In the first 100 days after an acquisition, get visibility first (assets, accounts, data, vendors), fix urgent exposures second, connect identity and monitoring third, and merge policies last. Do not connect networks or share credentials until you know what the acquired company is running.
Before day one
If you have diligence findings, turn them into a short action list with owners. Agree who in the acquired company is your security contact. Decide in advance what you will not do yet, such as full network connection.
Remember that the acquired team is anxious. Early respect for their work pays off in cooperation.
Days 1 to 30: see everything
Build an inventory of what exists: cloud accounts, source code repositories, devices, SaaS applications, domains and third parties with data access. Ask for it, then verify with your own discovery, because lists from memory are incomplete.
Identify where sensitive data sits and who can reach it. List privileged accounts and shared secrets.
At the same time, check for signs of existing compromise in the acquired systems. Inheriting an unnoticed intrusion is a known risk of deals.
Days 31 to 60: close urgent gaps
Pick the exposures that could hurt you quickly. Typical candidates are internet facing systems with known serious flaws, missing multi-factor authentication on admin and email accounts, unprotected backups and leaked credentials in code.
Fix these in the acquired environment itself. Avoid a large migration while fixing urgent issues, since moving things adds risk.
Scan the acquired software for dependencies and licence issues. If you plan to ship the code in your own products, you inherit its supply chain.
Days 61 to 100: connect carefully
Bring identity under common control in stages, starting with a shared way to authenticate and a clean joiner and leaver process. Add monitoring so incidents in either company reach the same response team. Share a single incident contact list.
Only connect networks and shared tooling after the acquired side meets a defined minimum standard. Publish that standard so there are no surprises.
Policies and compliance
Do not rewrite every policy in the first quarter. First map the acquired company's obligations, contracts and audit scope. Customers may have security terms that continue after the deal. Then decide which controls to align and set dates.
Report progress
Track a handful of measures: percent of assets inventoried, critical findings closed, privileged accounts reviewed, and share of staff on common identity. Share them with both leadership teams every two weeks.
Quick check
Should I connect the networks on day one?
No. Connect only after you know what is on the acquired side and it meets a minimum security standard.
What is the first thing to do after closing?
Build a verified inventory of assets, accounts, data and vendors, and check for signs of existing compromise.
Last reviewed: 19 October 2026.
