--- title: "Technology due diligence for buying or selling a business" description: "What technology due diligence should cover when you buy or sell a business, the surprises that show up after close, and what sellers can fix before buyers look." url: "https://northcreektechnology.com/guides/technology-due-diligence/" updated: "2026-10-13" audience: "Owners, buyers, and their advisors" author: "Andrew Healey" publisher: "Northcreek Technology" --- # Technology due diligence when you buy or sell a business In most deals, technology gets a slide and a questionnaire. The surprises show up after close. A short, plain review before the deal tells a buyer what they're inheriting and gives a seller time to fix the cheap things first. Deal teams spend weeks on revenue, customers, and working capital. Technology usually gets a slide in the deck and a questionnaire the seller fills out. Then the deal closes, and the buyer finds out the domain is registered to a former employee, the main server is past the end of support, and the backups have never been tested. None of that is rare, and most of it is cheap to find before close. ## What it should cover **Who owns the keys.** The domain name, the Microsoft 365 or Google account, the firewall, the backups, and the accounting or ERP system (the software that runs orders, inventory, and the books). Are they registered to the company, or to a founder, an employee, or the IT company? It's one of the easiest problems to avoid before close and one of the hardest to untangle after. **Contracts and licenses.** The IT company's contract, software subscriptions, and any license that can't move to a new owner without consent. Look for renewal dates, exit costs, and change-of-control terms (what changes if the company is sold). Check whether the company has the software licenses it's using. An unlicensed copy of a big-vendor product can turn into a bill after close. **Systems past their end of support.** Servers, computers, firewalls, and software the maker no longer updates. Each one needs money soon, and each one is a security gap now. In manufacturing, include the computers that run equipment on the plant floor. **Security and incident history.** Is multi-factor sign-in (MFA, a code or prompt on your phone at login) on everything that faces the internet? Do the backups work? Has the company had an incident or an insurance claim? Is the cyber insurance application true? See [is your cyber insurance application true?](/guides/cyber-insurance-application/) **Commitments to customers.** Security questionnaires the company has answered and contract terms it agreed to. A buyer inherits those promises. **People and knowledge.** How much depends on one IT person or one technician at the IT company? Is anything written down? **The cost of the first year.** What it will take to fix the urgent items, replace what's at end of life, and connect the business to the buyer's systems. That number belongs in the price conversation, not in the first quarter after close. ## If you're selling Buyers will look. Better that you find it first. - Move every account and domain into the company's name. - Fix the cheap items: MFA, a tested backup restore, licenses for people who left. - Write down what you have: systems, contracts, renewal dates, and who supports what. - Make a dated plan for the bigger items, like an old server, so they read as known and planned rather than discovered. A short list of known issues with dates tells a buyer the business is run well. A surprise in the data room does the opposite. ## If you're buying Ask for the items above early, in writing. Treat "we'll get that to you" on the domain and admin accounts as a finding. Before close, the review tells you what you're inheriting. After close, the same list becomes the first 90 days. Our founder led security inside a company backed by private equity, so we know what owners, lenders, and boards ask about. We review the technology. Your banker, CPA, and attorney keep the questions that belong to them. ## Questions ### Is this the same as a quality of earnings report? No. A quality of earnings report is financial work by a CPA firm. Technology diligence looks at the systems, contracts, people, and risk behind the business. The two answer different questions, and the findings from one often explain numbers in the other. ### When should it happen? For a buyer, before the letter of intent if you can, and before close at the latest. For a seller, six to twelve months before going to market, so there's time to fix what it finds. ### Do you work with our banker, CPA, and attorney? Yes. We cover the technology. Financial, legal, and tax questions go back to them. We don't give legal or tax advice. ## Related guides - [How to tell if your IT company is doing a good job](https://northcreektechnology.com/guides/evaluate-your-it-company.md) - [Is your cyber insurance application true?](https://northcreektechnology.com/guides/cyber-insurance-application.md) - [How much should a company spend on IT?](https://northcreektechnology.com/guides/how-much-to-spend-on-it.md) ## Where Northcreek Technology fits Technology Assessment (IT assessment and technology risk review): Find out where you stand. We review your systems, people, spending, and risk, and give you a stop, keep, fix, or replace list and a 90-day plan. It's the usual first step. https://northcreektechnology.com/services/technology-assessment/ ## Next step Book a call: https://northcreektechnology.com/contact/