IT Due Diligence When Buying a Business on the Eastern Shore

A generational handoff is underway on the Eastern Shore. Family businesses built over thirty and forty years, seafood processors and distributors, marine services, agricultural suppliers, trucking outfits, propane and fuel dealers, HVAC and plumbing companies, are changing hands as founders retire, sometimes to the next generation, increasingly to outside buyers and small private equity groups rolling up the trades.

The financial due diligence on these deals is usually thorough. The IT due diligence is usually a single line in a checklist: "Company owns computers and software. Yes." Then, three weeks after closing, the new owner discovers that the company website is registered to the founder's personal email, the accounting software license cannot be transferred, and the only person who knows the password to the server retired with the seller.

None of these problems is expensive to find before closing. All of them are expensive to find after. Here is the checklist.

1. Who owns the digital front door?

Start with the assets that are trivially cheap and catastrophically easy to lose:

• The domain name. Look up the registrar and confirm the domain is registered to the company, not to the founder personally, not to a web designer who built the site in 2011, and not to a defunct marketing firm. Confirm the seller can actually log in to the registrar account, and make transfer of that account an explicit closing deliverable. The domain carries the email and the website; losing control of it is losing the company's identity.
• The website and its hosting. Who hosts it, who can edit it, and is the hosting bill on a card that closes with the sale?
• Email. Is the company on Microsoft 365, Google Workspace, an ISP mailbox, or the founder's AOL address that customers have used for twenty years? Personal addresses woven into operations need a migration plan, not just a forward.
• Phone numbers. The main line and any numbers on trucks and signage: which carrier, whose name is the account in, and are they portable?
• Social accounts and review profiles. Ask who can log in to each. Recovering an orphaned business profile after the founder leaves is slow and sometimes impossible.

2. The credential inventory

Before closing, require a written inventory of every administrative credential: server and network equipment logins, the email admin console, accounting software, industry software, security cameras, alarm systems, online banking tokens, and the router password taped under the desk. Two rules of thumb:

• If a credential exists only in one person's head, that is a closing risk with a name attached.
• Plan a day-one password rotation. Former employees, the seller's relatives, and old vendors should not retain access to the company you now own, however friendly the transition. This is not distrust; it is hygiene, and any competent IT provider can script it.

3. Software licensing: what actually transfers?

This is the most common financial surprise. Software licenses are contracts, and many do not transfer with a business sale, especially in an asset purchase (as opposed to a stock purchase, where the legal entity and often its contracts continue). For each significant application, get answers in writing:

• Is the license perpetual or a subscription, and in whose name?
• Does the vendor permit transfer on change of ownership, and does the deal structure (asset vs. stock) change that answer? Your attorney and the vendor both get a say here.
• Industry-specific software deserves special attention: dispatch and routing systems, seafood and produce inventory software, field service platforms for the trades, farm management tools. These vendors are small, their transfer policies vary wildly, and the business may be operationally dependent on one of them.
• Look for unlicensed reality: five people using a two-seat license, or an "old version that still works" that has been out of support for years. You inherit the exposure either way.

4. Data: do you actually get it, and is it any good?

The customer list, order history, pricing, and job records may be most of what you are paying for. Verify that the data lives somewhere the company controls and exports cleanly, not solely inside a departing bookkeeper's personal spreadsheet or a software vendor's proprietary format with a fee to extract. Ask when the last backup restore was actually tested, where backups physically live, and whether any copy would survive a fire or a ransomware event. A business that cannot produce its data on request before closing will not get better at it after.

5. Contracts and infrastructure you are inheriting

• The IT support arrangement. Is there an MSP under contract, a local technician on handshake terms, or the seller's son-in-law? Get the contract, the rate, and the termination terms. You are not obligated to keep the incumbent, and the transition is a natural moment to run a real comparison, which is what our MSP broker service does for buyers at no cost.
• Internet and connectivity. Rural parts of the Shore have real constraints; confirm what service the sites actually have, what it costs, and what the options are before you assume cloud software will run smoothly at the plant.
• Hardware age. Walk the building. A server from 2016, Windows machines that cannot be updated, a network switch in a crab-house environment held together by salt and hope: none is a deal-breaker, but each belongs in your first-year capital budget rather than in the surprise column. Pricing out the refresh is a clean job for an RFQ.
• Compliance obligations that transfer with the work: food-safety recordkeeping, DOT logs, payment card handling at the counter, and any customer contracts with security requirements attached.

6. Key-person risk, the honest version

In a long-held family business, the real system of record is often a person: the office manager who knows which customer never gets charged delivery, the founder who knows why the pricing works. IT due diligence should name these people and plan for knowledge transfer during the transition period, because no server migration recovers what walks out the door at the retirement party.

Sequencing the first 90 days

After closing, treat the IT transition as a managed project with an owner and a timeline: credentials rotated day one, domain and accounts transferred week one, licensing regularized in the first month, email and data migrations scheduled deliberately rather than heroically. That is precisely the shape of engagement our IT project management service runs, and if the acquisition doubles as your chance to rethink the whole stack, start with an IT composition and strategy review so you migrate to the setup you want rather than replicating the one you bought. Buyers planning ongoing oversight across a portfolio of acquisitions should also read what a vCIO is; one strategy layer across several small companies is one of the strongest use cases for the role.