Read the change of control clause in every material contract, and have a lawyer confirm your position.
What happens if the company you buy had a breach it never disclosed?
The duty to notify does not disappear at closing. New York requires a business that owns or licenses computerized data which includes private information to disclose a breach within thirty days after the breach has been discovered, and health data carries a 60 calendar day deadline. Which entity owes the notice afterwards is a question for your lawyer.
When should IT due diligence start on a small acquisition?
Week one, because the evidence expires. Microsoft Entra ID Free retains audit logs and sign-ins for seven days, and log retention changes aren't retroactive, so upgrading the license later recovers nothing. Pull the identity logs and the license tier first, then work through contracts, license counts and technical debt.
Best IT MSP is the independent directory of vetted managed IT providers across the US and Canada. Organic ranking is earned on verified rating and firmographic data, paid placement is always labeled, and we do not sell IT services. Open the ranked list for your city, then ask three firms how they would run day one of the combined business.