Why merging intranets after an acquisition is a compliance project, not only a content move
If you acquire or merge with another company, you will run two intranets, two directories and two sets of policies until one of them is retired. The workable answer is to consolidate onto one self-hosted platform in phases, starting with a content inventory, a directory plan and dated cutover gates that name who signs off each move. Treat the project as a change to access controls and records, not as a copy job, because the people who approve it will ask who can see what, from which system, and when that changed. The compliance exposure is concrete. SEC staff allow management to exclude a newly acquired business from its assessment of internal control over financial reporting, but only for up to one year from the acquisition date and not from more than one annual report, and the excluded business and its significance must be disclosed (SEC ICFR FAQ, Question 3). An intranet that hosts finance procedures, approval workflows or access to ledgers therefore has to be mapped against that window. Confirm with your auditors which IT general controls cover the systems people use to approve, post or report, and whose access lists move in each migration step.
On the platform side, the surviving intranet should be chosen on identity and content needs. HumHub suits a social, space-based intranet where news and community matter most. XWiki suits policy-heavy organizations that need structured, permissioned knowledge and an existing Confluence estate to migrate, and its LDAP and SAML options are edition-dependent, so confirm them against the edition you plan to buy. Nextcloud suits organizations that already run files and documents on it and want the intranet close to that content. Whichever you pick, confirm in writing how it will federate or consolidate the two directories and how each cross-company space will be audited until the legacy portal is switched off.
Which obligations shape the merged intranet build
This table maps each regulatory obligation that touches a merger or acquisition intranet to what it requires, what evidence an assessor will ask for, and how it changes the build. Read it before fixing the migration sequence, because several rows set hard limits on how long legacy portals and cross-company access can stay in place.
| Requirement and source | What it asks for | Build impact on the merged intranet |
|---|---|---|
| SEC ICFR acquisition exclusion | Management may exclude a newly acquired business from its internal control assessment for up to one year from the acquisition date, and must disclose the exclusion and its significance. | Legacy portals that hold financial-reporting content can run for the exclusion window only if their controls are documented. Set a retirement date inside that window and record it in the disclosure file. |
| SEC Release 33-8810 IT general controls | Names program development, program changes, computer operations and access to programs and data as IT general control areas, limited to controls that address financial reporting risk. | Map intranet permissions, admin roles and change control for any space that feeds finance content. Keep role changes during the merger traceable to an approver. |
| SEC Item 1.05 and third-party oversight | Material cybersecurity incidents require an 8-K Item 1.05 filing, generally within four business days of a materiality determination. Annual reports describe oversight of third-party service providers. | Agree one incident path across both organizations and the intranet vendor before cutover. Confirm who makes the materiality call when the incident sits in the acquired company's legacy portal. |
| NIS2 Article 3(4) entity changes | Entities notify the competent authority of name, contact details, IP ranges, sector and service Member States, and report changes without delay and within two weeks. | When the acquired entity changes its legal name, domain or hosting IP ranges, the intranet domain and DNS records change with it. Put those notifications on the cutover checklist. |
| DORA Article 28 register and exit plans | Financial entities keep a register of ICT service arrangements and maintain tested exit strategies and transition plans for services supporting critical or important functions. | If a financial entity uses the intranet vendor, add the merged intranet to its register. Retiring a legacy platform needs a documented exit and transition plan that has been tested. |
| EU Data Act switching rights | Data processing providers must support switching to another provider or on-premises infrastructure, with a maximum two-month notice period, a 30-day transitional period and porting of exportable data. No switching charges apply from 12 January 2027. | If the legacy intranet is a SaaS service being retired, plan the export of exportable data within the notice and transitional periods. Ask the vendor for its export formats and for the notice terms in the current contract. |
| EDPB Guidelines 05/2021 remote access | Remote access to EU personal data from a third country, including for support or administration, counts as a transfer and needs a Chapter V transfer tool. | If acquirer staff outside the EEA get access to the target's intranet during integration, a transfer tool must be in place first. Consider read-only staging or EU-hosted admin roles until then. |
| GDPR Articles 28(3)(a) and 30 | Processors act only on the controller's documented instructions, including for transfers. Records of processing describe the Article 32 security measures where possible. | Update processing instructions and records of processing for each merged data set, such as profiles and migrated posts. Name which entity is controller for each space after integration. |
| 45 CFR 164.314(a) business associate terms | A business associate contract requires compliance with the Security Rule, flow-down of terms to subcontractors handling ePHI, and reporting of security incidents to the covered entity. | ePHI can appear in migrated clinical or HR spaces. Confirm business associate terms cover the intranet vendor and any migration subcontractor before content moves. |
| 17 CFR 240.17a-4 communications retention | Broker-dealers preserve originals of communications received and copies of communications sent, including inter-office communications, for not less than three years. | Migrating broker-dealer communications into a new intranet can break retention. Keep originals in the archive and confirm the migrated copy meets the retention rule before the source is deleted. |
How the merger structure changes the intranet plan
When the target keeps its own legal entity, it usually has to stay under its own controls for a period after closing. The acquirer's intranet can host the target's staff, but the target's policies, approval paths and records may still need to run separately. Plan the directory as a trust relationship or a synchronized copy rather than a single merged tenant, so each entity can still show who had access to what.
