Validate RMR quality, licensing compliance, and technology risk before closing on a commercial security integrator in the $1M–$5M revenue range.
Find Surveillance & Access Control Acquisition TargetsAcquiring a surveillance and access control integrator requires validating the stickiness of recurring monthly revenue contracts, confirming state licensing and technician certifications, and assessing whether the technology stack is cloud-ready or obsolescence-prone. Owner dependency and customer concentration are the most common deal-killers in this fragmented, relationship-driven industry.
Verify the true earnings power of the business by auditing RMR contracts, normalizing owner add-backs, and confirming revenue mix between recurring services and one-time installation projects.
Request a line-item RMR schedule showing every monitoring and service contract, monthly value, start date, term length, and auto-renewal clause. Verify totals against bank deposits.
Confirm the ratio of RMR to project-based revenue. Normalize EBITDA by identifying and documenting all owner add-backs including personal vehicles, family payroll, and discretionary expenses.
Review AR aging for overdue balances, disputed invoices, or customers on payment plans. High past-due AR in service contracts signals attrition risk and weak collections processes.
Confirm all state and local contractor licenses, technician certifications, and vendor dealer agreements are current, clean, and transferable to a new owner at close.
Obtain copies of every active alarm contractor and low-voltage license across all operating jurisdictions. Confirm licenses are in the business name, not the owner's personal license.
Verify ESA Level I/II, NICET, and manufacturer certifications for all field technicians. Review employment agreements, non-competes, and any pending labor or wage complaints.
Review authorized dealer agreements with Avigilon, Genetec, HID, Axis, or Bosch. Confirm assignment or consent-to-transfer provisions exist and that preferred pricing survives the acquisition.
Assess customer concentration, owner dependency, and technology stack resilience to determine whether revenue will transfer cleanly and the business can operate without the founding owner.
Identify any client representing more than 15–20% of total revenue. Request multi-year retention data and assess whether relationships are owned by the business or the exiting founder personally.
Determine whether installed systems are IP-based and cloud-manageable or legacy DVR/NVR. Assess cybersecurity posture for client-connected systems and any documented breach history or liability exposure.
Map which sales relationships, vendor negotiations, and service escalations run through the owner. Identify a second-in-command and confirm key technicians will remain post-close with retention incentives.
Expect 3.5x–6x EBITDA depending on RMR quality, customer diversification, and technology stack. Businesses with 30%+ RMR as a share of revenue and diversified commercial accounts command the upper range.
Yes. Most owner-operated integrators with clean financials and verified RMR qualify for SBA 7(a) financing. Expect 10–15% equity injection, with sellers often carrying a 5–10% note to bridge any valuation gap.
Owner-held customer relationships combined with declining RMR. If the founder personally manages key commercial accounts and recurring revenue is shrinking, expect significant customer attrition at or after close.
Cross-reference the RMR schedule against 24 months of bank statements and billing system exports. Confirm contract terms, renewal dates, and auto-renewal clauses. Sample 10–15 clients directly to validate active service relationships.
More Surveillance & Access Control Guides
DealFlow OS surfaces targets with seller signals and motivation scores — so you know before you start diligence. Free to join.
Start finding deals — freeNo credit card required
For Buyers
For Sellers