Technology due diligence: an initial screen
An initial conversation can identify where deeper investigation is needed. It cannot establish that an acquisition is ready to proceed, or replace technical, commercial and legal diligence.
Nine domains, one evidence trail
The accompanying scorecard has nine domains and 45 questions: infrastructure, security, engineering, technical debt, AI and data, team, vendors, regulation, and legal and policy controls.
For each answer, record the evidence, its date and the person able to explain it. An unanswered question is unknown. N/A means the question does not apply, and needs a reason. Neither is evidence of a strong control.
Follow the gaps
A high average can hide an important weakness. Review each low-scoring answer separately, alongside dependencies, customer commitments and the work needed to resolve it. The scorecard keeps a score of 1 visible as a critical issue, regardless of the overall average.
Completion means that the questions have been addressed. It does not mean that the evidence is complete or independently verified. Self-assessed scores organise the discussion; they are not transaction clearance.
Make findings useful
Separate observed facts, assumptions and unresolved questions. Give each finding an owner, the evidence needed to resolve it and the decision it may affect. Explain uncertainty rather than turning it into a confident rating.
A short first screen helps commission the next stage of work. Its useful result is a focused investigation plan, not a promise to audit a whole estate in a fixed time.
Review legal obligations in context
Identify the applicable jurisdiction, processing activity and sector before assigning a legal requirement. Notification thresholds, recipients and deadlines vary. Certifications and technical scans do not establish compliance with every applicable law.
Under UK GDPR, a reportable personal data breach must be notified to the ICO without undue delay and, where feasible, within 72 hours of awareness. Not every breach is reportable. Other jurisdictions and notification recipients require separate review.
Source: ICO: personal data breach reporting.