IT Due Diligence Consultant | Denver, CO and Remote
IT Due Diligence Before You Sign
Financial diligence tells you what a company earns. IT due diligence tells you what its systems will cost you after close. I review the target’s technology, security, and vendor commitments, then hand you a plain-English report of what you’re inheriting and what each fix costs.
What I Review
Six areas cover nearly every technology risk in a small-company acquisition.
Infrastructure and Hardware
Servers, network gear, firewalls, and workstations: age, warranty status, and what needs replacing in year one.
Security Posture
Endpoint protection, email security, MFA coverage, admin access, and any history of breaches or ransomware.
Backups and Recovery
Whether backups run, where they land, and whether anyone has tested a restore.
Software and Licensing
Microsoft 365, line-of-business apps, and ERP licenses. I flag unlicensed seats and contracts that won't transfer.
Vendors and Contracts
MSP agreements, SaaS subscriptions, telecom, and auto-renewals, with notice periods and exit costs.
Data and Compliance
Where customer and financial data lives, who can reach it, and any residency or industry rules that apply.
How an Engagement Works
01
Scoping Call
We agree on the deal timeline, what the seller will share, and how deep to go.
02
Discovery
I interview the owner or IT contact, review documents, and inspect systems remotely or on-site.
03
Findings Report
You get a risk register ranked by severity, with cost and effort estimates for each fix.
04
Close and Handoff
I walk your team through the report and can stay on to run the integration.
What the Report Gives You
The report answers three questions. What will break or need replacing in the first 12 months? Which security gaps could turn into a breach or a failed customer audit? And what will it cost to bring the company onto your standards?
Each finding gets a severity rating, a cost range, and a recommendation: fix before close, fix in the first 90 days, or accept the risk. Your deal team can use it to adjust price, write a specific rep or warranty, or plan the first quarter of ownership.
Findings I See Often in Small Companies
- One admin account shared by the owner and an outside IT person
- Backups that stopped running months ago with no alert
- Domains or software accounts registered to a former employee's personal email
- Consumer antivirus on machines that hold customer data
- Business software running on an unsupported server
- No documentation of what the last IT provider set up
IT Due Diligence Checklist
- Network diagram and asset inventory
- Admin accounts and who holds them
- Backup schedule and last successful restore
- Endpoint and email security tools in use
- Software licenses and renewal dates
- Vendor and MSP contracts with exit terms
- Domain registrar and DNS ownership
- Data locations, including personal devices
- Security incidents in the past three years
- Compliance rules: PCI, HIPAA, data residency
Related Case Studies
Cybersecurity Due Diligence in a PE Acquisition
Four and a half years of security work, then a three-week move onto a private equity buyer's systems.
NetSuite WMS for a Post-Merger Parts Distributor
NetSuite, a warehouse system, and label printers working together for tens of thousands of SKUs.
More Services
Common Questions
How long does IT due diligence take?
It depends on the company’s size and how fast the seller grants access. We set a schedule on the scoping call that fits your deal timeline, and I can deliver a first-pass risk summary early if you need it.
Do I need IT due diligence for a small acquisition?
If the company runs on computers, yes. Small companies keep less documentation and fewer controls, so problems hide better. A focused review costs far less than finding a breach or a dead server after close.
Do you need access to the target's systems?
Read-only access helps, but I can start with interviews and documents. I sign an NDA and keep findings confidential to your deal team.
Can you fix what you find?
Yes. After close I can run the remediation and post-acquisition IT integration myself or work beside your IT provider.
Have a Deal in Motion?
Send me the timeline and I’ll tell you what I’d review first.