Day one is the first day the buyer owns the business. Customers still expect orders to ship and invoices to arrive, staff expect to be paid, and the phones need to ring. Day-one readiness is the work between signing and closing that makes sure all of that happens while control passes to new owners.
The aim is not integration. On day one, very little should change technically. The expensive failures are mundane: a missed payroll run, a former owner who still holds administrator access, a payment-fraud email that exploits the announcement, or two networks joined in a hurry before anyone checked the target was clean.
When it happens
Between signing and closing, which can be weeks or many months depending on approvals. You usually have more access than in diligence and the target's IT team is engaged, but the target is still run by its current owner.
Until closing, buyer and seller remain separate businesses in law. Competition rules limit what information can be shared and how much influence the buyer may exercise before closing. Agree with counsel what you may see and do, including whether a clean team is needed for sensitive data.
Who is involved
- The integration lead, who owns the day-one plan and the go/no-go decision.
- IT and security leads on both sides, who build and run the cut-over.
- The target's IT team, who know where everything is and will run most of the changes.
- The seller's IT team, where shared services or transition services are involved.
- HR and payroll, for leavers, pay continuity and staff communications.
- Communications, for the announcement and everything sent to staff.
- Legal counsel, for pre-closing limits, contract assignments and the transition services agreement.
- Business owners, for each critical process.
- Service desk leads, who will take the calls.
The steps
1. Define what must work on day one
List the critical business processes and the systems behind them. For each, define what "working" means, how you will prove it on the day, and what happens if it does not.
- Payroll, finance and banking
- Customer-facing systems: ordering, billing, customer support, websites
- Email, phones and building access
- Dependencies on the seller's shared services
- A test, an owner and a fallback for each item
- An explicit list of what will not change on day one
2. Take control of access
From day one you are accountable for who can reach what. That starts with an inventory of privileged and shared accounts, many of which sit outside the directory service.
- Privileged accounts in the directory service, email platform, cloud tenancies, firewalls, hypervisors and backup systems
- Accounts with the domain registrar, DNS host, certificate authorities and key suppliers' portals
- Credentials handed over through a secure channel and rotated on receipt
- Break-glass accounts created, tested and stored offline under dual control
- Access of departing staff, including the seller's people, removed at the agreed effective time
- Supplier remote access reviewed, with anything unexplained switched off
- Multi-factor authentication on every privileged account
3. Prepare communications and the phishing wave
Deal news attracts phishing: a "new payroll portal", "updated bank details from the new owners", a fake welcome pack. Warn staff on both sides before the announcement, and tell them what genuine messages will look like and where they will come from.
- Announcement timeline, with IT and security briefed in advance
- A staff warning about deal-themed phishing and payment fraud
- A call-back rule for any change to supplier or payroll bank details
- Email domains and signatures: keep the target's domain working, and agree any change to signatures, disclaimers and legal entity names with counsel
- No changes to mail routing on day one
4. Extend security monitoring and incident contacts
If something goes wrong on day one, it is your incident. Make sure someone is watching and everyone knows whom to call.
- Monitoring coverage confirmed for the target's endpoints, identity, email and internet-facing systems
- Incident contacts and escalation paths on both sides, including out of hours
- The target's incident response plan bridged to yours
- Cyber insurance and any incident response retainer checked for cover of the new entity, with the broker
5. Hold the line on interconnection
No network link, directory trust or shared administration until the connectivity gate from security due diligence is passed. Where people need to work together on day one, use methods that do not join the networks.
- The gate criteria restated, with a named owner
- Day-one collaboration through email between domains, guest access and meetings across organisations
- No site-to-site tunnels, directory trusts or shared administrator accounts before the gate
- An exception process that needs security sign-off, in writing
6. Set up support, transition services and contracts
Staff need to know whom to call, and the services the business depends on need to keep running under new ownership.
- The support model and contact details published to staff
- An escalation path between the target's and the buyer's service desks
- Transition services live at closing, with named contacts, service levels and a way to log requests (see carve-outs and transition services)
- Consents obtained for contracts and licences that need them, or a plan where they are not
- Domains, certificates and cloud accounts held by the right legal entity
7. Write the cut-over runbook and rehearse it
Every change made at closing, however small, goes into one runbook. Rehearse the riskiest steps before the day.
- Timed steps, with an owner and a check for each
- A rollback for every change, with a decision point for using it
- Go/no-go criteria and the person who decides
- A dry run of credential rotation and access removal
8. Run a command centre for the first week
Give day one a single place to report problems and make decisions, in a room, on a call bridge, or both.
- Staffed hours and an on-call rota
- An issue log with owner and severity
- A decision log
- A daily status to the integration lead
- Criteria for standing it down
Common traps
- Assuming the seller's administrator accounts will be removed without anyone listing them
- Finding on day one that the domain registrar account belongs to a former employee's personal email
- Changing mail routing or the email domain on day one because it looks simple
- Connecting the networks under business pressure before the gate is passed
- A payroll dependency on a seller system that nobody put in the transition services agreement
- Licences that terminate on change of control, found after closing
- Sharing sensitive data before closing beyond what counsel cleared
- Announcing a "new portal" that attackers can imitate within hours
- A runbook without rollback steps
What you hand over
- Day-one requirements with owners, tests and fallbacks
- An access control pack: privileged account inventory, rotation record, break-glass arrangements
- The cut-over runbook, with rollback
- The communications plan, including the phishing warning
- The support model and escalation paths
- The transition services catalogue and contacts
- Command centre issue and decision logs
- The connectivity gate and its current status, for the first 100 days
Where MNA Tools helps
- HouseGRC tracks what the target agreed to fix before closing and turns the day-one plan into owned, dated actions in the target's own organisation.
- SubnetSleuth needs its scan scopes agreed before day one: the ranges, the devices to start from, the networks never to touch and the read-only credentials. Settle them now so inventory can start once you have the credentials.
- DeepReview can be run again before closing to see what has changed in the target's public footprint, and whether the promised fixes are visible from outside.
A general guide to the technology side of a deal, not legal, tax or financial advice. Adapt it to the deal in front of you, and take advice where the stakes call for it.