IT Due Diligence Checklist

What is an IT due diligence checklist?

An IT due diligence checklist is a structured list of questions and evidence requests used to assess an organization’s technology environment before a transaction or major decision. A merger or acquisition is the most common driver of this type of analysis, but companies may also engage in IT due diligence as part of the process for selecting a vendor or changing to a new MSP.

The checklist typically walks through infrastructure and applications, cybersecurity posture and incident history, data protection and disaster recovery, compliance obligations, contracts and licensing, IT spend and staffing, and technical debt or end-of-life systems. The goal is to surface risks, hidden costs, and integration obstacles early enough to affect valuation, deal terms, or the post-close integration plan.

What’s included in an IT due diligence checklist?

An IT due diligence checklist typically includes everything that’s required to get a complete picture of the technology environment in question. Here’s what that looks like in terms of high-level categories.

IT due diligence checklist scope

• Security controls — identity and access (MFA, privileged and orphaned accounts), endpoint and email coverage, backup and tested recovery, pen test and vulnerability history
• Insurance and compliance — cyber policy and the accuracy of its application, regulatory posture (HIPAA, PCI, CMMC, SOC 2, state privacy), contractual security obligations to customers
• Data and third parties — data residency, retention, and privacy constraints; vendor and supply-chain system access
• Assets and licensing — full asset inventory, end-of-life and unsupported systems plus refresh backlog, licensing entitlement vs. deployed usage, shadow IT and unsanctioned SaaS
• Contracts and people — vendor contract inventory and renewal calendar, key-person risk and documentation quality, the existing MSP relationship and its termination terms
• Integration scope — identity/directory/email domain consolidation, ERP consolidation or coexistence, EDI systems and integration, network and site connectivity, and for divestitures, carve-out standalone requirements and the TSA

At what point in the M&A process does IT due diligence occur?

IT due diligence typically runs during the confirmatory diligence window, i.e. after a letter of intent or term sheet is signed and exclusivity is in place, but before signing and close. This is when the buyer gets real access to systems, contracts, and staff. Consequently, IT due diligence usually runs in parallel with financial, legal, and commercial diligence over a few weeks.

Some lighter IT screening can happen earlier, at the target-screening or indicative-offer stage, but it’s limited to what’s publicly available or shared in a data room. The timing matters because findings only translate into leverage while the deal is still open. After close, the same findings become costs that the buyer must absorb. Integration planning work often continues between signing and close, once the deal is committed but before day one.

Who owns IT due diligence in the M&A process?

Ownership usually sits with the buyer’s corporate development or deal team. These stakeholders set the scope and timeline as well as determining how findings will translate into deal terms.

That said, the deal team rarely does the technical work themselves. In practice, the acquiring firm’s IT leader (or a PE firm’s operating partner) owns the substance of the IT workstream, often supported by an outside advisor or MSP with M&A experience. This is important, as internal IT teams are typically already at capacity and may not have carve-out or integration expertise.

The legal team handles change-of-control and contractual security obligations, while finance owns the cyber insurance and true-up exposure. The future integration lead should be in the room during diligence so the person who inherits the environment helped scope it. On the sell side, the target’s IT leadership responds to requests, which is itself a signal—how quickly and completely they can produce an asset inventory or restore-test result tells you something about the environment before you read the answer.

How long does IT due diligence take in the M&A process?

Most mid-market IT due diligence runs two to four weeks of active work inside a larger 30–60 day confirmatory diligence window, assuming the target responds promptly and there’s a functioning data room.

Simple environments can compress to a week or ten days. Complexity extends the timeline. Things like multiple sites, on-prem ERP, an EDI integration, regulated data, or a carve-out from a parent company can push the technical workstream to six or eight weeks. In the case of a divestiture, this is because scoping requires reconstructing what the parent company provides invisibly today.

Regardless of the scoped complexity level, most common cause of overrun isn’t analysis time. Rather, it’s response time—waiting on an asset inventory, license entitlements, or access to the incumbent MSP.

One thing to note here: Escalation items typically don’t wait to go through this sequence. An undisclosed incident or a missing restore test should be passed on to the deal team the day it surfaces, as it may influence the financial side of the process.