- Directory: Keep the target's directory authoritative for its own staff at first, and sync only the identities needed for cross-company spaces.
- Transfer tool: Confirm whether the target's data is moved at all, or only linked, since moving data can change who controls it.
- Retirement order: Retire the target's portal only after its internal control owners confirm that the replacement produces the same evidence.
- Internal control scope: Ask the finance team whether the target falls under a temporary exclusion from the acquirer's internal control assessment, which the SEC allows for a limited period for newly acquired businesses.
- Access review: Record which administrators from each side can change permissions during the interim.
Before you start, confirm with legal and internal audit how long the separate controls must stay in place and which reports depend on the target's systems.
When the two companies become one legal entity, the intranet can move to a single directory and a single set of policies. The work is mostly about consolidating duplicate accounts, reconciling group structures and deciding which spaces survive. Because there is no longer a separate entity to protect, the main risk is losing content or access history during the cut-over.
- Directory: Merge identities into one authoritative directory, resolve duplicate accounts, and map old group memberships to new roles before the first login.
- Transfer tool: Migrate content in waves by department, keeping page history and attachments where the source platform supports it, and verify counts after each wave.
- Retirement order: Freeze the legacy portal for editing, run both for a defined read-only period, then decommission it once search and links point to the new site.
- Records: Keep an export of the legacy audit logs in a location the records owner controls.
- Permissions: Review inherited permissions, since merged groups often grant more access than either company intended.
Before you start, ask the implementation partner for a written migration plan that lists each wave, its owner and its rollback step.
When the target sits in the EU and the acquirer is outside the EEA, the intranet plan becomes a data transfer question. Giving staff of a non-EEA acquirer remote access to an EU target's systems counts as a transfer under EDPB Guidelines 05/2021, even if no data is copied. The transfer tool and the hosting location must be settled before anyone outside the EEA logs in.
- Directory: Decide whether the EU target keeps an EU-hosted directory, and restrict acquirer administrators to the access the transfer mechanism covers.
- Transfer tool: Put a Chapter V transfer tool in place before remote access is granted, and document the processor instructions required by Article 28 of the GDPR.
- Retirement order: Keep the EU intranet hosted in the EU until the transfer basis and processor terms are confirmed, then retire it in a planned sequence.
- Portability: Where the target is a customer of a cloud service that is covered by the EU Data Act, check the switching rights the provider must honor.
- Sector rules: If the target is in scope of NIS2 or DORA, the register of ICT arrangements and the exit plan must reflect the new hosting model.
Before you start, ask counsel to confirm the transfer basis and whether a works council must be consulted on employee profile data.
When the target is in financial, healthcare or payment card scope, the intranet may hold records, validation evidence or access logs that must be preserved on their own timeline. Moving these records into the acquirer's intranet without a plan can break retention rules or the chain of custody. Keep evidence separate until the owner of each control confirms the destination meets the same requirements.
- Directory: Keep access to regulated spaces restricted to named groups, and do not grant broad acquirer access by default.
- Transfer tool: Preserve original communications and audit logs in their existing store, since SEC Rule 17a-4 and HIPAA audit controls both require retention and examination of records.
- Retirement order: Retire a regulated portal only after its retention period is met or the records are exported to a compliant archive.
- PCI scope: If payment card data or validation documents are involved, keep Attestations of Compliance and Reports on Compliance under the entity that issued them, since the payment brands decide who must validate.
- Business associates: Where a HIPAA business associate contract applies, confirm that its Security Rule terms follow the data to the new host.
Before you start, ask compliance to list every regulated space and the retention period each one carries.
How to inventory and migrate content from two intranets
Start with a content inventory of each legacy portal before choosing any migration tool. For every portal, list spaces, pages, files, news posts and their owners, together with the permissions on each space and the retention status of each item. Record which content is still in active use, which is referenced by a policy or a regulator, and which is duplicated on the other side. Then classify every item as migrate, archive or delete. Archived content should move to a read-only location with a named owner, and deleted content should only be removed once the retention owner has signed off in writing. Most merger intranets fail here because nobody owns the decision to drop content, so the acquiring company's records and communications leads should approve the classification rules.
