What is the Lazarus Alliance IT Pre-Acquisition Assessment?

It is a structured, phased cybersecurity and IT due diligence review specifically designed for any organization undergoing M&A or private-equity transactions. Using a detailed Client Request List (CRL), it evaluates the target firm’s IT governance, security controls, data protection, regulatory compliance, and transition readiness across 8 key sections.

Why is the assessment divided into Wave 1 and Wave 2?

The two-wave structure respects the operational capacity of a target organization. Wave 1 (18–20 items) delivers the highest-risk information within 14 days. Wave 2 (≈42 items) is issued only after Wave 1 review, so the scope can be adjusted based on findings, reducing unnecessary effort.

How long does the full assessment take?

The compressed timeline is 4–8 weeks from kickoff. Wave 1 is due in 14 days, Wave 2 collection takes ≈2.5 weeks, and the remaining time is used for analysis and final report delivery. Fast-track engagements can be completed in 4–6 weeks with strong MSP support.

What if a requested document or policy does not exist?

Simply upload a brief written confirmation (Word doc or email converted to PDF is fine). The absence of key documents is noted as an audit finding but is expected for many small firms and will not be penalized.

Do we need to involve our Managed Service Provider (MSP)?

Yes — we strongly recommend looping in your MSP at kickoff. Many Wave 1 exports (user accounts, MFA status, EDR coverage, patch reports) are most efficiently pulled directly from the MSP console.

How are documents submitted and tracked?

All documents, system exports, configuration records, and written confirmations are uploaded directly into the AI-powered Continuum GRC platform — Lazarus Alliance’s secure, enterprise-grade Governance, Risk, and Compliance system. Every submission is automatically protected with cryptographic hashing for immutable, tamper-proof evidence and a complete chain-of-custody. The platform’s intelligent evidence management engine automatically maps files to the corresponding audit steps, while built-in AI auditor tools perform real-time validation, gap detection, and compliance analysis. Progress is monitored through live dashboards with dynamic status tracking (NR, OS, PR, RC, NA, EX), automated alerts, and intelligent remediation recommendations — delivering a fully auditable, transparent, and highly efficient due diligence workflow.

What are the main benefits of this assessment?

It provides immediate visibility into hidden risks, protects deal value through early identification of liabilities, ensures FTC Safeguards Rule / GLBA compliance, smooths post-acquisition transition, and gives the acquiring firm concrete data for valuation adjustments and remediation planning.

Does the assessment cover regulatory compliance?

Yes. Section F is dedicated to FTC Safeguards Rule (Gramm-Leach-Bliley Act) compliance, including the Written Information Security Program (WISP), Qualified Individual designation, risk assessment, training, and vendor oversight.

What deliverables will the acquiring firm receive?

A comprehensive final report with findings, risk ratings, gap analysis, prioritized recommendations, and transition considerations. The report is delivered to the deal team and can be used for negotiation, indemnification, or post-close remediation planning.

IT Pre-Acquisition Assessment Services | M&A Cybersecurity Due Diligence

Why IT Pre-Acquisition Assessment Matters

Hidden IT and cybersecurity risks can erode deal value, create post-close liabilities, and complicate integration. A focused pre-acquisition assessment surfaces critical issues early, supports valuation adjustments and indemnification, and reduces surprises after closing.

Lazarus Alliance assessments are purpose-built for M&A timelines and work across industries including finance, healthcare, technology, manufacturing, professional services, and private-equity portfolio companies.

	Challenge	Business Impact	How We Address It
🔍	Hidden cybersecurity and IT risks	Deal value erosion and post-close liabilities	Rapid Wave 1 review of highest-risk items within 14 days
⚖️	Overwhelming the target company	Slow responses and incomplete data	Phased two-wave structure that respects operational capacity
📜	Regulatory and compliance gaps	Unexpected remediation costs or deal delays	Customizable coverage (FTC Safeguards, HIPAA, PCI DSS, ISO, CMMC, and more)
🔄	Incomplete transition visibility	Integration surprises and operational disruption	Dedicated focus on systems, contracts, credentials, and data preservation
📊	Lack of clear, actionable findings	Difficulty negotiating or planning remediation	Prioritized risk ratings, gap analysis, and concrete recommendations

Assessment Scope – 8 Critical Sections

IT Governance and Asset Inventory: Policies, MSP ownership, hardware/software inventories, business continuity/disaster recovery
Identity and Access Management: User accounts, MFA, privileged access, password policies
Endpoint and Network Security: EDR/AV, patching, firewalls, vulnerability scanning, network diagrams
Data Protection and Confidentiality: Backups, encryption, data flows, storage locations
Cloud and SaaS Environment: Microsoft 365 posture, DLP, external sharing, AI tools, SOC 2 reports
Regulatory Compliance: Customizable review of applicable frameworks (FTC Safeguards Rule/GLBA, HIPAA, PCI DSS, ISO 27001, CMMC, SOC 2, and others)
Cyber Incident History and Threat Exposure: Incident summary, cyber insurance, phishing tests, external attack surface
Transition-Specific Information: System inventories, contract terms, data preservation, departing staff considerations

Our Phased Methodology

Wave 1 (Highest-Risk Items – Due in ~14 Days)
Approximately 18–20 priority items focused on the most material risks (MSP contract, MFA status, EDR coverage, backups, basic user accounts, incident history, cyber insurance, etc.). Results determine whether deeper investigation is warranted.

Wave 2 (Detailed Review – Issued After Wave 1)
Approximately 42–44 additional items covering detailed policies, scans, data-flow maps, admin reviews, and supporting evidence. Scope can be narrowed or expanded based on Wave 1 findings.

Submission Approach
Target companies (and their MSPs) upload evidence into a secure portal. Clear format guidance is provided. Missing items are noted as findings but are not penalized when confirmed in writing.

Typical Lazarus Alliance Audit Timeline

The CRL explicitly defines only the first milestone; the rest follows standard pre-acquisition due diligence logic (aligned with deal timing). Here is a realistic timeline based directly on the framework:

Phase	Timing (from Kickoff)	Key Activities	Owner
Kickoff & CRL Issuance	Day 0	Full Client Request List issued + Continuum GRC access	Lazarus Alliance and Deal Team
Wave 1 Collection	Days 1–14	18–20 highest-priority items (MSP contract, users, MFA, EDR, backups, etc.)	Target firm + MSP
Wave 1 Review & Wave 2 Issuance	Days 15–18	Rapid review of Wave 1, red-flag identification, and tailored Wave 2 issued	Lazarus Alliance
Wave 2 Collection	Days 19–35 (≈2.5 weeks)	Remaining ~42 items (detailed policies, scans, SOC 2 reports, etc.)	Target firm + MSP
Full Analysis & Gap Assessment	Days 36–45	Detailed risk mapping, FTC/GLBA review, and deal implications	Lazarus Alliance
Findings / Report Delivery	Days 46–56 (Week 7–8)	Final report delivered to the deal team	Lazarus Alliance and Deal Team

Total typical duration: 4–8 weeks

Fast-track (4–6 weeks): Possible with immediate MSP coordination and rapid Wave 2 turnaround.
Standard (6–8 weeks): Recommended for most acquisitions to allow thorough review.

This compressed schedule front-loads the highest-risk items (still completed in the first two weeks) and keeps the entire engagement agile for tighter deal timelines. All documentation continues to be managed in the Continuum GRC portal.