IT due diligence is the work of finding out what you are actually buying before you buy it. Not the sales inventory, but the contracts that renew next month, the servers nobody patches, the certifications that do not cover what you think they cover, and the personal data you become responsible for on completion day.
Deals are usually priced on the accounts. The IT estate gets a short questionnaire and a promise that everything is fine. Then the deal completes, someone opens the server room, and the real cost of the acquisition starts to appear.
The ICO is explicit that data sharing has to be considered as part of the due diligence you carry out when taking on an organisation and its obligations. It is not something to sort out afterwards.
What Is IT Due Diligence?
It is a structured review of the target company’s technology before a deal completes. It covers what they own, what they rent, what it costs, what condition it is in, and what legal obligations come with it. The aim is a clear picture of the spending and risk you are taking on.
It is not the same as a technical audit of your own estate. You are working with limited access, limited time and a seller who would rather you moved quickly. That constraint shapes what a useful IT due diligence process looks like: prioritise the things that change the price or stop the deal, and leave the rest for afterwards.
Why Does It Get Skipped?
Because it rarely has an owner. Legal due diligence has lawyers. Financial due diligence has accountants. Technology sits between the two, and on smaller deals it often falls to whoever in the buying business happens to know about computers. That is a lot of responsibility for a side job.
The result is a review that confirms what exists without asking whether it works, what it costs to keep, or what happens to it in two years. Transputec sees this pattern in IT consultancy work: the questions that would have changed the price were answerable before completion, but nobody was asked to ask them.
Buying a Business This Year?
Transputec runs a three-week strategic assessment: stakeholder interviews, a technical audit and a commercial benchmark, ending in a costed roadmap with options and a board pack. The work is outcome-priced rather than hours-priced. Talk to our team about the technical audit work behind an acquisition.
Get a Strategic ConsultationWhat Should an IT Due Diligence Checklist Cover?
Six areas, and the useful version asks for evidence rather than assurances. A seller will tell you the estate is modern and secure. Documents tell you whether that is true. Ask for the items below early, because gathering them takes the seller longer than anyone expects.
| Area | What to ask for |
|---|---|
| Contracts and licences | Every agreement with its renewal date, notice period and any change of control clause |
| Infrastructure | An asset list showing age, support status and end of life dates |
| Identity and email | Tenant details, mailbox numbers and which domains the business actually owns |
| Security | Certifications with their exact scope, the last penetration test, and open findings |
| Data | What personal data exists, where it sits, and the lawful basis for holding it |
| People | Who genuinely runs IT day to day, and whether they are staying after completion |
The last row is the one buyers underrate. In a small business the entire operational knowledge of the estate often lives with one person who has no documentation and no reason to stay.
What Does the Law Require You to Check?
More than most buyers realise, and the obligation lands on you. The ICO’s guidance on due diligence says data sharing must be considered as part of the due diligence you carry out when taking on an organisation and its obligations. Completion does not reset the clock on someone else’s compliance.
The ICO sets out what that means in practice. Establish what data you are transferring. Identify the purposes it was originally collected for. Confirm your lawful basis for holding and sharing it, and whether that basis has changed because of the deal. Seek technical advice before moving data where different systems are involved, and decide when and how you will tell the people the data is about.
There is a post-completion half as well: check the records are accurate and up to date, keep retention consistent, and confirm appropriate security is in place. If the target has been keeping data it has no reason to hold, that becomes your problem on day one.
What Happens to Their Security Certifications?
Less than the certificate suggests. Cyber Essentials is scoped, and the scope is agreed with a certification body before assessment. The requirements document says certification should cover the whole IT infrastructure used to run the business, or a well-defined and separately managed sub-set of it.
So the question is not whether the target holds a certificate. It is what that certificate covers. A business can be certified against a narrow sub-set, and any part of the infrastructure left out has to be justified to the assessor. Ask to see the scope statement rather than the badge.
An acquisition then changes the boundary on both sides. What you now own is a different organisation from the one either certificate describes, so plan for recertification against the combined estate rather than assuming the paperwork carries over. Our guide to the five Cyber Essentials controls covers what the assessment actually tests.
