IT due diligence tells a private equity deal team three things before close: what the target's technology really costs to run, what security risks come with it, and what it will take to integrate or scale. Skipping it doesn't remove those costs. It just moves them into the first year of ownership, where they come out of returns.
This checklist is built from the IT health checks 7 Layer Solutions performs for private equity firms evaluating acquisition targets. Use it to scope pre-close diligence, spot red flags that affect valuation, and plan a smooth Day 1 and first 100 days for your new portfolio company.
Pre-close IT due diligence checklist
A thorough IT health check covers people, process and technology. 7 Layer's assessments review six areas, combining interviews with the target's leadership and IT staff with a review of existing documentation. Most take three to four weeks, depending on how quickly the target can provide information.
1. IT organization
- Who supports IT today: internal staff, outside vendors or one key person?
- Is there a documented IT budget, and how does spend compare to revenue?
- Is there an IT roadmap, or is IT purely reactive?
- Is there a ticketing system and formal onboarding and offboarding process?
2. IT infrastructure
- Network diagrams, firewalls, firmware currency and internet redundancy
- Server and cloud hosting: on-premises, IaaS, SaaS or a mix
- Long-term hosting, telecom or software contracts that limit integration
- Software and server licensing documentation
3. End-user computing
- PC and laptop inventory, age and refresh cycle
- Centralized device management (RMM and MDM) and patching
- Peripherals, mobile devices and leased equipment
4. Backup, disaster recovery and business continuity
- Backup retention, immutability and encryption
- Microsoft 365 backup (often missing)
- Off-site copies in a geographically separate location
- Defined recovery time and recovery point objectives (RTO and RPO), and when DR was last tested
5. Cybersecurity (see the full checklist below)
6. Business applications
- Key applications and who supports them
- On-premises, cloud-hosted or SaaS
- Custom-built applications or databases the business depends on
- Domains, websites and registrar ownership
The deliverable deal teams need is an executive summary with a maturity score for each area, key strengths, risks and opportunities, and remediation recommendations with estimated one-time and recurring costs.
Cybersecurity due diligence checklist
Cybersecurity gaps are the findings most likely to turn into post-close costs, insurance problems or a breach that hits valuation. Review each control and ask for evidence, not just answers.
|
Control area |
What to verify |
|---|---|
|
Asset inventory |
Hardware and software inventory exists and is managed centrally (RMM) |
|
Vulnerability management |
Regular vulnerability scanning, with findings tracked to closure |
|
Admin privileges |
Users aren't local admins; separate admin accounts; privileged access controlled |
|
Account control |
MFA on email, VPN, cloud apps and admin accounts; strong password policy; access reviews |
|
Malware defenses |
Centrally managed endpoint detection and response (EDR) on every device, with 24/7 monitoring |
|
Logging and monitoring |
Centralized logging (SIEM) or a managed SOC, so incidents can be investigated |
|
Security training |
Regular awareness training and phishing simulations |
|
Penetration testing |
A penetration test or security assessment within the last year |
|
Incident response |
A written, tested incident response plan |
|
Insurance and fraud controls |
Adequate cyber insurance and documented procedures for wire transfers and payments |
|
Third-party access |
Vendor and offshore contractor access limited, monitored and protected with MFA |
Also ask whether the target has had a breach in the last three years and which security framework it follows. "We generally follow NIST" without formal assessments is a common answer, and a gap.
Post-close IT integration plan
Integration goes fastest when every acquisition is measured against the same standard. Before the next deal, define a baseline IT standard for the platform company, then assess and integrate each new company against it.
The baseline IT standard covers:
- Network and internet: standardized firewalls, switches and Wi-Fi, with redundant internet
- PCs and business apps: standard device builds, Microsoft Entra ID sign-in, device management and clean onboarding and offboarding
- Cybersecurity: EDR, a managed 24/7 SOC, email security, Microsoft 365 backup, MFA and phishing training, aligned to the NIST framework
- IT support: one help desk, so the portfolio company operates as a single entity
Integrating each acquisition: assess, analyze, remediate
- Assess: Review pre-close diligence or perform an on-site assessment, inventory hardware and interview IT staff.
- Analyze: Decide which systems can stay, then build a timeline and budget to bring the company up to the baseline. Agree on the remediation plan with the platform company's leadership.
- Remediate: Execute the plan, document the environment in an IT runbook and move daily support to the standard help desk.
