Technology Due Diligence Before You Buy a Company: A Checklist for Mid-Market Owners and Operators

Technology Due Diligence Before You Buy a Company: A Checklist for Mid-Market Owners and Operators

2026-10-26

Takeaway: When you buy a company, you buy its technology: the systems, the contracts, the shortcuts, and possibly an intruder who is already inside. Before closing, get written answers in six areas: systems and contracts, security history, people, data, integration cost, and deal terms. Then keep checking after closing, because the risk doesn’t end at signing.

Financial due diligence gets a team of accountants. Technology due diligence often gets a one-hour call with the seller’s IT manager. That’s backwards for most modern businesses, where the systems are the operation.

Two expensive lessons from big deals

Marriott and Starwood. In 2014, attackers got into the IT systems of Starwood Hotels. Marriott acquired Starwood in 2016 and did not detect the attack until September 2018, according to the UK Information Commissioner’s Office (ICO) penalty notice of October 30, 2020. Marriott estimated that 339 million guest records were affected, and the ICO fined it £18.4 million.

Two details matter for buyers. First, Marriott told the ICO it could carry out only limited due diligence on Starwood’s data systems during the acquisition, and the ICO acknowledged there may be circumstances in which in-depth due diligence of a competitor isn’t possible during a takeover. Second, the ICO said a company’s need to conduct due diligence on its data operations “is not time-limited or a ‘one-off’ requirement.” (The fine covered only failures after GDPR took effect in May 2018.) In a statement the same day, Marriott said it would not appeal but made “no admission of liability,” and noted that the incident involved only Starwood’s separate network, which is no longer in use.

Verizon and Yahoo. On February 21, 2017, Verizon and Yahoo announced they had cut the price of Verizon’s purchase of Yahoo’s operating business by $350 million and would share certain legal and regulatory liabilities from Yahoo’s data breaches. The Securities and Exchange Commission (SEC) later charged Yahoo’s successor, Altaba (April 24, 2018). Its order found that Yahoo’s security team learned of a December 2014 intrusion within days, but investors weren’t told until 2016, as the Verizon deal was closing. Altaba paid a $35 million penalty without admitting or denying the findings.

You’re probably not buying a hotel chain. But the pattern scales down: the seller’s technology problems become the buyer’s problems on day one.

The six-part checklist

1. Systems and contracts

Ask for a list of every system the business runs on (ERP, CRM, accounting, line-of-business apps, websites) with an owner, annual cost, and renewal date for each. Flag contracts that can’t transfer to a new owner without vendor consent, accounts or licenses in someone’s personal name, and software on its last supported version.

2. Security and incident history

Ask in writing: Have you had a breach, ransomware attack, or fraudulent payment in the last five years? Who investigated, and can we see the report? Is multi-factor authentication (a second login step beyond a password) on email, remote access, and admin accounts? When was a backup last restored as a test? Yahoo’s story is why you ask about past incidents directly. Marriott’s is why you also look for a current intruder: where the deal size justifies it, pay for a short compromise assessment before closing.

3. People and key-person risk

Who actually knows how things work? If the answer is one long-time employee, or an outside contractor holding every admin password, that’s a retention and access problem to solve before closing, not after.

4. Data

What customer, employee, and payment data does the business hold, where does it live, and what has it promised customers about that data? Those promises come with the data.

5. Integration cost

Price the work to connect, migrate, or retire systems, plus the technical debt (the shortcuts someone will eventually have to fix). This number can change what the company is worth to you.

6. Deal terms

Turn findings into terms: specific statements from the seller about security incidents, a holdback or escrow, a price adjustment, or shared liabilities, the same levers Verizon and Yahoo used. Your attorney drafts the language. Your technology review tells them what to ask for.

After closing: the first checks

The ICO’s point bears repeating: due diligence doesn’t stop at signing. Early on, change shared and admin passwords, remove access for departing staff and vendors, put the acquired company’s email and remote access behind multi-factor authentication, and decide whether its network connects to yours now or only after a security review. The ICO notice also says adequate due diligence would have included reviewing the adequacy of monitoring, including logging, inside the acquired network, so add that to your list.

The bottom line

Treat technology due diligence like a building inspection: you don’t skip it because the seller seems honest, and you use what you find to negotiate. Yellow Coop’s CTO work includes technology due diligence for acquisitions or investors, and its CISO work includes vendor risk reviews and a written incident response plan. Let’s talk.

Sources