IT Due Diligence for PE and Mid-Market Buyers

When I sit in a data room, IT due diligence is the work of proving you can operate the company on Monday after close. I look at who holds the MFA, whose Gmail owns the domain, and which login still opens the bank and the ERP. I am not counting apps.

Buyers who search this phrase get an audit-assurance brochure or a vendor PDF. I write this page for the operating partner who has to run the company if the seller's phone is off.

Pineapples prices the hired version as Technology Diligence at $25K or $60K, 10 business days from data-room access.

What is IT due diligence when a buyer types it?

IT due diligence is the phrase PE, mid-market, and family-office buyers actually type. They are not asking for a history of due diligence. They are asking whether the target's IT will still work after the people in the data-room Zoom hang up.

I treat that as a live-file question. Can payroll run. Can someone reset a customer password. Can anyone get into AWS, the registrar, or the bank without texting the seller.

An inventory answers a different question. It lists Slack, NetSuite, a custom portal, and an MSP. All of that can be accurate. None of it tells you that the portal reset still lands in the founder's personal inbox, or that the MFA prompt on the laptop is waiting for a code on a phone that is already in another state.

This page is that read. The mid-market guide is the longer explainer. The M&A checklist is the self-serve question list. The consulting page is the commercial seat. Do not treat those as the same document.

Why does the page that ranks first miss the IC question?

Search "IT due diligence" on Google US and the first result, as of this writing, is a Deloitte Czech and Slovak audit-assurance service page. I am not quoting it. I am describing the menu a buyer actually lands on.

That page sells a health check, a red-flag review, and a broader IT environment review. Scope language on the page includes applications, data centers, vendor contracts, and headcount. The stated goal is whether the IT environment can support the business. Fine work for a combined diligence team. It is not the Monday lockout.

A PE operating partner heading to IC still needs a shorter, uglier list:

• Whose phone receives the MFA for bank, ERP, and cloud admin
• Which email is the registrant on the domain
• Who can sign or cancel the MSP
• What breaks if that person does not take the first buyer call

If your packet cannot answer those, you have a service brochure. You do not have IT due diligence for a live file.

I do not need Deloitte to be wrong to say that. I need the ranking page to be honest about what it is. It is a member-firm audit-assurance offer. It is not a walkthrough of the laptop that says "Enter MFA Code" on day one.

What do I open first in the data room?

I do not start with the application list the banker uploaded. I start with the objects that can lock the buyer out.

MFA. Ask for the admin path on the bank, the ERP, Microsoft 365 or Google Workspace, and the cloud account. Then ask which device receives the code. If the answer is "the founder's phone" or "we will handle that at close," write it down as a close condition, not as a footnote.

Domain and registrar. Open the registrar. Read the registrant contact. If I see a personal Gmail, I treat the domain as a seller asset until it is moved. The company can look modern and still have GoDaddy pointed at personal.email@gmail.com.

MSP and vendor contracts. Who is the named customer. Whose credit card or ACH is on the account. Who can open a ticket after the press release. An MSP that only knows the founder is a TSA you have not priced.

Bank and ERP admin. Two people who can log in, on devices that will still be in the building. If both admins are sellers who are leaving, Monday is a restore project.

Password reset path. Click "forgot password" on the customer portal and on the internal admin. Follow the email. If it goes to the founder's inbox, the portal is not yours yet.

I write those as objects I can screenshot. I do not write them as a maturity score.

The diagram is the finding. Domain on a personal Gmail. MFA on a seller phone. MSP or cloud in a personal login. ERP and bank admin. That chain is Monday lockout. The app count is the side path.

Where does day-one lockout actually live?

Day one is the first morning the buyer has to operate without the seller in the room.

Lockout lives in boring places:

• The bank still texts a phone that left with the seller
• The ERP admin is a shared password in a spreadsheet nobody can open because the vault login used that same phone
• The domain auto-renews on a personal card, or the transfer PIN is in a mailbox you cannot see
• The MSP will not talk to the buyer because the contract contact is the founder
• The customer portal works until the first reset, then the email goes to an inbox that is no longer monitored

None of those show up as a row on a seat matrix. All of them show up if you sit down at the laptop and try to do one real admin task.

I also look for the source of truth the board will ask about in week one. If last week's revenue or the close pack can only be rebuilt from a mailbox, you do not have a system you can inherit. You have a person. That person may be leaving. I write that in the memo. I do not turn it into a branded score.

The cheaper time to find lockout is before the announcement. After close it becomes a post-merger fire. Same objects. Worse timing.

What belongs in the IC memo?

IC does not need another appendix of logos. IC needs the things that change price, holdback, or timing.

I write findings as actions:

• Move MFA off seller devices before close, or hold funds until two buyer-controlled admins are live
• Transfer the domain off the personal Gmail and put the registrar on a company email and a company card
• Novate or re-paper the MSP so the buyer can open a ticket on Monday
• Name two people who can administer bank and ERP on devices that stay
• Reroute password reset off the founder's inbox

If I cannot attach a screenshot or a contract clause, I am not done. "Documentation is light" is not a finding. "The only MFA device is leaving" is a finding.

An inventory can sit in the appendix. The memo is the lockout list and the cost or delay to clear it. That is the difference between IT commentary and something finance can use.

When you want the question list, keep the mid-market M&A checklist. When the file is live and the model needs numbers, that is technology due diligence consulting. This page is the search phrase those two sit on.

When do I hire the 10-day seat?

I hire the seat when the next decision is a price, a holdback, or a no, and the logins can change that decision.

Pineapples prices Technology Diligence at $25K or $60K, 10 business days from data-room access. Same operator from access to the readout. Findings written so they can sit next to legal and finance.

That is the deal-room buy. It is not a second vendor PDF. It is not a request to "send the inventory and we will review it."

After close, if the company still needs a technology lead week to week, that is Fractional CTO at $15K or $35K a month, pause or cancel any month. Build work on systems you already control is AI-Native Build from $4,500 per 2-week sprint. One shipped proof workflow, later, is the Starter Workflow Pilot at $4,900, 7 business days. None of those replace the Monday login check on a live file.

I do not invent fees. The PE menu lives on the engagements page.

What do I take into IC?

I take the objects that can lock you out, and I stop.

The MFA code. The personal Gmail on the domain. The MSP that will not speak to you. The bank and ERP admin. The reset email that still belongs to the founder.

If those are clean, the inventory can wait. If they are not clean, the inventory does not matter yet.

I run this as owner-led work. Same person in the data room and in the readout. If you have a live file, scope the 10-day seat. Bring the target. I will sit at the laptop.

Related reading

• Technology Due Diligence Consulting for PE and Mid-Market Buyers
• Technology Due Diligence Checklist for Mid-Market M&A
• Technology Due Diligence for Mid-Market Acquisitions
• Post-Merger Integration for Mid-Market PE
• Technology Due Diligence for Mid-Market PE