The first months after closing on a business bring a long list of technology surprises. The list can include an aging server, a firewall nobody has logged into for years, shared passwords, a backup that has never been restored and a software vendor that wants a new contract under the new owner. Every item looks urgent. Infrastructure stabilization for acquired businesses is the discipline of putting those items in the right order, so the business keeps running while risk comes down.
This article complements the first 30 days after an acquisition checklist on our post-close support page. The checklist covers the immediate steps. This article covers how to build and work the backlog that follows.
Stabilization is not modernization. Its goal is a known, controlled and recoverable environment, not a new one. Upgrades and new systems come later, once you understand what you own and the business can absorb change. New owners who start with large projects can create disruption before they have earned employees' confidence or understood how the business really works.
Sort every issue by the question it answers. Work generally flows from the first question to the fourth.
Start with the findings from IT due diligence, then add what the first weeks of ownership reveal. For each item, record:
Keep the backlog in one place that leadership can read. A spreadsheet is enough. The value comes from seeing every item together and deciding deliberately rather than reacting to whatever broke most recently.
Fix first: transferring ownership of accounts and domains, removing access held by former owners and employees who should no longer have it, confirming and testing backups of critical systems, enabling multi-factor authentication on email and remote access, and documenting how to reach every critical vendor.
Fix soon: replacing equipment that is both critical and unsupported, closing unnecessary remote access, standardizing endpoint protection and establishing monitoring.
Plan for later: consolidating applications, redesigning the network, changing phone systems and other improvements that require employee training or significant downtime.
In healthcare settings, resident-safety systems such as nurse call and wander management move up the list regardless of effort. Revisit the order whenever a new risk appears. An urgent finding, such as signs of an existing compromise, moves to the front whatever the plan says.
Employees feel technology changes directly, and a new owner's first changes shape how the rest are received. Tell people what is changing, why and when, before it happens. Avoid scheduling disruptive work during busy periods. Explain new sign-in steps such as multi-factor authentication in plain terms and give people a clear place to get help. Name one point of contact for IT questions during the transition and make sure that person responds. Explain what is not changing, which is often more than people fear, and fix a few small irritants visibly to build goodwill for the larger changes. Long-tenured employees often know where the real problems are, so ask them.
Changing providers in the first weeks adds risk if the current provider holds knowledge that is not written down. In many cases, it is better to secure ownership and documentation first, then evaluate the provider against clear requirements. Judge the provider fairly: can it produce an asset list, a network diagram and a backup report promptly? Were the problems you found the result of neglect, or of an owner who declined recommendations the provider kept making? If the existing provider cannot hand over credentials, explain the environment or meet basic security expectations, a change becomes part of the stabilization plan. When you do switch, plan an overlap and a documented handoff rather than an abrupt cutoff. Our guide to comparing IT service providers lays out a fair way to decide.
Inzo supports searchers, search funds and independent operators after close, and our CEO is a former searcher who bought the company through Entrepreneurship Through Acquisition in 2023. Read more about post-close IT support, or if you have not yet closed, start with IT due diligence.
Secure control of domains, cloud accounts, administrator access and vendor relationships, then confirm that backups of critical systems exist and restore successfully.
It depends on the size of the environment and what diligence found. Our post-close IT support follows a 90-day sequence, with the most urgent control and recovery items handled in the first 30 days.
Usually not before you have secured ownership and documentation. Evaluate the provider against clear requirements once you understand the environment.
It often does, because diligence works with limited access and time. Treat the first months of ownership as extended discovery and expect the backlog to grow.
Sort each item by control, continuity, recovery and security, record its business impact and effort, and work generally in that order while moving any sign of active compromise to the front.