From Term Sheet to Single Sign-On: A 90-Day IT Integration Plan for UK Acquirers

UK SME acquisitions are usually run as finance and legal projects. The completion accounts are checked, the warranties are negotiated and the announcement is drafted. IT is often invited late, usually after signature, when the buyer discovers that the target runs a different email tenant, keeps shared passwords in a spreadsheet and has a broadband contract that cannot be assigned without consent.

The risk is not abstract. Duplicated identities create access control gaps. Incompatible networks slow every site move. Inherited software can carry auto-renewals, weak security terms and data processing arrangements that do not survive a change of control. Cyber weaknesses that were tolerable in a smaller business become material when they sit inside a larger group.

A 90-day plan will not deliver a full technology merger. It should deliver control: known assets, secure identities, tested communications, visible contracts and a board that understands what remains to be done.

Before signing: make IT a diligence workstream

IT due diligence should sit alongside finance, legal and commercial review. The aim is not to audit every cable. It is to identify dependencies, liabilities and risks that affect price, timing or integration cost.

Ask for the identity and email picture first. Which directories are in use? Who holds global administrator rights? Is multi-factor authentication enforced for all staff and contractors? Which domains, aliases and shared mailboxes exist? Are there personal accounts being used for business purposes? These questions reveal how much control the target actually has.

Then request an asset and contract view. Include endpoints, servers, cloud services, network equipment, phone systems and any connected devices in offices or meeting rooms. For contracts, look for change-of-control clauses, assignability, auto-renewal, minimum terms, exit assistance and data processing terms. A software licence that is cheap today may be expensive or unusable after completion.

Cyber diligence should be proportionate but specific. Has the target had a incident in the past two years? Are backups tested or merely taken? What is the patch position for internet-facing systems? Does the business hold Cyber Essentials, and if so, is it current? Are there remote access tools that bypass normal controls? The answers should feed the completion conditions, not just a red-amber-green summary.

Data diligence matters under UK GDPR. The buyer needs to understand what personal data is held, where it sits, why it is retained and which suppliers process it. Retention schedules, subject access requests and any data protection impact assessments should be visible. If the target handles special category data or large volumes of customer data, the integration plan needs more scrutiny, not less.

Board-level questions before signing should include: who will own IT integration after completion; what breaks if a critical vendor refuses consent; what cyber remediation is required in the first 30 days; which systems must remain separate; and what budget is reserved for duplication, licence true-ups and early termination. A board that cannot answer these questions is buying uncertainty.

Days 1 to 15: stabilise and map

Completion day should begin with control, not change. Appoint a single integration lead with authority across IT, finance and operations. Freeze non-essential changes for a short period. Preserve logs and evidence. Confirm that backups exist and can be restored. Reset privileged accounts and remove departed or unknown users. Confirm the incident response contact route for both organisations.

Build one source of truth. The register should cover identities, endpoints, applications, data flows, network links, vendor contracts and support arrangements. Label each item as retain, migrate, replace or retire. Do not assume that integration means merging everything. Some systems should stay separate because separation is cheaper, safer or contractually required.

Days 16 to 30: identity and email first

Identity is the control plane for almost everything else. Audit both directories, confirm domain ownership, enforce multi-factor authentication and remove stale accounts. Decide on the target identity model before moving mailboxes. A rushed tenant migration can create duplicate mail flow, broken calendar permissions and lost distribution lists.

Email migration needs a tested sequence: domain records, mail flow, spam filtering, signatures, shared mailboxes, archives and mobile devices. Communicate to staff in plain language. Users tolerate change if they know when it happens and what they must do. They do not tolerate missing email.

Endpoint work should start in parallel. Inventory devices, confirm encryption, check endpoint protection, remove local administrator rights where possible and identify unsupported operating systems. Do not join every device to the corporate estate on day one. Quarantine first, then remediate.

Days 31 to 60: networks, vendors and cyber gaps

Network integration is where physical and logical risks meet. Map site links, VPNs, Wi-Fi, IP ranges and firewall rules. Avoid extending a flat network across the group. Segment where practical, particularly for guest access, operational technology and any building or meeting-room devices.

Vendor management needs the same discipline. Consolidate overlapping software, confirm licence entitlements, update data processing agreements and record renewal dates. Where a contract cannot be assigned, negotiate a short bridge or an early exit. The cheapest contract is not always the one with the lowest unit price; it is the one the buyer can actually use and terminate.

Cyber remediation should focus on the critical few: multi-factor authentication, privileged access, patching of internet-facing systems, tested backups, logging and endpoint protection. Track actions in a register with owners and dates. Report progress to the board in business language: what risk is reduced, what remains and what it will cost.

Days 61 to 90: cut over and prove control

Complete the remaining mailbox, file-share and application migrations. Decommission what is no longer needed. Update the asset register and vendor register. Run an access review for both legacy and new accounts. Test the incident response plan across the combined estate. Hand over to business-as-usual ownership with named accountable people and a small set of metrics.

The final board report should be honest. It should state what has been integrated, what remains separate, what cyber risk has been accepted and what budget is required for the next quarter. Acquisition integration is not a one-off project. It is the point at which the buyer proves whether it can govern inherited technology.