IT Due Diligence Checklist and Baseline Methodology
IT Due Diligence Checklist and Baseline Methodology
IT due diligence checklist and baseline method: domain checklist, evidence index, cautious risk language and a baseline report.
This is not legal advice. This case describes a technical due diligence methodology only; it is not a certification or a legal opinion.
Project context
- Setting: Cross-border M&A or investment context involving China ops
- Scale: Target company with office + light infra
Challenge
Investors or HQ acquiring/operating a China entity need a repeatable IT due diligence checklist and baseline report structure. Ad-hoc Word docs miss domains (identity, OT adjacency, contracts). This case describes Easyton’s checklist methodology.
Environment
- Time-boxed diligence window
- Partial access to rooms/configs
- Language mix CN/EN
- Sensitive findings routed to counsel
Solution architecture
Text view of the architecture (each line: component → what it connects to):
Checklist domains → Evidence collection Evidence collection → Qualitative risk language Qualitative risk language → Baseline report Baseline report → Optional post-close action plan
Typical domains
- Identity & directory
- Endpoints
- LAN/WLAN
- Edge & remote access
- Servers/NAS
- Backup/restore evidence
- SaaS inventory
- CCTV/ACS
- Vendor contracts
- People/process RACI
- Compliance artifacts as provided
Technical highlights
Evidence over assertion
- Prefer config export snippets (redacted), photos of racks, restore test witnesses.
- Mark “not evidenced” explicitly—avoid filling gaps with optimism.
Risk language
- Use cautious qualitative grades agreed with client counsel.
- Easyton does not certify compliance with PIPL, GDPR or any other regulation.
Baseline report structure
- Scope & limitations
- Domain findings
- Evidence index
- Priority themes
- Suggested near-term and post-close actions (suggestions, not commitments, unless contracted)
Handoff
- Diligence team vs future ITO partner may differ; package should still be readable.
Implementation steps
- NDA/access
- Kickoff scope
- Onsite/remote collection
- Draft baseline
- Fact-check workshop
- Final baseline and optional post-close proposal
Acceptance
- Every domain either evidenced or marked gap
- Limitations section present
- No unsupported numeric risk scores
- Client acknowledges receipt
Deliverables
- Standard checklist
- Evidence index template
- Baseline report
- Optional post-close plan outline
Outcome
A reusable IT DD checklist and baseline methodology enabling structured diligence conversations.
Related
Easyton has delivered IT infrastructure and support projects since 2009. Planning something similar? Contact Easyton to discuss your requirements.
