STStrategyGuide
IT Due Diligence Checklist for Business Expansion
Acquiring a company, taking over a site or expanding with a partner brings their technology, contracts, risks and data obligations with it. This checklist covers what to review before committing and what to plan for the first months after.
- Published
- Updated
- Reading
- 3 minutes
- Prepared by
- EngineSpire Technologies
Key points
- Inventory systems, contracts and people first; surprises usually hide in licences and undocumented dependencies.
- Assess security posture with evidence: MFA coverage, patching, backups, incidents and vulnerabilities.
- Review personal data holdings and privacy compliance, including past breaches.
- Estimate integration costs realistically, including licence transfers and duplicated systems.
- Plan day-one access and security controls before connecting any networks.
When IT due diligence matters
- Acquisitions and mergers.
- Taking over a business unit, branch network or facility.
- Joint ventures and expansion with local partners.
- Large outsourcing arrangements.
Systems and infrastructure
- An inventory of applications with owners, users and business criticality.
- Servers, cloud accounts, networks, sites and hosting arrangements.
- Hardware and software past or near end of support.
- Architecture diagrams and documentation, or their absence.
- Single points of failure and systems only one person understands.
- Custom software: who wrote it, who maintains it and where the source code is.
Contracts and licences
- Software licences and whether they can be transferred; look for change-of-control clauses.
- SaaS subscriptions, renewal dates and notice periods.
- Telecommunications, outsourcing and managed service contracts, including exit fees.
- Hardware leases and maintenance agreements.
- Ownership of intellectual property in custom software.
- Open-source licence obligations in software products.
Security posture
| Area | Evidence to request |
|---|---|
| Identity | MFA coverage, list of administrator accounts, recent access reviews |
| Devices | Endpoint protection coverage and patch compliance reports |
| Backups | Backup policy and results of the latest restore tests |
| Vulnerabilities | Recent scans or penetration tests and remediation status |
| Incidents | Security incident history, including ransomware and account takeovers |
| Policies and training | Security policies and awareness training records |
| Third parties | Vendors with access and how that access is controlled |
| Monitoring | What is logged, where, and who reviews alerts |
Where the deal is significant, commission an independent assessment, including a check for signs of ongoing compromise, before any network is connected to yours. CISA's Cyber Essentials and the NIST Cybersecurity Framework give useful structures for the questions.
Data protection and compliance
- What personal data is held, where and for what purposes.
- Privacy notices, consent records and data sharing agreements.
- A designated data protection officer and registration with the National Privacy Commission where required.
- Past personal data breaches and whether required notifications were made.
- Transfers of data outside the Philippines.
- Rules from sector regulators that apply to the business.
- Retention practices and legacy data that should have been deleted.
People and organization
- IT team structure, skills and key-person risks.
- Contractors and outsourced functions.
- Processes for changes, incidents and documentation.
- Retention plans for people whose knowledge is critical.
Costs
- Current IT operating costs and where they are recorded.
- Upcoming capital needs, such as hardware refresh or unsupported systems.
- Licence true-up exposure.
- Integration or separation costs.
- Transition service arrangements if the business is being carved out of a larger group.
Integration planning
- Day one: communication channels, access for key staff, emergency contacts and baseline security controls. Do not connect networks yet.
- First months: consolidate identity, apply MFA and endpoint protection, confirm backups, add monitoring, then connect networks with firewall rules between them.
- Longer term: rationalize applications, integrate networks fully and consolidate contracts.
Red flags
- Remote access without MFA.
- Critical processes running on unsupported systems.
- Backups that are missing or have never been restored.
- Undocumented custom software maintained by one person.
- Unlicensed software.
- Breaches that were not properly handled or reported.
- Unclear ownership of data held by third parties.
Common questions
What is the most common IT surprise after an acquisition?
Licensing and contract issues, such as licences that cannot be transferred, change-of-control clauses and costly true-ups, along with undocumented systems that depend on one person.
Should we connect an acquired company's network to ours immediately?
No. Assess its security first, apply baseline controls such as MFA and endpoint protection, check for signs of compromise, and connect in a controlled way with firewall rules between the environments.
Who should perform IT due diligence?
Your IT and security leaders working with legal and finance, often supported by independent specialists who can assess security posture and technical debt objectively within the deal timeline.
Sources and further reading
- [1]Cybersecurity Framework — NIST
- [2]Cyber Essentials — CISA
- [3]Republic Act No. 10173: Data Privacy Act of 2012 — National Privacy Commission
Need this applied to your environment?
We can turn this guide into a scoped assessment of your own sites, systems and constraints.
Keep reading
- STTechnology Planning for a New Office in the PhilippinesA new office needs internet, network, devices, security, phones and meeting rooms ready on day one, planned around building rules, carrier lead times, power reliability and natural hazards. This guide puts the decisions in order.4 min read
- STHow to Write Technology Requirements Vendors Can Price AccuratelyVague requirements produce quotations that cannot be compared and projects that overrun. This guide shows how to describe outcomes, scope, quantities, performance, constraints and acceptance criteria so every vendor prices the same thing.3 min read
- STTotal Cost of Ownership for Enterprise Technology ProjectsThe purchase price is often a minority of what a technology system costs over its life. This guide shows how to build a total cost of ownership model that covers implementation, operations, licences, staff time, risk and exit, and how to compare options fairly.3 min read