What Are the Costs Nobody Budgets For?
The ones that arrive in the first year, after the deal price is fixed. None of them are dramatic on their own. Together they routinely add up to more than the buyer set aside for integration, because each one was assumed to be somebody else’s line in the model.
- Merging email and files. Microsoft charges a per-user licence for a tenant to tenant migration, and there are no exceptions to it.
- Unsupported kit. Anything past its support date has to be replaced or covered. Exchange Server end of life is a live example that catches businesses right now.
- Contract exits. Duplicate tools across the two businesses cannot always be cancelled when you want, because notice periods and terms run to their own calendar.
- Security remediation. Open findings from the target’s last test do not close themselves, and after completion they are yours.
- Key person cover. If the one person who understands the estate leaves, you are paying someone to rediscover it.
An IT due diligence exercise that surfaces these before signing does not always change the price. It does change who expects to pay.
How Long Does IT Due Diligence Take?
Two to four weeks for a mid-sized business, if the information arrives when you ask for it. The review itself is quick. What sets the timetable is how long the seller takes to produce contracts, asset lists and certification scopes, and that is the part to start first.
Deal timetables rarely allow more, so sequencing matters. Request documents on day one. Spend the first week on contracts and data, because those carry the legal exposure. Use the second week on infrastructure and security, where findings change cost rather than legality. Leave integration planning until you know what you are integrating.
If access is genuinely restricted, say so in writing and record what you could not verify. An honest list of unknowns is more useful to a board than a report that implies everything was checked. Transputec approaches technology due diligence the same way, because a deal timetable rarely allows a complete answer. The same discipline applies when you are assessing any third party.
Your IT Due Diligence Checklist
Work through these before completion.
- Request every contract with its renewal date and notice period, and look for change of control clauses.
- Get an asset list with support status, and mark anything already past its end of life date.
- Ask for certification scope statements, not certificate numbers.
- Map the personal data: what it is, where it sits, and the lawful basis for holding it.
- Identify the key people who actually run the estate, and find out whether they are staying.
- Price the integration separately from the deal, including migration licences, replacement kit and contract exits.
- Write down what you could not verify, and put it in front of the board before signing.
If security findings come out of the review, our cyber security team picks that work up after completion.
Conclusion
IT due diligence is not a technical exercise for its own sake. It is the difference between buying a business and buying a business plus a year of unplanned spending. The findings that matter are rarely exotic: contracts that renew badly, kit that is already unsupported, certificates that cover less than they appear to, and data the target should not still be holding.
The ICO’s position is the useful anchor. Their obligations arrive with the deal, and they arrive whether or not anyone looked. Transputec does this work as part of IT consultancy engagements, and the most valuable output is usually not the report. It is the short list of things the board did not know it was about to own.
FAQs
What Is IT Due Diligence in an Acquisition?
A structured review of the target company’s technology before the deal completes. It covers what they own and rent, what it costs, what condition it is in, and what legal obligations come with it. The aim is to know what you are buying while the price can still change.
How Long Does IT Due Diligence Take?
Usually two to four weeks for a mid-sized business. The analysis is fast. The timetable is set by how quickly the seller produces contracts, asset lists and certification scopes, which is why those requests should go out on the first day rather than the first week.
What Should an IT Due Diligence Checklist Include?
Contracts and licences with renewal dates and change of control clauses, an asset list with support status, identity and email details, certification scopes, a map of personal data with its lawful basis, and an honest view of who actually runs the estate day to day.
Does a Cyber Essentials Certificate Transfer With the Business?
Treat it as covering only what it was scoped to cover. Cyber Essentials is assessed against a scope agreed with a certification body, either the whole IT infrastructure or a well-defined sub-set. After an acquisition the organisation has changed, so plan for recertification of the combined estate.
Who Should Run IT Due Diligence?
Someone whose job it is, rather than whoever in the business knows about computers. It needs a person who can read a contract, judge the condition of an estate and price remediation. Transputec is often brought in for this because the work sits between the legal and financial workstreams.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