Migration tooling depends on the source system, so the inventory determines the tool. If the legacy portal is Confluence, XWiki SAS offers Confluence Migrator Pro, which moves spaces, pages, users, groups, permissions, attachments and metadata into XWiki. It keeps page history but not attachment history, and it is priced from 2000 EUR, with a trial limited to 30 pages per migration. Before you choose it, confirm with the records owner whether page history and attachment history matter for your retention obligations. If attachment versions must be preserved, plan a separate export of those files, or keep the old system available in read-only form for the retention period. Check the trial limit against your page count, since a trial run on a sample will not show how the full migration behaves.
Test the migrated content with the people who use it, not only with a technical check. Pick a sample of spaces from each legacy portal, confirm that page links, attachments, permissions and owners arrived intact, and ask each space owner to sign off. Keep a migration log that maps each source location to its new location, so that employees who follow old links can be redirected and auditors can trace where a record went. Ask any implementation partner to show this log, the sign-off record and the rollback plan for each batch before the first production move.
Which open-source platforms fit a merged intranet
A merged intranet usually needs three things at once: a place for both workforces to communicate, a governed knowledge base for policies, and a file layer that keeps legacy shares reachable during transition. The cards below match each platform to one of those needs and name what to confirm before committing, especially identity integration and which edition includes it.
HumHub as the social intranet
HumHub suits the communication layer: spaces for each legacy company, a shared news stream and a neutral space where both workforces meet before systems are merged. Use spaces to keep the acquired staff visible from day one without forcing them into the acquirer's org structure. Confirm which edition provides LDAP and SAML before you plan directory consolidation, because identity features are the main reason mergers stall. Also confirm how profile data from the target maps to your user model.
XWiki for policies and knowledge
XWiki fits the knowledge base that must hold merged policies, procedures and the migrated Confluence content. XWiki Standard is free and open source, while XWiki Pro adds Active Directory and Azure Active Directory SSO applications plus Office365 and OnlyOffice connectors. Ask XWiki SAS whether your identity provider needs an extension such as the community OIDC module, and confirm that connector support matches the editions you buy.
Nextcloud for transitional shared folders
Nextcloud, licensed under AGPL-3.0 with v33.0.10 published on October 15, 2026, keeps legacy file shares reachable while teams move content. Create one shared folder per legacy company with read access for the other side only where policy allows, and set a clear end date for each. Before go-live, confirm external sharing rules, quota behavior for migrated data, and whether your directory connector covers both user populations.
BookStack as a lighter wiki
BookStack, licensed under MIT with v26.09.1 published on September 29, 2026, fits a merged company that needs a simple, book-and-shelf structure for procedures and onboarding content rather than a full knowledge platform. It is faster to set up for small acquired teams. Confirm how it handles SSO for your directory, whether page permissions can be mapped from the legacy wiki, and how revision history is exported if you retire the source system.
Outline licensing constraint
Outline is licensed under the Business Source License 1.1, and its additional use grant forbids using it to offer a commercial Document Service. An internal intranet wiki for your own employees is a different case, but a merged group that plans to host Outline for or sell it to a partner or subsidiary must have counsel review the grant. Confirm the license terms against your deployment model before shortlisting it.
Rollout order for retiring legacy portals
This sequence moves two companies from separate portals to one intranet without losing content, access history or regulatory evidence. Each step closes with a written output so the next step starts from verified facts rather than assumptions.
Inventory content, directories and owners
Both companies list every legacy portal, space, site collection, news channel and attached file store, then record a named business owner, a technical owner, the data classification and the retention status for each. The directory team exports user, group and service account lists from each side and flags accounts with no clear owner. The step is done when every legacy system has an owner sign-off and a retention decision, and when records that fall under obligations such as the three-year preservation rule for broker-dealer communications are tagged for export rather than deletion.
Decide identity design and account lifecycle
The identity team chooses whether the two directories will be merged, federated or kept separate for a defined period, and documents which accounts remain active until each legacy portal is disconnected. Decisions cover sign-on method, group mapping, administrator roles and how leavers and transfers are handled during the overlap. The output is a signed identity design record that names the authoritative directory for each user population and the date-independent conditions under which each legacy account is disabled.
Set up interim cross-company spaces
Before any content moves, the team creates a small number of shared spaces for joint projects, policies and announcements, each with a named owner and permissions limited to the people who need them. Guest access is reviewed against the identity design from the previous step. A short data-sharing instruction is published in each space, stating what may be posted, what must stay in the originating company's systems, and who approves exceptions. The step is complete when access reviews are recorded and the instruction is acknowledged by space owners.
