The short version:

• Client: Two sister engineering firms, one in the US and one in Canada (anonymized), serving industrial clients
• Engagement: Seven years and counting of outsourced IT support and security
• Scope: Email security, cloud storage, remote and in-person helpdesk, phone systems, hardware
• Status: Both firms are now being acquired, primarily for their engineering talent. I still run their security today.

Two firms, one border between them

These two companies came to me about seven years ago. Sister firms, shared ownership, one operating in the US and one in Canada, both doing engineering work for industrial clients. Neither one had internal IT, and neither one needed a big MSP contract with a 40-page SLA. They needed someone who picked up the phone.

That’s been the shape of the whole relationship. I handle their email security, their cloud storage, and their day-to-day support, remote when that works and in person when it doesn’t. Over the years the scope grew the way it does with small firms: I’ve run their phone system migrations, built their workstations by hand when off-the-shelf machines didn’t fit the budget, and made a hundred small calls about where to spend money and where to hold off. IT support for small business lives in those decisions. The stack matters less than the judgment behind it.

The customer security test

A few years in, one of their major industrial customers raised the stakes. Before awarding project work, the customer required compliance with its corporate IT security policy and information security program. Buried in the requirements was a hard one: all project data had to stay in Canada.

That’s a data residency requirement, and it’s the kind of thing that quietly kills deals for small vendors. The engineering team just wanted to work. The customer wanted proof their data wouldn’t drift onto US servers. My job was to close that gap without blowing up the budget or the workflow.

I laid out three options with real time and cost estimates: client-side encryption with Canadian-held keys on their existing cloud storage, a locally encrypted vault, or a move to a Canadian-hosted cloud platform. They picked the Canadian platform. I ran the migration, kept the working copies flowing for the engineer who needed them daily, and mapped the setup against the customer’s security policy documents so the answers were ready before anyone asked.

Small firms lose big customers over vendor security assessments they can’t answer. This one kept theirs.

Then the acquisition came

Both firms are now being acquired by a larger company, and the deal is mostly about people. The acquirer wants the engineers. That’s the whole thesis.

Talent deals move slowly, and this one has. Which makes the IT story simple to state and hard to fake: through the entire drawn-out process, the engineers have kept working, the systems have stayed up, and the security stack has kept running. Seven years in, the incident count is still zero. Nobody on the buyer’s side has had to ask why the target’s email got breached or where the customer data lives, because those answers were settled years ago.

I’m not running this deal, and this case study isn’t about deal work. It’s about the thing that makes deal work easy: an acquirer doing diligence on these firms finds documented systems, a customer-vetted security posture, and a support relationship that didn’t wobble when ownership went into limbo.

What seven years buys

Here’s the honest math on long-term outsourced IT support. Any provider can look good for six months. The value shows up in year three when a customer’s security team comes knocking, and in year seven when a buyer does, and both times the answers are already written down.

These two firms got acquired for their talent. The reason talent was the only thing under negotiation, rather than talent minus a pile of IT risk, is seven years of unglamorous maintenance: patched systems, secured email, data where the contracts say it should be.

If your customers are bigger than you

Industrial customers push their security requirements downstream, and acquirers read your environment like a balance sheet. Both happen on their schedule, not yours. The firms that come through clean are the ones that treated security as routine long before anyone was checking.

If you’re staring down a customer’s vendor security assessment, a data residency requirement, or a sale where your IT needs to hold up to inspection, that’s the work I do.

Facing a security review you’re not sure you’d pass? Get in touch.

How 4.5 years of security work turned a single-location self-storage company into a clean acquisition target, and what a three-week technology handoff looks like when the buyer runs 50+ facilities.

The short version:

• Client: Single-location self-storage operator in Colorado (anonymized)
• Buyer: Private equity-backed storage operator with 50+ facilities
• My role: IT and security provider for 4.5 years, then transition lead on the seller side
• Handoff: Three weeks, kickoff to done

It started with a breach

They found me the way a lot of my clients do: mid-incident. Their previous IT provider had gone defunct, and the provider’s abandoned website was serving malware. Someone at the storage company opened that site looking for support and infected their machine instead.

I took the call, cleaned the infection, recovered their systems, and combed through everything for leftover malicious code. Then I rebuilt their stack so it wouldn’t happen twice: antivirus, EDR through Huntress, cloud backup, and same-day helpdesk, remote and onsite. All of it sized and priced for a single-location business.

Four and a half years of quiet

For the next 4.5 years I ran their IT and security. Webroot and Huntress covered the endpoints. Backups ran to the cloud and got checked. When something broke, I fixed it the same day. No repeat incidents, no drama.

That stretch of quiet matters more than it sounds. When a buyer showed up years later, the company had a documented, monitored environment with a real security history behind it. Most small businesses walk into a sale with none of that.

Then a buyer showed up

A private equity-backed storage operator with 50+ facilities acquired the company. Deals like this live or die in diligence, and the buyer’s team had two questions about IT: is this environment secure, and is it cost-effective?

That’s technology due diligence in one sentence. Buyers want proof, and on small acquisitions they rarely get it, because the seller’s IT knowledge lives in one person’s head or a defunct vendor’s filing cabinet. Here, I had run the environment for years and could answer with documentation instead of guesses. That alone shortened the timeline.

The three-week handoff

Post merger IT integration for this deal came down to four workstreams.

RMM migration. The buyer standardized every acquisition onto their own remote management platform. Instead of touching each machine by hand, I wrote a script that deployed their agent and removed mine (ConnectWise Automate, at the time) across all systems in one pass.

Backup migration. I moved their cloud backups off my platform and onto the buyer’s, and verified restore points on both ends before cutting over. A migration without verified restores is a gamble, and nobody gambles during a closing.

Access control. The buyer’s team ran the access control migration themselves. I supported from the client side, kept credentials flowing, and made sure nothing on our end held them up.

Data cleanup and destruction. The buyer’s compliance requirements meant old data had to go, and go for real. I purged stale records the business no longer needed, then dealt with the retired hard drives that held customer data: a seven-pass wipe on each drive, and then I opened them up and pulled the platters out. Nobody is recovering that data. The platters make decent coasters, if you’re wondering.

Secure data destruction is the step small-business acquisitions skip most, and it’s the one that turns into a lawsuit years later when a drive full of customer records surfaces at a pawn shop.

Total time, including the buyer’s inspection and the back-and-forth between their team and my client: three weeks.

The result

The buyer got what diligence teams almost never get from a small acquisition: a documented environment, a working security stack, verified backups, and proof that legacy customer data was destroyed instead of forgotten in a closet. My client walked into closing without IT sitting on the deal as an open issue.

And the whole thing traced back to a malware infection five years earlier. The same work that saved them from a breach made them a cleaner company to buy.

Why this matters if you’re buying or selling

Most small businesses run on undocumented IT held together by whoever set it up. In an acquisition, undocumented becomes risk, and risk becomes a price reduction or a delayed close. Buyers now run cybersecurity due diligence on deals of every size, and sellers who can’t answer basic questions about their environment pay for it at the negotiating table.

If you’re a buyer, a searcher, or an owner planning an exit, the cheapest time to fix your technology story is before diligence starts. That’s the work I do: assess the stack, close the gaps, and run the handoff so the deal keeps moving.

Working a deal and want a second set of eyes on the technology? Get in touch.