IT Due Diligence for Acquisitions: The Document Request List

Small business data rooms often say little about technology. Buyers receive financial statements, customer lists and leases, but rarely a record of the systems that run the business, who controls them and what it will cost to keep them working. IT due diligence for acquisitions fills that gap before close, when findings can still shape price, terms and the first months of ownership.

This article gives you the request list to send the seller and the interviews to schedule. For a ready-made version, download Inzo's IT due diligence discovery questionnaire, built for searchers and other business buyers.

Key Takeaways

• Send the IT request list as soon as you have data room access, so findings arrive while price and terms can still change.
• Confirm who owns the domains, the email tenant and every administrator account before anything else.
• Interview the seller, whoever runs IT and the outside provider, because many small sellers have little written down.
• Sort each finding into fix before close, fund in year one or monitor, and give your deal advisers the evidence and an estimated cost.

Why IT due diligence for acquisitions matters

A technology problem found before close can still shape price and terms; found afterward, it becomes the buyer's cost. A server past its end of support, a seller who personally owns the domain name, a former employee who still holds administrator access or backups that have never been tested can each create unplanned cost and disruption in the first weeks of ownership. Diligence does not need to be exhaustive to be useful. It needs to surface the issues that affect value, continuity and risk.

The IT due diligence request list

Ownership and access

• Who owns the domain names, the Microsoft 365 or Google Workspace tenant and key software subscriptions.
• A list of administrator accounts for each major system and who holds them.
• How passwords and credentials are stored.
• Which accounts belong to the seller personally rather than to the business.

Infrastructure and devices

• An inventory of servers, computers, network equipment and phones, with approximate ages.
• Network diagrams for each location, if they exist.
• Internet circuits and carriers at each site.
• Any equipment or operating system past manufacturer end of support. Windows 10, for example, reached end of support on October 14, 2025, and receives security updates after that date only through Microsoft's paid Extended Security Updates program.

Software and licensing

• The applications the business depends on, with vendor, version and support status.
• License counts, renewal dates and whether licenses can transfer to a new owner.
• Custom software or integrations and who maintains them.

Security controls

• Whether multi-factor authentication is enabled, and where.
• Endpoint protection, email filtering and firewall management in place.
• Security incidents in the past several years and how they were handled.
• Cyber insurance policy details and the most recent application, which records the seller's own answers about security controls.

Backup and recovery

• What is backed up, where copies are stored and how often.
• Results of the most recent restore test.
• Any documented recovery plan.

Vendors and contracts

• IT provider, software, telecom and equipment contracts, with term, renewal and termination provisions.
• Change-of-control or assignment clauses that could affect transfer.
• Monthly technology spend by vendor.

People and documentation

• Who handles IT today, internally or externally, and how much of the knowledge is written down.
• Recent IT projects and any planned or deferred upgrades.

Interviews to schedule

Documents tell only part of the story. Schedule short conversations with the seller, whoever handles IT day to day and, where possible, the outside IT provider. Ask what breaks most often, which systems people work around, what the seller has been meaning to replace and what would happen if a key person left. Ask the person who handles IT to walk through a recent outage from start to finish; gaps in the story usually mirror gaps in the environment. Ask the outside provider what it has recommended that the seller chose not to fund, which surfaces deferred maintenance quickly. Department leads who depend on a particular system, and whoever handles insurance renewals, round out the picture.

Many small business sellers will not have all of this assembled, and that is normal. Send the request list early and expect to gather part of it through conversation and discovery.

Findings that deserve a closer look

• Critical systems or accounts controlled by the seller personally or by a departing employee.
• Untested backups or no isolated copy of critical data.
• Core applications or servers past end of support.
• No multi-factor authentication on email and remote access.
• IT provider contracts with long terms, high exit costs or unclear ownership of documentation.
• Undisclosed security incidents.
• Licenses paid for but unused, or software in use without licenses.
• Email, domains or phone systems shared with the seller's other businesses, which need a clean separation plan.
• Specialized systems, such as nurse call in a healthcare target, with no current support arrangement.

Turning IT due diligence findings into deal decisions

Sort findings into three groups: items to fix before close because they block day-one operation, items to fund in the first year, and items to monitor. For each material finding, record the evidence, the business impact, a rough cost range labeled as an estimate and the timing. Share the results with your deal advisers, who can decide whether a finding belongs in price, in transition services, in seller obligations before close or simply in the post-close plan. Missing records warrant further review but do not automatically mean a system must be replaced. Our post-close IT support page shows how findings carry into the first 30 days and the first 90 days after close.

Inzo's CEO is a former searcher who bought the company through Entrepreneurship Through Acquisition in 2023, so we approach diligence from the buyer's side of the table. Start with the ETA hub or download the IT due diligence questionnaire.