Run a bounded pilot migration
A limited set of spaces, chosen for mixed content types and clear owners, is migrated first. The implementation partner compares item counts, attachment counts, page or post history, group membership and effective permissions between source and target, and logs every mismatch with a cause and a fix. Where a migration tool keeps some metadata but not all of it, such as page history without attachment history, the gap is written into the migration record. The pilot is accepted when reconciliation reports match or each variance has an approved explanation.
Apply branding and navigation to the merged intranet
The merged site receives a single visual identity, navigation structure, home page and search scope, with legacy company names removed from the primary menus. Accessibility checks, mobile rendering and link validation are run against the pilot spaces before the structure is published more widely. The output is an approved navigation map, a theme record and a list of redirects from legacy addresses to their new locations, so that bookmarks and links from internal documents continue to resolve.
Cut over and retire each legacy portal
Each remaining legacy portal is migrated in its own cutover window, frozen for writes during the final sync, and then verified with the same reconciliation method used in the pilot. Before retirement, the team captures evidence: migration reports, access review records, retention exports and change tickets. Where DORA applies to an ICT arrangement supporting a critical or important function, the exit strategy and transition plan are updated and tested first, and where the EU Data Act applies to a data processing service being switched, the porting and notice requirements are checked. Retirement is complete when the portal is read-only for the agreed period, its data is archived under the retention decision, and the system is removed from the directory and the service register.
Evidence auditors and regulators ask for after the merge
This table maps each evidence type that assessors and regulators request after two intranets are combined to the record that produces it and what to confirm in the platform. Use it to plan which logs, exports and sign-offs must be preserved during the migration, not reconstructed afterward. The main takeaway is that most of this evidence is created during the work itself, so it has to be captured as the migration runs.
| Evidence | Producing component | What to confirm before relying on it |
|---|---|---|
| Migration inventory and sign-off | Content inventory and migration log kept by the implementation team | Who approved each space and page set, the date of approval, and which items were excluded and why |
| Permission change records and admin role reviews | Platform audit logs and directory exports taken before and after cutover | Whether the platform logs permission and role changes, how long logs are retained, and whether they can be exported |
| Retention decisions for broker-dealer or healthcare content | Retention policy document and archive export of affected spaces | Whether the archive preserves communications in a form that meets the retention periods in 17 CFR 240.17a-4 or the HIPAA audit control expectations in 45 CFR 164.312, confirmed with counsel |
| Transfer tool records for non-EEA access | Signed transfer contract and access log for remote administration of EU target systems | Whether the acquirer's support staff outside the EEA have logged access, and whether a Chapter V transfer tool is in place before access starts |
| Processor instructions and records of processing | Documented instructions to the processor and updated records of processing | Whether instructions cover transfers and migration tasks, and whether records describe the Article 32 security measures |
| ICFR scope disclosure support | System inventory of in-scope IT general controls for the acquired business | Whether the inventory lists access, change and operations controls for the intranet and directory, and whether the acquired business is tracked against the one-year exclusion window |
How much work does a post-merger intranet merge take, and what does it need from us?
What drives the cost of merging two intranets after an acquisition?
The main drivers are how much content must move, how many directories must be reconciled, how many legacy platforms exist, and how much of the content is regulated or subject to retention rules. A merge of a small intranet with one directory and a few hundred pages is a different job from consolidating several portals with years of attachments, personal spaces and records that must be kept. Ask the implementation partner to size each driver separately in a written scope, because each one changes the migration, validation and cutover effort. Confirm with the partner which of these drivers their quote assumes and what would move the number up.
Which parts of an intranet merge are one-time and which recur?
One-time work includes the content inventory, migration and reconciliation, directory mapping, theming for the combined brand, testing and the cutover itself. Recurring work includes hosting, applying security updates and version upgrades, administering users and spaces, and ongoing moderation of news and content. Some teams treat the first months after cutover as a stabilization period that costs more than planned, so ask for that period to be named in the scope. Ask for the recurring items to be priced separately from the project so you can compare them with a per-user SaaS intranet.
Can our internal staff do the content inventory and cutover themselves?
Often yes for the inventory, and usually only partly for the cutover. Internal staff know which spaces matter, who owns them and which content is out of date, which makes them essential to the inventory and to deciding what to archive instead of migrate. Cutover is harder, because it touches identity, DNS, redirects, permissions and rollback, and mistakes are visible to every employee at once. Agree in writing which tasks your team owns, which the partner owns, and who signs off each phase of the rollout.
