Industrial IT, OT security and M&A IT integration

---

The IT risks and costs that should change the price or the terms, found before you sign.

Call us when:

• A letter of intent is signed
• The target runs systems nobody on your side knows
• Your deal model assumes IT synergies nobody has tested

You get:

• A red-flag report your deal team can use
• A range for one-time integration costs and for IT synergies
• Cyber and OT exposure, including past incidents
• Key-person risks and contracts affected by a change of control
• Day 1 and transition services needs

Duration and format: 2 to 4 weeks. Remote, with site visits as the deal allows.

Built on: McKinsey on IT in M&A (2011); Bain on systems integration in M&A (2019); EY-Parthenon on integration costs (2024).

Fee: per diem rate; number of days agreed in writing before work starts.

Nobody notices the change of owner on day one, and the synergies in your deal model start to show by day 100.

Call us when:

• Closing is 4 to 8 weeks away
• A transition services agreement must be written
• An integration stalled after closing

You get:

• An IT integration plan and the IT workstream led in your integration office
• Day 1 checkpoints: email, access, payroll, invoicing
• The transition services agreement
• 30, 60 and 90-day plans and synergy tracking

Duration and format: 4 to 8 weeks before closing, then 100 days. Monthly fee, on site at key milestones.

Built on: Deloitte Day One readiness (2024); Bain on 30, 60 and 90-day integration plans.

Fee: per diem rate, for a number of days each month agreed in writing.

Know how an office incident could reach your plant floor, and get a segmentation plan that does not stop production.

Call us when:

• An insurer or a customer asks how the plant network is protected
• Equipment vendors connect remotely to your machines
• Office and plant networks were never separated

You get:

• A review of internet exposure and vendor remote access
• A sample asset inventory and network map
• A first zones-and-conduits map with target security levels
• Gaps against the Canadian Centre for Cyber Security readiness goals
• A phased plan aligned with your production windows

Duration and format: 3 to 4 weeks per site. On site for the walk-down, remote otherwise.

Built on: ISA/IEC 62443-3-2; NIST SP 800-82 Rev. 3 (2023); Canadian Centre for Cyber Security readiness goals (2024).

Fee: per diem rate; number of days agreed in writing before work starts.

One way of running IT across your sites: fewer contracts, one support desk, a budget you can see.

Call us when:

• Growth by acquisition left one IT per site
• Nobody can say in a day what you run and where
• Several support desks and domains serve the same group

You get:

• An inventory of sites, networks, domains, systems and contracts
• A target standard for identity, network, devices and support
• Migration waves ordered by risk, not by ease
• A business case, with savings from licences and telecom

Duration and format: 6 to 8 weeks. Remote, with visits to key sites.

Built on: Bain on process and systems integration (2019); ISACA COBIT 2019.

Fee: per diem rate; number of days agreed in writing before work starts.