IT due diligence checklist for private equity firms

Matthew Slason and Leon Hart November 6, 2026

Cybersecurity

Deal team reviewing a printed checklist, laptops and a tablet in a glass-walled conference room

Key takeaways

Use one checklist on every deal, so findings compare from one target to the next.
Ask for evidence, not reassurance: a restore test record, an MFA coverage report, the last insurance application.
For a company with many locations, check each site, not only head office.
End with cost ranges, split one-time and recurring.

How to use this checklist

Start the pre-close review early, ideally before the offer or valuation is set rather than in the last weeks before close. Findings that surface late tend to complicate the whole deal. Found early, they give the deal team a clear view of the costs going in and of any liabilities the buyer could inherit.

A checklist earns its keep when it is used the same way on every deal. Copy it into each deal plan and keep the items in the same order, so findings from one target can be compared with the next and the work can be priced consistently. Many firms are not there yet. In a global Kroll survey of 325 private equity executives, published in February 2026, 29% of smaller firms said cyber due diligence is a standard part of transaction diligence, compared with 81% of larger firms.

Pre-close work also happens with partial access and a short window, so the aim is not a complete picture of the company’s IT. It is a picture clear enough to price the work. We can be as involved as you want, from a document review to a full internal and external review, and it helps a great deal to speak with the target’s IT manager or team.

The sections below walk through each part of the checklist: what it is for and why it matters to the deal. The same lines appear in our one-page checklist PDF, ready to copy into a deal plan.

1. What to ask the target for

Diligence starts with documents. A short, specific request list tends to get better answers than a long generic one, and each item on the list below is there for a reason.

The organization chart, network diagram, site list and asset inventory show what the company actually runs and who can change it, including any outside providers that hold administrator access. They are also where systems past their vendor’s end of support tend to show up. Those systems no longer receive security fixes, and replacing them is usually a cost the buyer will carry.

The contracts show what the buyer inherits along with the company: renewal dates, termination terms and change-of-control clauses that can end or reprice a service once the deal closes. The incident response, continuity and recovery plans, the most recent scan or penetration test, and the incident history show how the company has dealt with problems in practice, which is not always how its policies say it would.

Two items are easy to overlook. The last cyber insurance application is worth reading closely, because the company has already answered a set of security questions for its carrier, and those answers can be checked against what is actually in place. Compliance artifacts and the last full year of IT spend round out the picture, showing what the company owes its customers and regulators and what its IT really costs to run today.

Ask the target for:

An IT organization chart, including who holds administrator rights and which outside providers have access.
A current network diagram and a list of sites, with internet connections and remote access methods.
An asset and application inventory, including anything past its vendor’s end of support.
Contracts with the managed service provider and key technology vendors: term, renewal, termination and change-of-control terms.
Incident response, business continuity and disaster recovery plans, and the date each was last tested.
The most recent vulnerability scan or penetration test, and what was fixed afterward.
The cyber insurance policy and the last application, since the answers given to the carrier are a useful self-assessment.
A description of past security incidents and how each was resolved.
Compliance artifacts that apply: a HIPAA risk analysis, payment card assessments, customer security questionnaires or requests for a SOC 2 report.
IT spend for the last full year, split into one-time and recurring.

2. Checks to confirm or flag

Documents describe what a company says it does; the checks in this section confirm whether it does. The rule of thumb is to ask for evidence rather than reassurance: an MFA coverage report instead of the MFA policy, and a record of a backup restore test instead of the backup schedule. Where the evidence is missing, flag the item and put a price on it. A gap found before close is a cost the deal can account for. Found after close, it becomes a cost the new owner absorbs.

Two lines in this section are not technical at all. Any review of the target’s systems needs explicit permission from all parties first, preferably under a mutual NDA. And questions about change-of-control terms, or about which regulations apply to the company, belong with deal counsel, who can say what they mean for the deal.

