IT Due Diligence for Business Acquisitions in St. Louis, Louisville and Nationwide
IT due diligence is a pre-close review of the technology a buyer will inherit: who controls it, what it costs and what could disrupt the business. Send our IT Due Diligence Discovery Questionnaire to the target company, or fill in what you already know. We turn the answers into a written summary of the technology risk in the deal and a 30-day plan for after close. Both are free. We work with buyers in St. Louis and Louisville, and with searchers nationwide.
Already under LOI or post-close? See our post-close IT support for operators.
What IT and cybersecurity risks should a buyer check before acquiring a small business?
Before closing, check who controls the accounts, which systems the business needs to earn revenue, whether it can restore its data, what security incidents remain open, which contracts transfer and what it will cost to keep operating. Start with anything that could keep employees from taking orders, delivering work or making payroll on the first day you own the company.
Who can give you control on closing day?
Ask the seller to show who owns the domain registration, company email, accounting software and phone numbers. For each, record the account owner, the person with administrator access and the recovery contact. Ask for a redacted account record. Keep passwords and recovery codes out of the data room.
Suppose the business pays for its domain, but the owner registered it personally and password resets go to a private inbox. The invoice shows who paid. The registrar’s recovery settings show who can regain control if the password stops working. Agree who will transfer control and when the buyer will verify that a company-controlled account can renew the domain and recover access.
What would stop orders, billing or payroll?
Ask an employee to walk through one order from the customer’s call to the paid invoice. Write down the phone line, application, device and people each step depends on. Ask who supports each one and check support dates against the equipment list. An aging office laptop may be routine replacement spend. A single unsupported workstation that prints every shipping label deserves a continuity plan before closing.
Technology due diligence gives you the facts early enough to act on them. One buyer we worked with learned during diligence that every laptop and PC in the business needed replacement. That was tens of thousands of dollars, and it became part of the price conversation with the seller.
Can the business recover in time?
Choose a system from that walkthrough. Ask the IT provider for its last successful restore record, including what it restored, the date of the recovered data and how long the work took. Check whether a separate copy would survive the loss of the main system. A green backup report tells you the copy job ran. A restore record tells you what the team actually got back.
If payroll must run by Friday morning, compare the recovery time with that deadline. If nobody has tested the payroll files or application, record recovery time as unknown. Agree with the seller on an authorized test or a workable fallback before relying on those backups.
What security exposure would you inherit?
Ask for a dated summary showing where multifactor authentication is enforced, especially on email, remote access and administrator accounts. Compare the user list with recent departures and the endpoint protection report with the device inventory. A former employee who still has mailbox access calls for an owner and a removal date. A device absent from the report needs an explanation.
Ask for a redacted incident history and evidence that corrective work was completed. If the business holds customer, employee or patient information, identify where it lives and who can access it. Bring unresolved incidents, customer commitments and questions about cyber insurance continuity to counsel and the insurance broker before close.
Which costs and contracts follow the buyer?
Match recent invoices to the contracts for software, phone service, internet and outside IT support. Check renewal dates, notice periods and who owns the licenses. For an application that runs dispatch or billing, ask the vendor to confirm in writing whether the buyer can use it on closing day and what transfer or setup will cost.
Separate monthly operating costs from one-time costs for replacement, migration or temporary support. Ask for a dated quote on material items. If only the seller knows how to run a critical process, put the handover session and the person taking over on the same schedule as any vendor transfer.
What should change before you close?
For each material finding, write down the evidence, what work could stop, who owns the next step, when it is due and any estimated cost. Give your deal team the items that could interrupt day-one operations while there is time to agree on a fix or transition support. Put a supported system due for replacement next year in the operating budget. Keep missing evidence open with a named person and a date to resolve it.
Inzo’s IT Due Diligence Questionnaire at inzotechnologies.com gives the seller or its IT provider a place to start. You can return partial answers. Inzo reviews them at no charge and provides a written, prioritized technology-risk report and a 30-day post-close plan. Get the questionnaire · See the seller document request list
For a Louisville acquisition, our Louisville IT due diligence FAQ covers seller documents, technology risks, review costs, and what happens after the review.
What IT due diligence surfaces before close
Current-state Environment
See what the business actually depends on today.
Document the basics of the environment, including sites, users, connectivity, hardware, cloud or virtualization choices, software, networking, voice, directory, email, and business-critical dependencies.
Resilience and Support Gaps
Find where continuity may be weaker than it looks.
Understand backup approach, offsite backup, firewalls, VPN usage, MDM, antivirus, spam filtering, DR planning, and whether the business has policies and documentation in place.
Near-term Cost Drivers
Spot what may turn into spend soon after close.
Spot where replacement, standardization, licensing cleanup, roadmap work, or vendor changes may be needed soon after close.
What the IT due diligence questionnaire covers
The questionnaire is a full technology review, not only a security review. It covers cybersecurity exposure and everything the business runs on day to day, because both create cost for a new owner. It works through the environment category by category:
- sites, users, and connectivity
- server and end-user hardware
- virtualization and cloud services
- proprietary software and platform requirements
- antivirus, spam filtering, and MDM
- storage, backup tools, backup targets, and offsite backup
- networking, firewalls, wireless, VPN, topology, and VLANs
- phone and communications setup
- Active Directory and group policy
- Microsoft 365, Exchange, DNS, and mailbox environment
- business dependencies such as compliance, employee IT policy, disaster recovery, and roadmap
IT and cybersecurity due diligence for every kind of buyer
The same review works whether you are a searcher buying your first company, a private equity firm adding a platform or add-on, an independent sponsor, or a business acquiring a competitor. The questions don't change much. What changes is how much weight each finding carries in the deal.
