The deal has closed and the business wants the two companies connected. Before you join a single network or federate a single directory, you need a defensible day-1 posture: isolate first, assess, and extend trust only to what you have vetted. This checklist gives you the structure to record that — the pre-connect gates, the identity and domain-trust decisions, the inherited-risk triage, the isolate-first network posture, the 30/60/90 plan, and who signs off on the risk of connecting.
Educational template — not legal or security-engineering advice. Inherited data obligations and breach liability are fact- and jurisdiction-specific; adapt this with your own security, legal and privacy advisers.
Free · no signup · adapt it in your own doc
M&A Day-1 Security Integration Checklist
For the first hours and days after an acquisition closes. This checklist records the day-1 security integration decisions for a newly acquired company under an assume-compromise posture: what stays isolated until vetted, the identity and domain-trust calls, the inherited-risk triage, and the 30/60/90 sequence. It is about post-close integration, not pre-deal due diligence.
01Pre-connect gates — do not connect until
On close day you know nothing verified about the acquired environment. Treat every item below as a gate that must be satisfied before the two companies are joined. Default posture: isolated, trust earned not granted.
A rapid compromise assessment / EDR sweep has run across the acquired estate and come back clean (no evidence of active intrusion)
Inherited internet-facing assets are inventoried and known/exposed vulnerabilities triaged
Privileged account credentials have been force-reset; shared and service accounts inventoried
The acquired directory (AD/IdP) has been vetted for stale admins, unexplained trusts and golden-ticket exposure before any federation
Regulated/sensitive data acquired has been identified and its legal, residency and contractual obligations understood
Endpoint EDR and identity MFA are deploying across the acquired environment
A named executive risk owner has signed off on any connection that proceeds before a gate is fully met
Business pressure to "integrate fast" does not retire a gate. Accepting an unmet gate to hit a synergy date is a documented risk-acceptance decision made by a named executive (section 6) — never a quiet technical shortcut.
02Identity & domain-trust decisions
A forest trust, SSO federation or directory merge extends your identity blast radius into a directory you have not vetted. Do not federate or establish domain trust on day 1. Record the decision and the vetting that must precede it.
Acquired identity system(s)
On-prem AD / Entra ID / Okta / other — forests and domains
Federation / trust decision
DO NOT FEDERATE until vetted — target date and gating criteria
Privileged reset status
Domain admins, enterprise admins, break-glass — reset date
Stale / unexplained accounts found
Dormant domain-admin accounts, service accounts, guest accounts
Unexpected trusts found
Outbound/inbound forest trusts to third parties — explain or remove
Force-reset all inherited privileged credentials before extending any trust
Enumerate and justify every existing domain/forest trust; remove the unexplained ones
Remove or disable stale privileged and service accounts
Enforce MFA on acquired identities as a day-1 priority
Federate or merge directories only once the directory is vetted clean and a risk owner has signed off
An unexplained forest trust is an unknown path into your estate and a stale domain-admin account is a prime takeover target. Either one is reason enough to withhold federation until remediated.
03Inherited-risk triage
You inherit the acquired company’s risk — and possibly an in-progress or undisclosed breach — on close. Triage each inherited asset or exposure: what it is, the risk, the day-1 action, and who owns it.
Asset / system
Inherited risk
Day-1 action
Owner
Internet-facing VPN / remote access
Unknown patch level; credential exposure
Inventory, patch/triage, force-reset access
Name
Public web apps / cloud tenants
Unmanaged, possibly misconfigured
Inventory, scan, isolate until assessed
Name
Acquired Active Directory / IdP
Stale admins, unvetted trusts
Vet before federation; reset privileged
Name
Endpoints without EDR
No visibility into compromise
Deploy EDR; run compromise assessment
Name
Regulated data holdings
Inherited notification/residency duties
Classify; map obligations before moving
Name
Suspected / undisclosed intrusion
Inherited breach + liability
Treat as active incident; preserve seller claims
Name
An undisclosed or in-progress breach transfers with the company. Once you own it, it is your incident and your regulatory exposure — run it as one while legal pursues reps-and-warranties / indemnity against the seller separately.