Explicit permission from all parties, preferably under a mutual NDA, before any review of the target’s systems.
MFA coverage on email, remote access and admin accounts confirmed or flagged.
Backup restore testing confirmed or flagged.
End-of-support systems listed.
Key-person and provider dependence noted.
Change-of-control and termination terms in IT contracts sent to deal counsel.
Regulations that apply identified.

3. Red flags worth a closer look

Not every finding carries the same weight. Missing multi-factor authentication, backups nobody has ever restored and systems no longer patched by their vendor are the kind of gaps that let a stolen password or a failed server turn into a serious incident. Other findings point to concentration risk, such as one person holding every administrator credential, or to records that do not match reality, such as an insurance application describing controls the company does not actually have.

Many red flags are not a reason to walk away. They are a cost and a timeline to plan for. Common ones:

Multi-factor authentication missing on email, remote access or administrator accounts.
Backups never restore-tested, or deletable by the same administrator account.
Systems past end of support running something the business depends on.
One person, inside or at the provider, holding every administrator credential.
Remote access exposed directly to the internet.
Insurance application answers that do not match what is in place.
A provider contract that auto-renews or ends at a change of control without a handover plan.
An incident history nobody can describe clearly.
Regulated data (health records, card data, controlled defense information, customer financial information) without a current risk analysis.

4. Extra checks for a company with many locations

Clinics, branches, offices and practices each bring their own network, devices and accounts, and many of them rarely see anyone from IT in person. Head office can look well run while a site acquired a year or two earlier is still on its old firewall, its old provider and the former owner’s administrator account.

The checks below are meant to show whether the company’s standard actually reaches every site or stops at head office. When a target runs many sites, add them to the list:

A list of every site with its internet connection, firewall and remote access method.
Whether every site follows the same standard for MFA, patching and backup, or each site does its own thing.
Who holds administrator access at each site, including former owners of acquired practices.
Which sites run systems past end of support.
How the company manages devices at sites it cannot visit often.

How ProSource helps

ProSource is a managed IT, cybersecurity, cloud and compliance provider founded in 2006 by CEO Leon Hart, who still leads the company, with offices in Oviedo, Orlando and Melbourne and clients supported nationwide. We can run the same pre-close review on every deal and hand the deal team a short red-flag memo, each finding ranked and backed by the evidence we saw.

If a deal is coming up, book an introductory call or call 888-948-7767.

Tags: #it due diligence#private equity#venture capital

Frequently Asked Questions

What does it cost?

It depends on the company: the number of sites, users and systems, the deal timeline and what you need to know. It starts with a brief introductory call about your needs, timeline and regulatory requirements. From there, you choose a high-level view or a full pre-close or post-close deep dive, which can include a migration plan and managed services.

How long does a pre-close review take?

It depends on access and size. We discuss your timeline on the introductory call.

Do you replace a company's IT team or current provider?

We offer both fully-managed and co-managed IT services. This means you can use ProSource as an extension of your team (co-managed services) or we can be your entire IT department (fully-managed services). Co-managed support keeps the IT lead in place and adds coverage where the team is thin. Fully-managed IT has ProSource completing virtually all of your IT needs with services like vCISO and compliance-as-a-service available as needed.

Can you test a target company's systems before you invest or acquire?

We review a target's systems, inside or out, only with explicit permission from all parties, preferably under a mutual NDA. Penetration testing is a separate engagement the target must authorize.

But isn't a SOC 2 report enough?

Not on its own. A SOC 2 report is useful evidence if the target has one, but it reports on a system, not necessarily on the whole company or all of its products and services. Management defines the boundaries of that system, and anything outside those boundaries is outside the auditor's opinion. An ISO 27001 certificate works the same way: it covers the scope the company chose for its security management system. When you acquire a company, you acquire all of it, including the products, systems and hidden liabilities the report never looked at. Diligence still asks about the accounts, contracts, incidents and end-of-support systems that matter to the deal.

Can we use the same checklist on every deal?

Yes. That is the point of it.

Book an introductory call

ProSource Technology Solutions | Oviedo, Orlando and Melbourne, Florida | 888-948-7767 | sales@getprosource.com | getprosource.com

Book an introductory call (888) 948-7767