IT due diligence tells a private equity deal team three things before close: what the target's technology really costs to run, what security risks come with it, and what it will take to integrate or scale. Skipping it doesn't remove those costs. It just moves them into the first year of ownership, where they come out of returns.
This checklist is built from the IT health checks 7 Layer Solutions performs for private equity firms evaluating acquisition targets. Use it to scope pre-close diligence, spot red flags that affect valuation, and plan a smooth Day 1 and first 100 days for your new portfolio company.
A thorough IT health check covers people, process and technology. 7 Layer's assessments review six areas, combining interviews with the target's leadership and IT staff with a review of existing documentation. Most take three to four weeks, depending on how quickly the target can provide information.
1. IT organization
2. IT infrastructure
3. End-user computing
4. Backup, disaster recovery and business continuity
5. Cybersecurity (see the full checklist below)
6. Business applications
The deliverable deal teams need is an executive summary with a maturity score for each area, key strengths, risks and opportunities, and remediation recommendations with estimated one-time and recurring costs.
Cybersecurity gaps are the findings most likely to turn into post-close costs, insurance problems or a breach that hits valuation. Review each control and ask for evidence, not just answers.
|
Control area |
What to verify |
|---|---|
|
Asset inventory |
Hardware and software inventory exists and is managed centrally (RMM) |
|
Vulnerability management |
Regular vulnerability scanning, with findings tracked to closure |
|
Admin privileges |
Users aren't local admins; separate admin accounts; privileged access controlled |
|
Account control |
MFA on email, VPN, cloud apps and admin accounts; strong password policy; access reviews |
|
Malware defenses |
Centrally managed endpoint detection and response (EDR) on every device, with 24/7 monitoring |
|
Logging and monitoring |
Centralized logging (SIEM) or a managed SOC, so incidents can be investigated |
|
Security training |
Regular awareness training and phishing simulations |
|
Penetration testing |
A penetration test or security assessment within the last year |
|
Incident response |
A written, tested incident response plan |
|
Insurance and fraud controls |
Adequate cyber insurance and documented procedures for wire transfers and payments |
|
Third-party access |
Vendor and offshore contractor access limited, monitored and protected with MFA |
Also ask whether the target has had a breach in the last three years and which security framework it follows. "We generally follow NIST" without formal assessments is a common answer, and a gap.
Integration goes fastest when every acquisition is measured against the same standard. Before the next deal, define a baseline IT standard for the platform company, then assess and integrate each new company against it.
The baseline IT standard covers:
Integrating each acquisition: assess, analyze, remediate
Day 1 priorities
First 100 days
The Microsoft 365 tenant integration is usually the change employees notice most, so plan its timing and communicate it clearly.
These are the kinds of findings that show up in real diligence engagements, even at well-run companies. Each one becomes a cost, a delay or a risk after close.
|
Red flag |
Why it matters to the deal |
|---|---|
|
No formal disaster recovery plan, or a DR site with no guaranteed recovery time |
A single outage could halt operations, with no contractual recovery commitment |
|
Backups kept for only a few weeks, or no Microsoft 365 backup |
Data lost to ransomware or user error may be unrecoverable |
|
Long-term hosting or telecom contracts running years past close |
Integration and cost savings are delayed until contracts end |
|
Custom databases or applications tied to software being retired |
Hidden rebuild costs and key-person dependency |
|
No centralized device management or endpoint protection |
Unpatched, unmonitored devices are the most common way attackers get in |
|
No logging, SIEM or SOC |
A breach can't be investigated or its scope proven |
|
No penetration test or vulnerability scanning in the last two years |
Unknown exposure going into ownership |
|
No formal onboarding and offboarding |
Former employees may still have access to sensitive data |
|
Offshore contractors or vendors with broad system access |
Third-party risk that may conflict with compliance or insurance requirements |
|
Microsoft 365 licenses that don't support required security features |
Licensing upgrades needed before key security controls can be deployed |
Good diligence prices these items. A remediation plan with low and high estimates for one-time and recurring costs lets the deal team factor them into valuation, or into the first-year budget.
7 Layer Solutions is a Schaumburg, Illinois-based managed IT services, cybersecurity and advisory firm with a primary focus on private equity firms and their portfolio companies. 7 Layer sits on the advisory board of The Private Equity CFO Group as a trusted advisor on IT and cybersecurity.
Across the deal lifecycle, 7 Layer provides:
With 12+ years in business, 7 Layer employs 75+ full-time, U.S.-based engineers and does not subcontract or white-label its managed IT services, so the same team that performs diligence can support the company after close.
Get an independent view of the target's IT and cybersecurity before you close. 7 Layer's IT health check gives your deal team a maturity scorecard, the risks that matter and a costed remediation plan, typically within three to four weeks.