- Searchers and first-time owners. You need to know what you're inheriting and what the first year of technology will cost, because nobody on the seller's side will tell you.
- Private equity and independent sponsors. You need findings you can price into the deal or the hold plan: end-of-life hardware, unsupported software, backup gaps, licensing exposure, and security weaknesses that will cost money in the first 100 days.
- Corporate acquirers. You need to know how hard the target will be to bring onto your systems, and what has to be fixed before you connect the two networks.
- Healthcare practice acquisitions. Patient data raises the stakes. The review covers how protected health information is stored and backed up, who has access, and whether the practice's systems and vendors would hold up to HIPAA scrutiny after close.
We work with buyers in St. Louis and Louisville and with searchers nationwide. Every buyer gets the same thing back, free: a written report that ranks what needs attention before close against what can wait, with cost drivers alongside the risks, plus a 30-day plan for the first month of ownership.
What happens after close
Findings don't stop mattering when the deal closes. Inzo can stabilize the environment after close and run IT and security from there, including the fixes the diligence report flagged. See post-close IT support.
Why that matters in diligence
You inherit the architecture decisions, the vendor contracts, the aging equipment, the backup practices, and the licensing choices. Gather those facts early enough to act on them.
Get the IT Due Diligence Discovery Questionnaire
Send the questionnaire to the target company or the seller's IT provider, fill in whatever you already know, and send us the answers.
We map those answers into a written report on the technology risk factors in the deal, ranked so you can see what matters now against what can wait. Some of what surfaces is cost savings rather than risk. You also get a 30-day plan for the period right after close.
Buyers can use the output several ways. Some take significant findings into price discussions with the seller. Others use it to budget the first year accurately. There is no cost for any of it.
What search fund buyers need to know about IT before close
Infrastructure Condition
How many servers exist, what platform they run on, how old they are, whether hardware will need replacement, and how standardized the environment really is.
Cloud & Software Dependencies
Which applications and cloud services are in use, what versions they run, which vendors support them, and whether there are proprietary or operational dependencies that need to be maintained.
Backup & Network Resilience
How backup is handled, whether offsite protection exists, what firewalls and VPN practices are in place, and whether the network is documented and segmented.
Business & Governance Risk
Whether the business has compliance requirements, retention policies, employee IT policies, a disaster recovery plan, and any current technology roadmap.
Hear the ETA perspective behind this questionnaire
Nick joins Ryan Condie on Let's Buy a Business to walk through the cybersecurity problems buyers find in diligence and inherit after close.
Frequently Asked Questions
IT due diligence is the process of reviewing a target company's technology environment before an acquisition closes. It establishes what the business runs on, where the environment is weak, and what technology spend the buyer should expect in the first year of ownership. It covers infrastructure, software, networking, communications, Microsoft 365, backup, and security.
Our IT Due Diligence Discovery Questionnaire is that tool. It works through the target environment category by category, covering sites and users, hardware, cloud services, line-of-business software, storage and backup, networking, phone systems, directory and Microsoft 365, and governance items like compliance requirements, data retention, employee IT policy, and disaster recovery planning. We structured it as a questionnaire because the practical use is handing it to the seller or the seller's IT provider and getting answers back.
Most buyers send it directly to the seller or the seller's IT provider and fill in whatever they already know themselves. Either approach works. Partial answers are still useful, and a question the seller cannot answer is itself a finding worth noting.
A written report mapping the answers to the technology risk factors in the deal, ranked so you can separate what needs attention now from what can wait. It includes cost drivers as well as risks, and a 30-day plan for the period right after close. There is no charge.
Common findings include aging servers and end-of-life firewalls, inconsistent hardware standards, undocumented networks, backups that have never been restore-tested, shared or reused administrator credentials, Microsoft licensing shared across multiple people, and missing disaster recovery planning. We have found business passwords stored in an employee's personal Gmail account and, in another deal, written on paper in the break room. Each of these becomes post-close cost or cleanup if nobody finds it before signing.
The technology environment affects continuity, support burden, future spend, and how quickly the business stabilizes after close. Finding problems before signing gives you options: price them into the deal, plan the first 90 days around them, or walk away. Finding them after close leaves only the third option gone.
Cybersecurity due diligence looks at exposure: identity, endpoints, email, and whether the business could survive an incident. IT due diligence covers that and adds everything the business runs on day to day, including hardware lifecycle, software licensing, vendor contracts, network documentation, and communications. Security gaps create risk you inherit. Infrastructure gaps create spend you did not budget.
Yes. We support searchers, private equity firms and other buyers nationwide, including across the Midwest. Diligence review is remote work, and we place no geographic limit on it. After close, we provide ongoing support from St. Louis and Louisville.
Yes. Private equity firms, independent sponsors and corporate acquirers use the same questionnaire and written report. The report ranks findings by what needs attention before close and what can wait, and it lists the technology costs a buyer should expect in the first year of ownership, so findings can go into the price, the hold plan or the first 100 days. Inzo is headquartered in Chesterfield, Missouri, serves St. Louis and Louisville, and reviews deals anywhere, because diligence is remote work. The review is free.
Establish the IT baseline before you close
Send the questionnaire to your target, get back a written view of the technology risk in the deal, and start the first 30 days with a plan instead of a surprise.