IT Due Diligence Checklist: Infrastructure, Security, Cloud and AI

IT due diligence is the review of a target company's infrastructure, business applications, security, data, vendor contracts and IT organization before an acquisition, carve-out or investment. An IT due diligence checklist turns that review into specific questions backed by evidence, so the buyer knows what it is inheriting, what the estate will cost to run, separate or integrate, and what has to be fixed after close.

This checklist is IT-centric. It is built for targets that run on technology rather than sell it: manufacturers, distributors, services firms, healthcare providers, and divisions being carved out of a larger parent. If the target's product is software, use our software due diligence checklist instead, which goes deeper on code, architecture and product. Many deals need parts of both, and Sphere's IT and technical diligence practice can scope either one.

What Is IT Due Diligence and When Do You Need It?

IT due diligence answers three questions for the deal team. Does the IT estate support the business plan? What will it cost to run, separate or integrate? And what risk does it carry that the price or the contract should reflect?

The usual triggers are acquisitions of non-software businesses, carve-outs where the target shares systems with its parent, private equity add-ons where ERP and CRM consolidation drives the synergy case, and lenders or insurers who want independent assurance. Software diligence asks whether the product will scale; IT diligence asks whether the business can keep operating, and at what cost, once ownership changes. For how both fit within the wider review investors run, see what technology due diligence covers.

The IT Due Diligence Checklist

The ten sections below cover a full IT review. Rate each item red, amber or green, and attach a cost and timeline to anything that is not green. Scale the depth to the deal thesis: a carve-out puts section 10 first, a regulated target puts sections 3 and 4 first.

1. Infrastructure and hosting

• Is there a current inventory of servers, cloud accounts, networks, sites and end-user devices, with a named owner for each?
• Which workloads run on-premises, in colocation and in which public clouds?
• How old is the hardware, and how much refresh spend is already overdue?
• Is the environment documented well enough that someone outside the current team could rebuild it?
• What is shared with a parent company or affiliate, such as data centres, networks, identity or email?

2. Business applications and enterprise systems

• Which ERP, CRM, HR, payroll, finance and industry systems run the business, and on which versions?
• How heavily are they customized, and how close are they to the end of vendor support?
• How do they integrate: middleware, point-to-point connections, file transfers or manual re-keying?
• Which processes depend on spreadsheets, macros or scripts that one person maintains?
• Is any core system facing a forced migration, for example because the vendor is retiring an on-premises edition?

3. Cybersecurity

• When were the last penetration test and vulnerability scan, and were the findings closed?
• Is multi-factor authentication enforced for email, remote access, admin accounts and cloud consoles?
• How are privileged accounts, former-employee access and third-party access controlled and reviewed?
• Are backups isolated from the production network, and when was a full restore last tested?
• What incidents, ransomware events or breach notifications occurred in the last three years?
• Is there a tested incident response plan, and what does the cyber insurance policy exclude?

4. Data, privacy and compliance

• What personal, financial or regulated data is held, where, and under which regimes, such as GDPR, HIPAA, PCI DSS or state privacy laws?
• Is there a data map, a retention policy and a record of who can access what?
• How clean is master data for customers, products and suppliers, and who owns it?
• Are there open audit findings, regulator inquiries or customer security questionnaires the company failed?

5. Cloud costs and IT spend

• What is total IT spend across people, licences, cloud, outsourcing and hardware, and how has it trended against revenue?
• What do twelve months of cloud bills show about idle resources, oversized environments and multi-year commitments?
• Which IT costs sit in a parent's or affiliate's budget today and will appear on the target's books after close?
• Which committed spend survives the deal, and what does it cost to exit?

6. Vendors, contracts and licences

• Which software licences and SaaS subscriptions are in use, and does actual use match entitlements for users, cores and editions?
• Which contracts contain change-of-control, assignment or termination clauses?
• Which managed service providers or outsourcers run critical functions, and on what service levels and exit terms?
• Which vendors would stop the business if they failed or raised prices?

7. IT organization and key people

• Who leads IT, how is the function structured, and what is the mix of employees, contractors and service providers?
• Who holds knowledge that is not documented anywhere?
• What do attrition, open roles and on-call load look like over the last two years?
• Which people need retention arrangements for the deal to work?

8. Resilience and business continuity

• Is there a tested disaster recovery plan with defined recovery time and recovery point objectives for each critical system?
• What were the major outages of the past two years, and what changed afterward?
• Which single sites, network links or people could stop operations?

9. AI usage and shadow IT

• Which AI tools are employees using, including chat assistants, coding assistants and AI features inside existing SaaS, and under what policy?
• What company or customer data has been sent to external AI services, and do customer contracts and privacy notices allow it?
• Are any customer-facing or financial decisions automated with AI, and who reviews the output?
• Which systems or tools were bought or built outside IT's knowledge?

This section is about AI as a tool the business uses. If AI is part of the value being acquired, it needs its own workstream; our guide to evaluating AI capabilities in a target covers model provenance, data rights and inference costs.

10. Separation and integration

• Which systems, data and services does the target share with the seller, and what will the transition services agreement (TSA) cover, and for how long?
• How long will it take to stand up standalone ERP, CRM, identity, email and networking, and what will it cost?
• Which data must be extracted and migrated, and who legally owns it?
• For integrations, which systems move onto the buyer's platforms, and what does that do to licences, contracts and headcount?

Carve-outs show why this section matters. In a software division carve-out Sphere supported after a private equity acquisition, the parent kept every core system, including ERP, CRM, HR, PSA, web, intranet and analytics, and the new company had a six-month TSA window to become fully operational on its own stack. The replacement platforms were chosen partly because they met more than 80% of functional requirements out of the box. Mapping those dependencies before signing is what gives a deal team a realistic TSA length and stand-up budget.

What Should You Request in the Data Room?

A questionnaire tells you what management believes. These documents tell you what is true, and each one answers several checklist items at once. Put them on the first request list.

How Do IT Due Diligence Findings Change the Deal?

IT findings hit the deal model in two different places, and keeping them apart is what makes them usable. One-time costs, such as a stand-up, an overdue upgrade or a security fix, affect the price or an escrow. Run-rate changes, such as licences repriced on change of control, new standalone headcount or an outsourcing contract that cannot be exited, affect EBITDA and the synergy case. Mixing them is how a buyer ends up paying for the same problem twice, or not at all.

• One-time costs: quantify and take to price, a holdback or an escrow.
• Run-rate changes: feed the EBITDA bridge and the synergy plan.
• Risks that are real but hard to size: licence non-compliance or data protection exposure, handled through specific warranties and indemnities.
• Separation dependencies: set the scope and length of the TSA.
• Accepted gaps: sequenced and funded in the first 100 days.

To prepare management interviews, start from our list of technical due diligence questions to ask the target. For how IT diligence fits into a full acquisition process, read the complete guide to M&A technical due diligence, and for the full methodology, including where a code audit fits, see our technical due diligence and code audit guide.