Publication: Technical Due Diligence checklist 2026 — for investors and strategic buyers
Checklist structure (150+ points):
- Architecture and scalability: microservices versus monolith, API design, event-driven systems, caching, CDN, multi-region, DR and BCP, RTO and RPO, chaos engineering
- Security posture: SAST, DAST and SCA in CI/CD, secrets management, zero-trust networking, WAF, DDoS protection, incident response, SOC 2 and ISO 27001 status
- Data and privacy: data classification, encryption at rest and in transit, key management, GDPR and local law compliance, DPIA records, data retention, tested backup and recovery
- Engineering excellence: CI/CD maturity, test coverage (unit, integration, e2e), code review process, technical debt ratio (SonarQube), documentation, onboarding time
- Team and processes: org structure, seniority ratio, bus factor, hiring and retention, compensation benchmarks, on-call culture, incident postmortems
- IP and open source: patent portfolio, trademarks, copyright, OSS licence compliance (SBOM, FOSSA or Black Duck), copyleft risk, attribution
- AI and ML specifics (2026 addendum): model governance, training data provenance, bias testing, explainability, drift monitoring, adversarial robustness, model registry, A/B testing framework
Scoring framework: categories 1-5 (critical, high, medium, low, info) plus effort estimates for remediation. A traffic-light summary for the investment committee memo.
Download (Excel plus PDF): xlsx | pdf
← Back to news