The 18-month runway: getting IT ready before the bankers show up

There is a version of the sale process every owner imagines: the banker runs a tight auction, buyers compete, the quality of the business speaks for itself. Then there is the version where, 6 weeks into exclusivity, the buyer’s IT diligence team asks for the disaster recovery test results, the software license inventory and the list of who has administrative access to the ERP, and the answers require archaeology. Nothing about the business changed between those 2 moments. What changed is that questions were being asked faster than a company can build the answers.

IT rarely kills a deal. What it does, reliably, is create retrade conversations, escrow holdbacks and closing-condition punch lists in the last weeks, when leverage sits entirely with the buyer. The pattern is well documented from the buy side, and we wrote about what diligence teams actually examine in PE cybersecurity diligence. This post is the mirror image: what a seller does with 18 months of runway so that examination finds a clean room.

Why 18 months and not 6

Some of what diligence checks cannot be produced retroactively. A backup restore test performed last week, during the process, proves you can pass a test under pressure. Four quarterly test records spanning the past year prove the discipline exists. The same time-dependence applies to security monitoring history, to patch cadence, to access reviews and to incident documentation. Buyers and their advisors read dates. A folder of artifacts all created in the 90 days before the teaser went out tells its own story, and not the intended one.

Eighteen months is enough runway to generate a year of genuine operating history plus the remediation quarter most companies need up front. Twelve works. Six forces triage. Starting later than that is still worth doing, it just compresses the options, and the honest advice is that the best time to start was at your last insurance renewal.

The 5 workstreams, in priority order

1. Documentation that matches reality

Diligence begins with a request list, and half of it is documents: network diagrams, asset and license inventories, vendor contracts, org charts for IT responsibility, policies. The bar is not elegance. The bar is current and true. An out-of-date diagram is worse than none, because every discrepancy found teaches the buyer’s team to double-check everything else. The starting kit is the same one we described in IT documentation for small business, aimed at a reader you have not met yet.

2. Access hygiene, the fastest credibility win

Who can log into what is the first thing technical diligence tests and the cheapest thing to fix. Former employees with live accounts, shared admin passwords, contractors with standing VPN access and an ERP where half the company holds administrator rights all read as management inattention. A quarter of steady offboarding cleanup, MFA completion and admin-rights reduction changes the read entirely, and none of it requires spending beyond the hours.

3. Provable resilience

Every buyer’s checklist now includes ransomware questions, because every buyer has seen a portfolio company lose a quarter to one. What they want is evidence, not adjectives: immutable backups with restore-test records, an incident response plan with a date and a tabletop behind it, endpoint detection with someone watching it. Operators who run tested restores on a calendar produce this evidence as a by-product of operating well, which is rather the point.

4. The untangling list

Most lower-middle-market companies carry some structural debt that becomes a diligence question: software licensed personally to the owner, the domain registered under a founder’s personal account, a sibling company sharing the file server, the plant Wi-Fi on the owner’s home ISP account. None of it is scandalous. All of it takes weeks-to-months of lead time to unwind cleanly, which is exactly what the final weeks of a process do not have. Build the list early, unwind steadily.

5. The narrative, one page

Diligence teams write a report for an investment committee. Hand them the summary you want them to start from: what the IT environment is, what was invested in the past 2 years, what is planned, what it costs to run. When the seller’s one-pager and the diligence findings match, the whole workstream shrinks. We covered how buyers translate this into price in cybersecurity and enterprise valuation: a clean program rarely raises the multiple on its own, but it removes the reasons buyers discount, retrade or hold back escrow.

What this looks like from the sponsor’s side of the table

Sponsors preparing a portfolio company for exit run this same list, usually with more force and a set deadline. We operate as the post-close IT partner for a lower-middle-market PE portfolio company we carved out from its publicly-traded industrial-services parent operator, and the discipline that made its standalone IT credible, documented builds, evidence-backed operations, quarterly reporting the operating partner could forward without editing, is precisely the discipline that makes a seller credible at exit. The cadence is the same whether the audience is a sponsor’s board deck or a buyer’s diligence team. For operators earlier in that lifecycle, the 100-day post-close plan builds the habits that make exit prep nearly automatic when the time comes.

The quiet payoff either way

Here is the part that makes the 18-month runway an easy decision: every item on it is something the business should want anyway. Tested backups, clean access, current documentation and a vendor list without zombies are Tuesday-morning operational hygiene that happens to be denominated in enterprise value at exit. If the sale slips a year, nothing was wasted. If a surprise buyer calls early, and surprise calls are how a striking number of lower-middle-market deals begin, you answer the request list instead of scrambling for it.

The full sell-side and buy-side picture, including how diligence depth scales with deal size, is in our PE portfolio cybersecurity guide. And if a transaction is somewhere on your horizon, even a hazy one, start a conversation. Eighteen months goes faster than it sounds.