What Happens to Your IT When You Buy Another Business

When a small or medium business buys another one, IT is rarely the reason for the deal and often the source of the first month's headaches. You inherit a second set of computers, accounts, licences and vendor contracts, built by someone else, to someone else's standards. Some of it will be fine. Some of it will be a security risk the moment it connects to your network.

This is the order we work in: what to find out before the deal closes, what to do in the first 30 days, and how to bring the two businesses together without losing email, files or a week of productivity.

Before the deal: IT due diligence

You may not get full access before closing, but ask for as much of this as you can. Gaps in the answers are information too.

• Who runs IT today? An employee, an outside provider, or the owner? Will they stay through the transition?
• Accounts and domains. Who controls the domain name, the DNS, the Microsoft 365 or Google Workspace admin accounts, and the cloud subscriptions? Are they in the company's name, or a founder's personal account?
• Systems and data. What line-of-business applications does the business depend on, where does the data live, and who supports them?
• Contracts and licences. Internet, software subscriptions and support agreements: their terms, renewal dates and whether they can be transferred or cancelled.
• Security. Is MFA on? Is there endpoint protection? When were backups last tested? Any incidents in the past few years? Any cyber-insurance questionnaire they've completed is a useful summary.
• Compliance. Do they handle health records, card payments or defense work? HIPAA, PCI DSS or CMMC obligations come with the business.
• Hardware age. A rough count of computers and servers, and how old they are. Replacing a fleet of old laptops is a cost worth knowing about before you agree a price.

Day one: secure what you just bought

• Take control of the admin accounts, the domain registrar and DNS, and change the passwords. Make sure MFA is on for all of them.
• Find out who still has access, including former staff and former IT providers, and remove anyone who shouldn't.
• Confirm the backups exist and that you can restore from them, before you change anything else.
• Don't connect the two networks yet. Until you know the acquired machines are patched and protected, keep them separate.

The first 30 days: inventory and plan

• Build a full inventory: people, devices, accounts, applications, vendors, contracts and data.
• Bring every device up to your security baseline: supported operating system, patches, endpoint protection, disk encryption.
• Decide the target: one email domain or two, one Microsoft 365 tenant or two, which line-of-business systems survive.
• Write a migration plan with dates, an owner for each step, and a way back for each one. Tell staff what will change and when.

Bringing the two businesses together

Email and calendars

Tenant-to-tenant migrations of mailboxes, calendars and contacts are routine, but the details matter: shared mailboxes, permissions, forwarding, distribution lists and the domain cutover itself. Plan the cutover for a quiet period, keep the old domain receiving mail for a long time afterwards, and test with a few users first.

Files and permissions

File migrations fail on permissions more often than on data. Map who should see what in the combined business before you move anything, and clean up obvious problems (everyone can see everything) on the way.

Line-of-business applications

These are usually the slowest part. Talk to the vendors early about licensing, data export and merging records.

Networks and locations

Once the acquired devices meet your baseline, connect the sites securely and bring them under the same monitoring, patching and backup as everything else.

The mistakes that cost the most

• Discovering after closing that a key account belongs to someone who has left, or to the seller personally.
• Connecting an unpatched, unprotected network to yours on day one.
• Cutting over email without a rollback plan, and losing mail during the switch.
• Auto-renewing contracts nobody knew existed.

None of these is technically hard to avoid. They just need someone to own the IT side of the deal from the start.