Carve-outs from large industrial parents look clean on paper. The asset is defined, the workforce transfers, the Transitional Service Agreement covers the operational gap. Then Day 1 arrives and the portfolio company discovers the parent's IT/OT stack was not a single system — it was a dense web of services, integrations, and identity dependencies that nobody fully documented.
Within the first 90 days, the same patterns repeat across deals.
The ERP that isn't there
The parent's SAP, Oracle, or M3 instance was the central nervous system. The carved-out entity often runs on a temporary read-only export — no purchase order flow, no invoicing, no inventory truth. The TSA clauses paper over this for a quarter, but by month three the parent IT team has moved on, ticket response times collapse, and the new finance team is reconciling spreadsheets by hand to close the books.
OT systems that quietly call home
SCADA platforms, MES layers, and PLC programming environments often connect back to the parent's central licensing server, historian, or remote access gateway. The plant keeps running until a firmware update, a license renewal, or a maintenance VPN session is needed — and then suddenly nothing works. Nobody knows the password to the central historian. Nobody has the parent's PKI certificates. The OEM engineer arriving on-site cannot connect to the PLC because the engineering workstation phones home to a server that no longer accepts the new entity's IP range.
Identity sprawl
Active Directory belonged to the parent. Single sign-on, machine certificates, OT engineering workstations — all federated through it. New users can be provisioned in the new tenant; old ones cannot be cleanly deprovisioned from the parent's. Service accounts with names like svc_legacy_scada_2014 still authenticate against the parent's domain controller. Nobody is willing to be the person who turns them off.
The data exfiltration problem
Production data was streamed to a parent-owned data lake or BI platform. The new owner has no access. The board wants weekly KPI dashboards. The plant manager has spreadsheets. The gap between these two realities is where 100-day plans quietly die.
What the first 90 days should actually deliver
- A bridging ERP — even a lightweight cloud instance — operational by week six
- An OT security perimeter assessment and a complete list of every parent-owned service the plant touches
- A new domain, a new identity provider, and a deprovisioning plan for the parent's AD with clear ownership
- A minimal data pipeline that produces three numbers the board trusts — not thirty
None of this is glamorous. All of it is the foundation everything else in the value creation plan rests on. Skip it and the 100-day plan becomes a 300-day plan, with the first 200 days spent rebuilding what was assumed to be in place.
If this matches a situation you're walking into — or one you're already in — get in touch.