Infrastructure & Architecture

Start by understanding the foundation supporting the target organization's technology environment.

• Is there a complete inventory of servers, endpoints, and network infrastructure?
• How old is the infrastructure?
• Are any systems approaching or past end of support?
• What workloads are on-premises versus cloud-based?
• How is the network designed and documented?
• Are there capacity or scalability concerns?
• Are hardware refresh cycles documented and budgeted?
• Are there single points of failure?
• Will significant infrastructure investments be required after close?

The objective is to identify aging technology, supportability issues, and potential capital investments that may otherwise become post-acquisition surprises.

Cybersecurity & Risk

An acquisition can also mean acquiring another organization's cybersecurity risk.

• What cybersecurity tools and controls are currently in place?
• Is multifactor authentication deployed?
• How are privileged accounts managed?
• Are endpoints centrally managed and protected?
• How frequently are systems patched?
• Are vulnerability assessments or penetration tests performed?
• Have there been previous cybersecurity incidents or data breaches?
• How are backups protected?
• Has disaster recovery been tested?
• Are employees receiving security awareness training?
• Are security policies documented and enforced?
• Are third-party cybersecurity risks being evaluated?

A security weakness discovered before closing can be planned for. One discovered afterward may immediately become the acquiring organization's problem.

Applications & Data

Most organizations depend on a collection of business applications, cloud services, databases, and integrations.

• What applications are considered business-critical?
• Who owns and supports each application?
• Are any applications legacy, unsupported, or highly customized?
• What SaaS platforms are in use?
• Where is critical business data stored?
• How is sensitive information protected?
• What integrations exist between applications?
• Are integrations documented?
• Are there custom applications or databases?
• Can data be migrated or exported if necessary?
• Are there redundant applications that could be consolidated?

Vendors, Contracts & Software Licensing

Technology contracts can create both financial and operational surprises during an acquisition.

• Is there a complete list of technology vendors?
• What contracts are currently in place?
• When do those contracts renew?
• Are there early termination provisions?
• Do contracts contain change-of-control provisions?
• Are software licenses transferable?
• Is the organization properly licensed for the software it uses?
• Are subscriptions associated with individual employees?
• Are there significant vendor dependencies?
• Are any technology vendors providing mission-critical services?
• Could vendor consolidation create savings?

IT Operations & Organization

Technology risk isn't limited to hardware and software. People and processes matter too.

• Who manages the organization's technology?
• Is IT handled internally, outsourced, or both?
• Are roles and responsibilities clearly defined?
• Is there significant dependence on one employee?
• Are administrative credentials properly documented and controlled?
• Is there a formal help desk or support process?
• Are IT policies documented?
• Are technology assets inventoried?
• Are changes to systems formally managed?
• Are recurring IT tasks dependent on manual processes?
• What managed service providers or consultants are involved?
• Will key technology personnel need to be retained after close?

Compliance & Governance

The target organization's technology environment may also carry regulatory, contractual, and governance obligations.

• What regulatory or industry requirements apply?
• Are security and technology policies documented?
• How is access to sensitive systems approved and reviewed?
• How is sensitive data classified and protected?
• Are data retention policies established?
• Are third-party vendors assessed for risk?
• Are audit findings or compliance gaps outstanding?
• Is cybersecurity governance formally assigned?
• Are there contractual security requirements with customers or partners?
• Are there unresolved technology-related compliance issues?

Technical Debt

Technical debt can become one of the most expensive technology liabilities inherited through an acquisition.

• Are operating systems and applications currently supported?
• Have upgrades been repeatedly deferred?
• Are there outdated or obsolete platforms?
• Are there undocumented customizations?
• Are manual workarounds required to keep critical processes functioning?
• Is technical documentation current?
• Are there systems requiring near-term replacement?
• What investment would be required to modernize the environment?

The important question isn't simply "Does it work?" It's "What will it cost to keep it working, secure it, and integrate it?"

Integration Readiness

Due diligence should also look forward. Understanding how difficult the target environment will be to integrate can help shape Day 1 priorities and the post-close roadmap.

• How will user identities be integrated?
• Can email and collaboration platforms be consolidated?
• Are networks compatible?
• Will security tools need to be replaced or standardized?
• Which business applications should remain?
• Which applications could be consolidated?
• How will data need to be migrated?
• Are there communications or phone systems that need integration?
• What vendor contracts need to be addressed?
• What needs to happen immediately at close?
• What can wait 30, 60, or 90 days?
• What resources and budget will integration require?