Post-Acquisition Day 1 IT Checklist: 47 Tasks That Can't Wait

The Day 1 Vulnerability Gap

The ink is dry, the wire has hit, and the press release is live. For the deal team, the work is done. For the Operating Partner, a different kind of work begins.

The first 24 hours post-acquisition represent a concentrated window of identity, access, vendor, backup, and infrastructure risk. While the deal team was focused on EBITDA adjustments and working capital targets, the acquired company’s IT environment may have been operating with informal controls, incomplete documentation, or deferred security work.

According to Forescout-cited M&A security research, 53% of buyers discover unknown cybersecurity problems after closing. IBM’s data breach research also shows that merger and acquisition complexity can increase breach cost. The practical issue is straightforward: you are connecting two operating environments before you fully understand trust, access, and control.

The Access vs. Control Fallacy

Most Day 1 plans focus on access: getting new employees email addresses, Slack logins, and access to the parent company’s intranet. That matters, but your primary Day 1 objective is control.

You are inheriting:

• Tribal Knowledge: Admin passwords stored informally or known only by one employee.
• Shadow IT: SaaS subscriptions on personal credit cards or unmanaged business cards.
• Employee-Transition Risk: Acquired teams often experience meaningful attrition in the first year. If a departing employee retains privileged access, the risk becomes operational and financial.

The following diagnostic checklist is not about integration strategy. That comes later. This is about triage and stabilization: the tactical list of tasks that should happen early to reduce preventable value leakage.

The 47-Point Day 1 Triage Checklist

We divide the checklist into three phases: Lockdown (Hours 0-24), Audit (Hours 24-72), and Stabilize (Week 1). The sequence matters because control gaps compound quickly after close.

Phase 1: Lockdown (Hours 0-24)

Goal: reduce unmanaged access and secure the perimeter.

• 1. Global Admin Reset: Reset passwords for all Domain Admin, Global Admin (M365/Google), and root accounts. Enable MFA immediately on these accounts if not present.
• 2. Departure access cutoff: Identify all employees marked for immediate exit (if any) and disable access during the notification meeting, not after.
• 3. Financial Authority Revocation: Revoke banking tokens and wire transfer authority from former controllers/CFOs immediately.
• 4. Domain Registrar Lock: Verify ownership of DNS records and enable transfer locks to prevent domain hijacking.
• 5. Social Media Handover: Secure credentials for LinkedIn, X, and corporate Meta accounts. Enable MFA tied to a corporate device or approved authenticator.
• 6. MSP Change Control: If the target used an MSP, notify them of the change in control and place a freeze on standard changes without written authorization.
• 7. Physical Access Control: Issue new keycards or re-key server rooms and executive offices where appropriate.
• 8. VPN Audit: Review active VPN sessions. Terminate connections from unknown locations or former employees.
• 9. Backup Verification: Locate the backups, verify they are running, and confirm at least one recoverable backup set is protected from ransomware impact.
• 10. Endpoint Protection: Query endpoints for missing EDR or antivirus agents and prioritize coverage gaps.

Phase 2: The Silent Audit (Hours 24-72)

Goal: Identify what you actually bought before it breaks.

• 11. SaaS Discovery Scan: Connect a tool or check CASB logs to identify shadow IT and undisclosed applications.
• 12. Codebase Repo Audit: Audit GitHub/GitLab repositories for hardcoded API keys, cloud secrets, and unmanaged deploy credentials.
• 13. SSL Certificate Review: Check for expiring SSL certificates on public-facing assets. Certificate failure on Day 2 creates an avoidable customer-trust issue.
• 14. Cloud Spend Triage: Review AWS/Azure billing dashboards. Identify unattached volumes, idle instances, and obvious waste.
• 15. Vendor Auto-Renewals: Review the AP ledger for the last 60 days. Identify any SaaS contracts auto-renewing in the next 30 days and send non-renewal notices where appropriate.
• 16. Data Room Closure: Shut down the Virtual Data Room (VDR) used for the transaction. Download the archive for legal retention.
• 17-25. Infrastructure Inventory: Map network topology, subnets, IP ranges, critical systems, and third-party dependencies.

Phase 3: Stabilization (Week 1)

Goal: Operational continuity without compromising security.

• 26. Helpdesk Unification: Establish a triage queue. Do not merge ticketing systems yet; create visibility first.
• 27. Branding Updates: Update email signatures and disclaimers, but do not change email domains until migration risk is understood.
• 28. Communication Bridge: Create a shared Slack or Teams channel for IT and Ops leadership between both companies.
• 29-47. Policy & Compliance: Update privacy policies, review cyber insurance coverage applicability, and complete initial compliance gap analysis.

Execution: The Zero Trust Integration Model

The biggest mistake Operating Partners make is assuming the acquired network is friendly. Until your team has audited the environment, identity posture, endpoint coverage, backups, and privileged access, treat the acquired network as untrusted.

The Cost of Skipping the Checklist

Integration budgets can be materially affected by technical debt and security remediation. The 47 tasks above are designed to surface those items in Week 1, allowing you to re-forecast the 100-day plan accurately and avoid preventable disruption.

The Golden Hour Rule

You have a brief post-close window where requests for passwords, access, and documentation are viewed as standard integration activities. After the first few weeks, the same requests can be perceived as bureaucracy or lack of trust. Use the acquisition event to establish control cleanly and professionally.

Your Action Plan for Tomorrow:

1. Assign a Day 1 Commander: This person, likely an Interim CIO or external consultant, owns execution of the checklist.
2. Use a Visible Checklist: Physical or shared checklists reduce handoff errors.
3. Verify, Do Not Assume: When the acquired CTO says MFA is enabled, ask for the policy configuration and coverage report.

By securing control first, you earn the right to focus on integration later. Do not let unmanaged admin access become the reason your value creation plan starts behind schedule.