Day 1 priorities
- Secure admin access and credentials from the outgoing provider or IT staff
- Deploy EDR and 24/7 monitoring on every device
- Confirm backups work, including Microsoft 365
- Plan the Microsoft 365 tenant integration, usually the first major post-close project
First 100 days
- Close critical security gaps from diligence
- Complete the Microsoft 365 tenant migration
- Standardize devices, identity and patching
- Document DR (Disaster Recovery) plans with defined RTO (Recovery Time Objective) and RPO (Recovery Point Objective)
- Start regular reporting to the deal team on security and integration progress
The Microsoft 365 tenant integration is usually the change employees notice most, so plan its timing and communicate it clearly.
IT red flags that change deal value
These are the kinds of findings that show up in real diligence engagements, even at well-run companies. Each one becomes a cost, a delay or a risk after close.
|
Red flag |
Why it matters to the deal |
|---|---|
|
No formal disaster recovery plan, or a DR site with no guaranteed recovery time |
A single outage could halt operations, with no contractual recovery commitment |
|
Backups kept for only a few weeks, or no Microsoft 365 backup |
Data lost to ransomware or user error may be unrecoverable |
|
Long-term hosting or telecom contracts running years past close |
Integration and cost savings are delayed until contracts end |
|
Custom databases or applications tied to software being retired |
Hidden rebuild costs and key-person dependency |
|
No centralized device management or endpoint protection |
Unpatched, unmonitored devices are the most common way attackers get in |
|
No logging, SIEM or SOC |
A breach can't be investigated or its scope proven |
|
No penetration test or vulnerability scanning in the last two years |
Unknown exposure going into ownership |
|
No formal onboarding and offboarding |
Former employees may still have access to sensitive data |
|
Offshore contractors or vendors with broad system access |
Third-party risk that may conflict with compliance or insurance requirements |
|
Microsoft 365 licenses that don't support required security features |
Licensing upgrades needed before key security controls can be deployed |
Good diligence prices these items. A remediation plan with low and high estimates for one-time and recurring costs lets the deal team factor them into valuation, or into the first-year budget.
How 7 Layer Solutions supports private equity firms
7 Layer Solutions is a Schaumburg, Illinois-based managed IT services, cybersecurity and advisory firm with a primary focus on private equity firms and their portfolio companies. 7 Layer sits on the advisory board of The Private Equity CFO Group as a trusted advisor on IT and cybersecurity.
Across the deal lifecycle, 7 Layer provides:
- Pre-close IT diligence: independent IT and cybersecurity health checks with maturity scoring and remediation cost estimates for the deal team
- Post-close remediation: closing critical gaps found in diligence
- Post-close integration and roll-up strategy: baseline IT standards, Microsoft 365 tenant integrations and a repeatable playbook for each new acquisition
- Ongoing support: Level 1–3 help desk, managed 24/7 SOC, 7 Layer incident responders and cybersecurity governance
With 12+ years in business, 7 Layer employs 75+ full-time, U.S.-based engineers and does not subcontract or white-label its managed IT services, so the same team that performs diligence can support the company after close.
Evaluating an acquisition target?
Get an independent view of the target's IT and cybersecurity before you close. 7 Layer's IT health check gives your deal team a maturity scorecard, the risks that matter and a costed remediation plan, typically within three to four weeks.
FAQ
Frequently Asked Questions
How long does IT due diligence take?
A focused IT and cybersecurity health check typically takes three to four weeks. Timing depends mostly on how quickly the target company provides documentation and makes its IT staff available for interviews.
What should a cybersecurity due diligence checklist include?
At minimum: asset inventory, vulnerability management, MFA and access controls, endpoint detection and response, logging and monitoring, security training, penetration testing, incident response, backups and disaster recovery, and third-party access.
What deliverables should a PE deal team expect from IT diligence?
An executive summary with a maturity score for each area, strengths, risks and opportunities, and a prioritized remediation plan with estimated one-time and recurring costs.
How do private equity firms integrate IT after an acquisition?
The most efficient approach is to define a baseline IT standard for the platform company, then assess each acquisition against it, agree on a remediation plan and move the company onto shared support, security and Microsoft 365. The tenant integration is usually the first major post-close project.
Who provides IT due diligence for private equity firms in Chicago?
7 Layer Solutions, based in Schaumburg, Illinois, provides pre-close IT diligence, post-close remediation and integration, and ongoing managed IT and cybersecurity for private equity firms and portfolio companies across the Chicago area and nationwide.
