50-item checklist · PDF + interview script
Run technical due diligence on a small acquisition the right way, in one focused week.
A 50-item TDD checklist plus interview script for acquirers, search funds, and investors evaluating SMB tech-enabled businesses. Surface code, security, infrastructure, and team risk on a structured rubric — before you sign the LOI and before you commission a full paid TDD.
Most SMB acquisitions skip real technical due diligence — until they should not have
The SMB acquisition market does substantially less technical due diligence than it should. A typical $5M-EV tech-enabled SMB transaction will see meticulous QofE work from the financial side, careful customer-concentration analysis from the commercial side, and then a 30-minute Zoom call with the founder-CTO that passes for technical due diligence. The acquirer takes ownership of a codebase, an infrastructure footprint, and a team — and finds out about the 12-year-old monolith, the four production database instances on the founder's personal AWS account, the pending GitHub security alerts, or the contractor-managed credentials only after close.
This checklist is built to fix that. It is what we hand to acquirers, search funds, and PE associates before they walk into a TDD screening call. The 50 items map to the risk categories that matter — code quality, security, infrastructure, team resilience, compliance exposure, and post-close transition risk — with structured interview questions designed for a 60-minute call with the seller's engineering lead. It is not a substitute for a paid TDD engagement; it is the artifact that tells you whether a paid engagement is warranted on this specific target.
Inside the 50-item checklist
- Section 1 — Business and technology overview (6 items). Core product surface, stack, hosting footprint, the 5 most-used screens, and the 5 most-changed files in the last 6 months — a fast signal of where complexity actually lives.
- Section 2 — Codebase health (8 items). Repository structure, test coverage, CI/CD posture, the 90-day commit cadence, contributor concentration (a single-contributor codebase is a flag), and the documented architectural decisions.
- Section 3 — Infrastructure and operations (7 items). Hosting account ownership, IaC posture, secrets management, backup and disaster recovery, monitoring and alerting, on-call structure, and the post-incident retrospective practice.
- Section 4 — Security posture (8 items). Vulnerability surface, dependency hygiene, secrets exposure, authentication patterns, RBAC, audit logging, recent security incidents, and the SOC 2 or equivalent attestation status.
- Section 5 — Compliance and data (6 items). The regulatory regimes the target operates under (HIPAA, PCI, GDPR, CCPA, GLBA), the customer-data inventory, the data-residency posture, the data-retention policy, and the audit history.
- Section 6 — Team and key-person risk (6 items). Engineering headcount, contractor concentration, the bus-factor list (which engineers know critical systems that no one else does), the documented onboarding flow, and the retention plan post-close.
- Section 7 — Vendor and third-party risk (5 items). Critical SaaS dependencies, the contractor and supplier list, the vendor data-processing agreements, and the third-party SLAs that affect product reliability.
- Section 8 — Customer and integration risk (4 items). Customer-facing integrations, the top-customer dependency on custom code, the open-feature-request queue, and the customer-side SLAs the platform must hold.
- Section 9 — Interview script and risk-flag rubric. A 60-minute interview script for the seller's engineering lead, a risk-flag rubric mapping checklist responses to red/yellow/green status, and a one-page summary template you can attach to your IC memo.
Who this is for
The checklist is built for five buyer profiles. First, search fund principals running a self-funded or traditional search who are about to enter LOI on their first tech-enabled SMB acquisition. Second, PE associates and VPs at lower-middle- market firms evaluating add-on acquisitions to a tech-enabled platform. Third, family offices and HNW individuals making direct SMB acquisitions in the $2M-to-$30M EV range. Fourth, angel investors and small institutional investors evaluating early-stage tech-enabled businesses where the engineering posture materially affects the investment thesis. Fifth, strategic acquirers at companies in the 10-to-500-employee range making a competitive or capability-driven acquisition.
The checklist also works in reverse: if you are a founder preparing your business for sale, walking through the 50 items yourself before a buyer does is the cheapest way to find out where your business has TDD risk — and to fix or document it before it shows up in someone else's report.
What you will learn
You will leave with a structured way to evaluate any tech-enabled SMB target in under a week, a 60-minute interview script you can run with the seller's engineering lead, and a one-page IC-memo-ready summary template. You will also have the vocabulary to distinguish the risk flags that should kill a deal from the ones that are normal at this scale and can be addressed post-close.
On the diligence calendar, you will have a defensible structure for the first week of technical evaluation. Day 1 and 2 are the checklist read on materials in the data room. Day 3 is the 60-minute interview with the seller's engineering lead. Day 4 is the synthesis and risk-flag rollup. Day 5 is the decision: proceed to paid TDD, proceed to LOI without paid TDD, or pass. This calendar fits inside the typical SMB acquisition timeline without forcing the deal team to extend exclusivity.
On the risk side, you will know which findings warrant a price adjustment, which warrant a holdback or indemnification carve-out, and which are simply post-close remediation work that fits into the first 90 days. The risk-flag rubric in Section 9 maps each of the 50 items to a recommended action so the diligence read is productive even when the seller-side engineering team is small.
How this connects to our work
We run paid TDD engagements for acquirers and search funds throughout the year, and this checklist is the lightweight version of the artifact set we produce on a full engagement. After close, our custom business software and DevOps engineering practices are typically the ones executing the 30-60-90 remediation plan that follows. If your target has a security or compliance exposure that surfaces in the checklist, our penetration testing and MITRE ATT&CK assessment offerings are the typical next steps.
For the broader engineering-quality framework, pair this with the MVP to Production Playbook — which is the post-close standard most targets need to be brought up to. For pricing on a paid TDD engagement, see our pricing page or book a call. Recent TDD engagements and post-close remediation projects are listed on our work page, and you can learn more about how we engage on our about page.
Frequently asked questions
Who is this technical due diligence checklist for?
Acquirers, search funds, PE associates, family offices, and angel investors evaluating SMB acquisitions of tech-enabled businesses in the $1M-to-$50M EV range. Also useful for non-technical founders on the sell side.
Is this a substitute for a full TDD engagement?
No. A full TDD is typically a 2-to-4-week scoped review with a senior engineer reading the codebase and producing a written risk report. The checklist is the artifact you walk through on the 60-minute screening call before commissioning a paid TDD.
Does it cover security and compliance specifically?
Yes. Sections 4 and 5 cover security posture and compliance regimes (SOC 2, HIPAA, PCI, GDPR) that may apply to the target. The checklist flags questions you must ask before signing an LOI when these factors are in play.
What if I am the seller, not the buyer?
The checklist works in both directions. As a seller, walking through the 50 items before a buyer does lets you fix or document common risk flags before they show up in someone else's report.
What happens after I download?
You get the PDF immediately and one short follow-up email. If you want a paid TDD review on a specific target, book a 20-minute scoping call. We have run TDD engagements at sizes from $2M to $40M EV.
Related resources & reading
MVP to Production Playbook
The post-close standard most targets need to be brought up to.
MITRE ATT&CK Self-Assessment v2
The security maturity artifact that pairs with the TDD security section.
Web App Pentest Checklist
When the TDD security finding warrants an external pentest before close.
Penetration Testing
Attack-side validation for high-stakes acquisitions.
In LOI on a target? Get a paid TDD that fits the deal timeline.
If the checklist surfaces flags worth a deeper read, our paid TDD engagement runs 2 to 4 weeks and produces a written report with risk findings, remediation cost estimates, and a 30-60-90 post-close plan. See our pricing or book a call.