Technology due diligence
Technology Due Diligence for PE-Backed Acquisitions: IT and Security in One Assessment
Technology due diligence — also called technical due diligence or IT due diligence — is the assessment of a target company’s IT infrastructure, cybersecurity posture, and digital capabilities as part of a private equity acquisition process. In most mid-market deals, it is the workstream most likely to surface deal-shaping risk, and the one most often commissioned too late. This guide explains what it covers, how it works, and why the combined CIO and CISO assessment matters.
What Is Technology Due Diligence in a PE Context?
Technology due diligence answers the questions a deal team cannot answer from a management presentation or a financial model:
- What is the real state of the IT infrastructure the investment relies on?
- What cybersecurity risks are being acquired alongside the business?
- What will IT integration cost and how long will it take?
- What technology investment is required to support the value creation plan?
- Are there material liabilities in vendor contracts, compliance gaps, or technical debt?
The output is not a technology opinion. It is deal-shaping intelligence: a clear view of what is being acquired, what it will cost to integrate and develop, and whether any finding is a price adjustment, a deal condition, or a material risk that changes the investment case.
What Technology Due Diligence Covers: The Eight Assessment Domains
Starkhorn’s technology due diligence framework covers eight domains that map to the real sources of IT risk in PE acquisitions. This is designed specifically for non-software businesses, where code quality is irrelevant but operational technology, vendor dependencies, and security posture are critical.
| # | Domain | What it assesses |
|---|---|---|
| 1 | IT infrastructure and architecture | Infrastructure maturity, cloud vs on-premise balance, resilience, technical debt, and investment trajectory |
| 2 | Cybersecurity posture | Security controls against NIST CSF and ISO 27001, incident history, third-party risk, and regulatory compliance gaps |
| 3 | Enterprise applications and ERP | Core business systems, ERP suitability for growth plan, integration dependencies, and upgrade roadmap |
| 4 | Data protection and regulatory compliance | UK GDPR compliance, ICO obligations, FCA or sector-specific regulatory requirements, and data governance maturity |
| 5 | IT team, vendor contracts, and managed services | Team capability and retention risk, key man dependencies, MSP and vendor contract terms, renewal dates, and exit penalties |
| 6 | Technology spend and cost trajectory | Current IT budget, run-rate cost savings available, capital investment required, and value creation plan technology requirements |
| 7 | Integration readiness | Complexity and cost of integrating with acquirer’s platform or portfolio; Day 1 requirements; TSA scope |
| 8 | Digital and technology roadmap feasibility | Whether the management team’s technology plans are deliverable, funded, and appropriately sequenced |
The Combined CIO and CISO Assessment: Why It Matters for PE Deals
Technology due diligence and cybersecurity due diligence are typically commissioned separately. The result is two reports with a gap between them: the technology due diligence misses security implications of architectural decisions, and the cybersecurity review misses technology context that changes the risk assessment.
The seam between them is where the most consequential risks in PE acquisitions accumulate:
- A legacy ERP with no vendor support that is also the only system enforcing access controls
- A cloud migration plan that will inadvertently expand the attack surface during the value creation period
- A regulatory compliance gap that is both a data protection issue and an IT governance one
- A key man dependency that is simultaneously an IT delivery risk and a security risk
Starkhorn holds both the CIO and CISO mandates in a single engagement. The eight-domain framework assesses technology and security as an integrated picture, not two separate reports for two separate teams to reconcile.
How the Technology Due Diligence Process Works
A Starkhorn technology due diligence engagement runs at deal speed: typically two to four weeks from commission to report delivery, structured around the deal timeline.
| Week | Activity | Output |
|---|---|---|
| Week 1 | Management presentation review; initial data request; kick-off with management team | Scoped assessment plan; priority risk areas identified |
| Week 2 | Infrastructure and security assessment; vendor and contract review; ERP and application deep-dive | Draft findings across eight domains |
| Week 3 | Management Q&A; financial model for IT investment requirements; integration complexity scoring | Validated findings; investment and integration cost estimates |
| Week 4 | Report finalisation; deal team briefing; board presentation if required | Final technology due diligence report; deal team briefing |
The final report is structured for the deal team, not for a technology audience. Findings are categorised as: deal-shaping (recommend price adjustment or deal condition), material (recommend post-close workstream), or noted (low risk, monitor during integration).
Technology Due Diligence for Services Businesses and PE Targets
Most technology due diligence frameworks are designed for software companies. The majority of PE acquisitions are not: they are veterinary groups, care businesses, logistics operators, automotive retailers, professional services firms, and similar businesses where technology is the infrastructure of operations, not the product.