04Isolate-first network posture
Keep the two environments separated until the acquired estate is assessed and hardened. Integration stays staged and reversible so you can carve the acquired environment back out if a finding demands it.
Networks remain segmented / isolated by default — no flat join on close day
Any cross-company access is narrow, brokered and logged (e.g. jump host, limited app access), not a general trust
Integration is architected so the acquired environment can be re-isolated ("carve back out") if the assessment surfaces something bad
No irreversible commingling of core systems until the acquired estate is proven clean
Monitoring/alerting covers the acquired estate before, not after, any connection
Reversibility is a feature, not a lack of commitment. Until the environment is vetted, deep irreversible commingling is a bet you cannot unwind.
0530 / 60 / 90 integration plan
Sequence the work so assessment leads, connection follows, and standardisation comes last. Record owners and exit criteria for each phase.
0–30 days — Contain & assess: isolate, run the compromise assessment, deploy EDR, enforce MFA, force privileged resets, inventory internet-facing assets and regulated data.
30–60 days — Harden & selectively connect: remediate findings, vet the directory, open only narrow vetted connections to assessed systems, close exposed perimeter gaps.
60–90 days — Integrate & standardise: federate identity once vetted, merge/standardise tooling and policy, broaden connectivity, and relax assume-compromise controls only against evidenced milestones.
Who; federation live, tooling standardised, controls relaxed on evidence
Any ordering that connects or standardises before it assesses inverts the posture. Do not relax controls on a calendar date — relax them when milestones are evidenced and signed off.
06Integration risk-acceptance sign-off
Connecting two companies is a residual-risk decision. It must be owned by a named, accountable executive and recorded — not left as an implicit technical default decided by whoever runs the connection.
Residual risk being accepted
What is being connected and the risk that remains after controls
Executive risk owner
Name / role — e.g. CISO with business-owner sign-off / date
Business sponsor acknowledgement
Name / date
Conditions / compensating controls
Monitoring, review date, re-isolation trigger
Review / re-assessment date
When this acceptance is revisited
Record the decision trail: who accepted what risk, on what evidence, and under what conditions. The same discipline you would demand for any material risk acceptance applies here.
Practice the decision
This checklist records calls you can rehearse. The free Day-1 Integration Security Lab drops you into the morning the deal closes and grades you on ~14 of the exact decisions this checklist documents — connect vs isolate, whether to federate, how to triage the inherited risk, and the 30/60/90 sequence.
TL;DR
What this template is
A day-1 checklist that records the security integration decisions for a just-closed acquisition under an assume-compromise posture — the pre-connect gates, identity and domain-trust calls, inherited-risk triage, isolate-first network posture, 30/60/90 plan, and risk-acceptance sign-off.
The default is isolate first: you do not join the networks or federate identity on close day — you assess, harden and vet, then extend trust only to what is proven clean.
This is post-close integration security, not pre-deal due diligence; you have inherited the acquired company’s risk and possibly an in-progress breach.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Day-1 Integration Security Lab.
Educational template — not legal or security-engineering advice. Use it with your own advisers.
Frequently asked questions
What is this template for?+
It is a day-1 checklist a security or integration team can use to record the decisions made in the hours and days after an acquisition closes: what stays isolated until vetted, the identity and domain-trust calls, the triage of inherited internet-facing assets and data, the isolate-first network posture, the 30/60/90 sequence, and who formally accepts the risk of connecting the two companies.
How is this different from M&A due diligence?+
Due diligence is the pre-deal assessment that informs whether and at what price to buy. This template is for after close, when you already own the environment and its risk. It focuses on the integration mechanics — connect vs isolate, federate or not, triage, sequencing — so the acquired company’s unknown risk does not become your risk overnight.
Why isolate first instead of connecting on day 1?+
Because on close day you have no verified picture of the acquired estate. Joining the networks or federating identity immediately imports their unknown risk — stale domain admins, an undisclosed intrusion, an exposed perimeter — straight into yours. Assume-compromise means isolate, run a rapid compromise assessment, harden, and only then extend trust to what you have vetted, keeping integration reversible meanwhile.
Is this legal or security advice?+
No. It is an educational template. Inherited data obligations and breach liability in particular are fact- and jurisdiction-specific; adapt this with your own security, legal and privacy advisers.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout