Why investors look at your IT
You are raising investment or selling your company, and the investor sends you a due diligence checklist. It is a large document, and a big part of it covers IT: your systems, your security controls and how you handle data. The investor performs this IT due diligence to understand the risks they are taking on, and what it will cost to fix them. The outcome of this assessment will decide whether the deal will be closed or not, so the stakes are high.
For a small business without a security team, this can feel like a very difficult exam. Some answers are only known to your IT provider(s), others you can probably retrieve by asking a colleague who has been with the company for a while, and some don’t exist yet or are a big unknown. As a result, preparation and a good understanding of what is being asked go a long way to successfully address this otherwise complicated questionnaire.
The good news is that you don’t need perfect answers. You just need clear, honest ones, backed by evidence where possible. And this is exactly where preparation and clarity come in. Below are the most common IT due diligence questions investors typically ask, and the four steps we recommend you take to prepare for them.
The IT due diligence questions investors ask
While the wording of each question might be different (depending on the investor), those questions typically cover the following items and areas:
| Area | Typical questions |
|---|---|
| IT systems and ownership | What systems and cloud services do you use? Who manages them? Is there an up-to-date list you can share with us? |
| Access and security basics | Who has admin rights? Do you use multi-factor authentication (MFA)? Are devices encrypted and kept up to date? |
| Backups and recovery | Are backups in place and tested? How long would it take to get your systems or services back up and running after an outage? |
| Security incidents | Have you had a security incident or data breach within the last X years? How did you handle it, and who did you inform? What data did it affect? |
| Data protection (GDPR) | What personal data do you hold, and where? Do you have data processing agreements with your suppliers? Do you store data overseas? |
| IT suppliers and contracts | Which suppliers are critical to your business? What do the contracts say about notice periods, change of ownership and exit? Do you have a way to manage and oversee your suppliers? |
| Key people and documentation | Who knows how your systems work? Is it written down? Are roles and responsibilities clearly defined? |
| Software and licences | Do you own the software you built? Are all licences valid, including open-source ones? |
| Known gaps and costs | Which systems need replacing soon? Which security improvements are planned, and what will they cost? |
Investors may also ask for supporting documents, such as policies, an IT asset list, supplier contracts, insurance policies and past security assessments. If clients have sent you security questionnaires before, those answers are a useful starting point. For this, we advise that you read our blog entry on how to answer a security questionnaire without a security team.
We get it – addressing the above topics can seem daunting. Following the steps below can, however, bring the necessary structure and process to address such questions in the most efficient and accurate way possible:
Step 1: List what you have
Keep a live record of all your systems, cloud services, devices and IT suppliers, and who manages each one. A simple Excel (or similar) spreadsheet is a good start. This list answers many questions on its own, and it shows the investor you know your own setup. It will add structure to your daily operations, and it will be very useful when such requests come your way. You can always go back to the inventory to find some of the answers you seek. Your main obligation is to ensure it is kept up-to-date, as things can dynamically change.
Do you wish to create the order and structure needed to address such inquiries now? An EvRisko risk score shows where you stand and what to fix first.
Step 2: Find the quick wins
Some gaps are cheap and easy to close. Fix these before the investor asks:
- Turn on MFA for email, cloud services and all admin accounts.
- Remove accounts of people who have left the company.
- Ensure each user has access to only what they need to perform their tasks.
- Make sure laptops and phones install updates automatically.
Each fix turns a “no” into a “yes” you can back up when asked by an investor. The other positive is the fact that those quick fixes immediately improve your IT posture and make your company a more trustworthy business partner, service provider or potential collaborator. We recommend you actively try to close gaps and address issues to bring your risk down and your IT maturity up.
Step 3: Gather evidence in one place
Investors usually work from a data room: a shared, access-controlled folder of documents, where all relevant information is collected and analysed. It is a good idea to prepare an IT section (in other words, a data repository) with your system and supplier list, key supplier contracts, policies, insurance and any past assessments. Use that repository to host all information, and update it as needed to ensure accuracy and currency.
One important point to consider – always take confidentiality of the information into account. Share security details only after a non-disclosure agreement (NDA) is signed with the investor, and only through the data room.
Step 4: Explain gaps with a plan
Every company has gaps. There is no point hiding issues and problems that can affect a partnership and damage your company’s reputation. What matters is that you know your IT shortcomings and have a plan to address them.
For each gap, say what you do today, what you will improve, and by when. For example:
“We don’t have a written incident response plan yet. Our IT provider handles incidents today, and we plan to have a written plan by the end of the year. Here is a snippet of the already-drafted table of contents.”
Explainability and directed focus go a long way when IT questions start piling up.
Three mistakes to avoid
- Don’t hide incidents. If you had a data breach or a serious outage, say so and explain what you did to address it. Investors usually ask you to confirm in the deal contract that your answers are accurate, and they probably already know the answer anyway. A problem they find later can lower the price or lead to a claim.
- Don’t overclaim. Only mention certifications you actually hold and controls you actually have in place. Your cloud provider’s ISO27001 certificate covers the products or services they provide to you, not your whole company. An absent/inefficient control is not worth mentioning or defending.
- Don’t wait until the deal starts. Due diligence moves fast. Gaps you fix early cost less and leave you time to do it properly. The more proactive the approach, the better the result.
How EvRisko helps
Investors check the same basics as clients and insurers: access, backups, incidents, data and suppliers. Knowing where you stand before the questions arrive puts you in a stronger position at the table.
EvRisko asks plain-language questions about your IT setup. You get a risk score from 0 to 100, rated Poor, Fair or Good, and a list of what to fix first. A first score takes about 25 minutes, and no technical knowledge is needed. You can export the results as a PDF report to help you prepare your answers.
14 days · No credit card required
Start your 14-day trial →Frequently asked questions
What is IT due diligence?
It is the part of a due diligence review that checks a company’s IT systems, security and data handling. Investors and buyers use it to spot risks and costs before they commit.
When does IT due diligence happen?
Usually after an initial offer is agreed and before the final contract is signed, although many investors proactively send an IT questionnaire earlier in the process.
Do I need ISO27001 before raising investment?
Not necessarily. Investors mainly want to see sensible security basics, honest answers and a plan for the gaps. A certification helps, but it is not a requirement for every deal. Of course, this also depends on the industry you operate in and the data you process.
What documents should I prepare for IT due diligence?
A list of your systems and IT suppliers, key supplier contracts, security and data protection policies, your cyber insurance policy, and records of backup tests, incidents and past assessments. Always take confidentiality into account prior to sharing any information with investors.