For these businesses, the critical due diligence questions are different:
- Does the ERP support multi-site, multi-entity operation at scale?
- Are there technology dependencies that will constrain the rollup strategy?
- What is the technology cost of the buy-and-build model at 20, 50, and 100 sites?
- Can the current security posture survive the scrutiny of larger acquirers or public markets?
Starkhorn’s track record is specifically in services-sector PE acquisitions: VetPartners (veterinary, 850+ sites, 9 countries), Jardine Motors Group (automotive, 2 transactions), and PE-backed engagements across healthcare, professional services, and consumer sectors.
Sell-Side Technology Due Diligence: Preparing for Buyer Scrutiny
Management teams approaching a sale process benefit from commissioning sell-side technology due diligence before the buyer’s advisers arrive. It identifies findings before they become price chips, allows remediation on a managed timeline, and demonstrates proactive governance to acquirers.
Sell-side technology due diligence is especially valuable when:
- The business has known technology gaps that need to be positioned correctly
- The management team’s technology plans are ambitious and need independent validation
- A previous deal fell through on a technology finding and the next process needs to be better prepared
- The business is seeking a premium valuation and needs to demonstrate technology governance maturity
Technology Due Diligence Checklist: 40 Questions PE Deal Teams Should Ask
Use this checklist to assess whether your technology due diligence is covering the right ground.
Infrastructure and architecture
- Is the infrastructure modern enough to support the value creation plan?
- What is the split between cloud and on-premise, and is it changing?
- What technical debt is present and what does remediation cost?
- Are there single points of failure in critical business systems?
- What is the IT capital investment required in years 1 to 3?
- Are disaster recovery and business continuity plans tested?
- What is the real infrastructure run-rate cost after normalisation?
- Are there infrastructure constraints on the rollup or growth plan?
Cybersecurity
- What is the current security posture against NIST CSF or ISO 27001?
- Has there been a material security incident in the last 3 years?
- How are endpoints, identity, and access managed?
- Is there a documented incident response plan?
- What are the third-party and supply chain security risks?
- Are there regulatory compliance gaps (FCA, ICO, NIS 2)?
- What is the cost of achieving target security maturity?
- Are there cyber insurance implications in the findings?
Applications, ERP, and data
- Is the ERP fit for the scale and complexity of the value creation plan?
- What is the ERP upgrade or replacement cost and timeline?
- Are integration dependencies between systems documented?
- Is the data structure able to support reporting and analytics?
- What are the GDPR and data protection compliance gaps?
- Are there material licence or contract liabilities?
- Is the data quality sufficient for integration and reporting?
- Are there vendor support end-of-life risks?
Team, vendors, and integration
- What are the key man dependencies in the IT function?
- Is the IT team capable of supporting the value creation plan?
- What vendor and MSP contracts have unfavourable terms or exit penalties?
- What is the integration complexity and cost for the acquirer’s platform?
- What does Day 1 integration require and is it achievable at close?
- What TSA scope is needed and for how long?
- What are the synergy assumptions in the financial model and are they achievable?
- Are there technology dependencies that constrain the acquisition strategy?
Frequently Asked Questions
When should technology due diligence be commissioned?
Before exclusivity where possible, or immediately at exclusivity. After exclusivity, the findings can still shape the SPA conditions and integration planning, but the deal-shaping window where price adjustments are negotiated from a position of strength has already compressed. Technology DD commissioned after signing can still surface material risks, but the leverage to act on them has diminished.
How long does a technology due diligence assessment take?
Starkhorn delivers technology due diligence reports in two to four weeks, structured to match deal timelines. The eight-domain framework is designed to run at PE deal speed: focused, evidence-based, and structured for the deal team rather than the technical audience.
What is the difference between technology DD and IT due diligence?
The terms are used interchangeably. In PE contexts, “technology due diligence” typically covers both IT infrastructure and cybersecurity. “Technical due diligence” often refers specifically to software and code quality assessments, which are relevant for software businesses but not for services-sector PE targets where the IT is the operational infrastructure, not the product.
Can technology DD findings be used to renegotiate price?
Yes, and this is one of the primary commercial uses of the report. Findings categorised as “deal-shaping” are presented with a cost-to-remediate estimate that supports price adjustment negotiations. In Starkhorn’s experience, a well-evidenced technology DD report routinely justifies its cost many times over in price reduction or risk mitigation.
PE-backed engagements
Technology due diligence that moves at deal speed
Two to four weeks from commission to report. IT and security in one assessment. No conflict with any SI or technology vendor.