What does the merge need from our IT, legal and HR teams?
IT must provide directory access, an agreed identity model for the two user populations, hosting capacity and network paths, and a rollback window. Legal should confirm which content carries retention obligations, which spaces hold personal data, and whether any cross-border access to employee data triggers transfer rules, since remote access from a third country can count as a transfer under EDPB Guidelines 05/2021. HR should confirm the authoritative source for joiners and leavers and the rules for who sees employee profiles. Ask the partner to list these inputs in the scope with an owner and a date for each.
How do XWiki Pro support tiers relate to the number of users?
XWiki SAS sets its Starter, Basic, Business and Enterprise tiers by user count: Starter covers up to 25 users and is available for XWiki Cloud only, Basic covers up to 1,000 users, Business covers up to 10,000 users, and Enterprise is unlimited. XWiki SAS states that cloud and on-premises pricing is the same. Consulting at 1200 EUR per day requires a Business or Enterprise support plan, according to XWiki SAS pricing. Count the users who will be migrated, plus expected growth from the acquired company, before choosing a tier. Confirm current terms with XWiki SAS, since these tiers are a vendor offering and not a fixed part of DeployOpen's service.
How do regulated records affect the merge plan?
Regulated content has to be identified before migration, because it may need to keep its original format, history and access logs. In the United States, broker-dealers must preserve business communications for at least three years under 17 CFR 240.17a-4, and healthcare organizations must keep audit controls over systems that hold ePHI under 45 CFR 164.312. In the EU, DORA requires a register of ICT arrangements and tested exit and transition plans for critical services. Ask the partner how each regulated space will be tagged, where its records will live after the merge, and what evidence will show that access was controlled during the move. DeployOpen prepares systems and evidence for compliance assessments, but auditors issue the conclusions.
Which items should a quote for a post-merger intranet merge list?
A usable quote lists the scope in phases: inventory, migration by content type, directory consolidation, interim cross-company spaces, branding, testing, cutover and the retirement order for each legacy portal. For each phase, ask for the assumed content volume, number of directories, number of source platforms, and which content is excluded or archived. Ask who provides the XWiki or HumHub licenses, who runs hosting, what the support tier covers, and what happens if the scope changes. Request the rollback procedure and the exit conditions for the interim spaces. DeployOpen works from a written scope and does not publish a price list, so the quote should follow directly from these inputs.
Does the migration tool keep page history and attachments?
It depends on the tool and the source platform, so verify it before you commit to a plan. For Confluence to XWiki, XWiki SAS describes Confluence Migrator Pro as migrating spaces, pages, users, groups, permissions, attachments and metadata, and says it keeps page history but not attachment history. The trial is limited to 30 pages per migration, and the tool is priced from 2000 EUR according to the XWiki Store. Ask the partner to run a sample migration of a representative space and compare the result with the source, including permissions and links, before the full migration is scheduled.
Questions to ask an implementation partner before a merger cutover
Start with the content inventory. Ask how the partner will crawl both intranets, classify every space, page and attachment as keep, merge, archive or delete, and who signs off each class. Ask how they will mark content owned by the acquired company that still carries that company's policies, and how they will stop duplicate policy pages from being published under two brands during the transition. For directory consolidation, ask which identity source is authoritative during the transition and what happens to a user who exists in both directories with different attributes. A credible answer names the source of truth for each attribute, the sync direction, the account-matching rule and the process for disabling a leaver in the old directory before the new one is trusted for access.
Next, press on evidence and cross-border access. Ask how page history and attachments are preserved, which fields are reconciled after import (permissions, groups, owners, last-modified metadata), and what the partner will not carry over. Ask for the reconciliation report format and who checks it. If any staff in the acquired company sit in another country, ask how remote administrative access by the acquirer's staff is documented, which transfer mechanism applies under the relevant regime, and whose written instructions govern that access. For regulated firms, ask how the partner supports the records of ICFR-relevant policies, retention settings and access logs that auditors will request, and which evidence is produced for each control. Use the SEC staff allowance for excluding a newly acquired business from ICFR assessment only as a planning input for your own counsel and auditors, and confirm the exact treatment with them.
Finish with sequencing and accountability. Ask for a retirement order for each legacy portal, the rollback trigger for each step, and how long the old system stays read-only before decommissioning. Ask who owns disclosure decisions, such as whether a cybersecurity incident found during migration requires an SEC Form 8-K assessment, and who signs off the cutover. A strong partner will state which steps they perform, which they support and which stay with your staff, in writing before work starts. Confirm the scope, deliverables and timeline in that written agreement, and ask for the named people who approve each gate.
