Separating Shared Systems in a Divestiture: The Data Checklist

Every divestiture has a sentence in the agreement that sounds simple: the seller will separate and transfer the divested business's data and stop holding it. Then the work starts, and everyone discovers that the business unit was never separate to begin with.

Shared email systems, shared file shares, shared admin accounts, shared SaaS tenants, shared backups. The unit being sold lives inside the parent's infrastructure, and extraction is surgery, not packing.

Done well, separation ends with two clean companies and evidence of the boundary between them. Done casually, it ends with the seller still holding the buyer's data, the buyer unable to operate, or both, discovered months after close.

TLDR

• Inventory the data and systems before promising separation dates; shared always means more shared than anyone thought.

• Map shared-service dependencies early: identity, email, file storage and admin accounts lead the list.

• Plan credential cutover as its own workstream, with former-employee and vendor access included.

• Require evidence of deletion for data the seller must not keep, not assurances.

• Treat the separation checklist as a closing condition with owners, not an IT side project.

Start with inventories, not intentions

Both sides need the same three lists: the data sets the divested business owns, the systems that hold them, and the accounts that can reach them. In practice these lists do not exist, because the unit grew up inside shared platforms. Building them is the first month of real work.

The inventory disciplines the schedule. A separation plan dated before the inventory exists is a hope, and it usually collapses in the first week of execution when someone finds the file share nobody remembered.

The dependencies that bite

Four shared services cause most of the pain:

• Identity. One directory serves both companies. Splitting it decides who can authenticate to what on day one after close, and mistakes lock out the business you just sold.
• Email and collaboration. Mailboxes, shared drives and chat history mix both companies' data. Extraction rules need legal review, because privilege and privacy travel with the messages.
• Admin accounts. Administrators of shared systems can see both sides after close. Every one of those accounts needs a decision: reassign, re-scope or revoke.
• Backups. Backups cannot be edited. The seller will hold copies of the sold business's data in backup until rotation ages it out, which needs to be said out loud and governed, usually by contract.

The separation checklist

The working checklist has four sections, each with owners and evidence. The rows below are illustrative; the structure is what transfers.

Section	Key items	Evidence of done
Data inventories	Data sets, systems, owners, locations, legal holds	Signed inventory with dated sign-off from both sides
Shared-service dependencies	Identity, email, files, network, SaaS tenants, backups	Dependency map with cutover plan per service
Credential cutover	Admin accounts, service accounts, former employees, vendor connections	Post-cutover access review showing only intended access
Deletion evidence	Seller-held copies identified, deletion method per set, exceptions for backups and legal hold	Deletion certificates or logs; written exception list with expiry

On deletion: agree the standard before the work starts. NIST's media sanitization guidance is the reference point both sides' lawyers and engineers can share, and it settles arguments about what 'deleted' means.

Make it a closing condition, not a side project

Separation fails quietly when it is staffed as an IT task beside the real work of the deal. It succeeds when the checklist sits in the transition services agreement with owners, dates and money attached, and when both sides can see the evidence column fill in.

The buyer's side of this boundary, the first ninety days of integrating what was acquired, is covered in cybersecurity integration after an acquisition.

Frequently asked questions

What is the first step in separating shared systems during a divestiture?

A joint inventory: the data sets the divested business owns, the systems holding them, and the accounts that can reach them. Every schedule built before that inventory exists is fiction.

How do you handle backups that contain the sold business's data?

Backups cannot be edited, so handle them by contract: the seller acknowledges retention, restricts use, and deletes on rotation with a defined end date. Put the exception in writing with an expiry.

What counts as proof that data was deleted?

Deletion certificates or system logs per data set, with the method named. NIST SP 800-88 gives both sides a shared technical standard for what sanitization means.

Who should own the separation checklist?

A named executive on each side, with the checklist embedded in the transition services agreement. IT executes; the deal owns the boundary.

A Defensible Next Step

If a divestiture is anywhere on the horizon, commission the three inventories now, while the people who remember how the systems grew are still around to ask. Separation done from memory is how both companies end up holding data they should not. Book a Decision-Clarity Call to scope the inventory work.