A decade ago, cyber review in a mid-market sale often meant one page in the IT questionnaire: “Has the company suffered a data breach? Y/N.” That has changed. Ransomware, regulatory disclosure rules and the cost of a breach after closing have pushed security into the core of buyer diligence, alongside financial and legal review.
This guide covers both sides: what the buyer’s advisers will ask for, and how a seller can answer properly without spreading sensitive security detail across every bidder.
What is cybersecurity due diligence?
Cybersecurity due diligence is the part of a transaction review that assesses how well a target company protects its systems and data, how exposed it is to attack, and what it would cost to fix gaps after the deal. It is usually run by a specialist adviser or the buyer’s own security team, and it feeds into the legal and financial work rather than standing apart from it.
It has three practical outputs:
- Price and structure. Known weaknesses become remediation costs, escrow amounts or specific indemnities.
- Contract terms. Security and data protection warranties, disclosure against them, and sometimes conditions to fix something before closing.
- Integration planning. What the buyer must change on day one, especially before connecting the target’s network to its own.
Why does cyber diligence matter more now?
Several pressures have combined. Breaches discovered after closing land on the buyer, and they can surface years later. Public companies in the US face disclosure obligations for material cybersecurity incidents, which makes an acquired company’s history part of the buyer’s own reporting risk. Regulators in many jurisdictions have also become more willing to fine for weak data protection, regardless of whether the company has since changed hands.
Our staging framework, set out in the figure below.
What do buyers ask for?
Requests vary by deal size and sector, but most cyber workstreams cover six areas. The table shows what the buyer is really trying to learn in each.
| Area | Typical requests | What the buyer is testing |
|---|---|---|
| Governance | Security policies, roles, board reporting, framework alignment | Is security owned by someone with authority? |
| Incident history | Incident log, breach notifications, forensic reports | What has gone wrong, and was it handled well? |
| Testing | Pen test reports, vulnerability scans, remediation tracking | Are weaknesses found and fixed, or just found? |
| Third parties | Vendor inventory, critical SaaS, supplier security reviews | Who else could expose the company’s data? |
| Access and identity | MFA coverage, privileged access, joiner and leaver process | Could a stolen password open everything? |
| Resilience | Backups, recovery tests, continuity plans, cyber insurance | How long would the business be down after an attack? |
Many advisers map the questions against a recognized framework such as the NIST Cybersecurity Framework, which makes gaps easier to describe consistently. The framework matters less than the evidence behind each answer.
How should a seller stage sensitive security documents?
This is where cyber diligence differs from most other workstreams. Financial statements do not help an attacker. A list of open vulnerabilities, a network diagram or a pen test report with exploitable findings does. Sharing all of it with every bidder in round one would be careless.
Cybersecurity due diligence: what to share, in which round
Summaries
- Security policy index
- Framework or certification status
- Org chart for IT and security
- Insurance summary
- High-level incident statement
Evidence
- Pen test executive summaries
- Incident log with outcomes
- Vendor and SaaS inventory
- Access review records
- Backup and recovery test results
Sensitive detail
- Full pen test findings
- Open vulnerability list
- Network diagrams
- Forensic reports on past incidents
- Remediation roadmap
The tiers work like this in practice:
- Tier 1, all bidders. Summaries and status: which policies exist, which frameworks the company aligns to, whether it holds any certifications, a statement on material incidents. Enough to price roughly.
- Tier 2, the shortlist. Evidence that controls work: pen test executive summaries, an incident log with outcomes, the vendor inventory, access review records, backup test results.
- Tier 3, named advisers in confirmatory diligence. The detail: full findings, open vulnerabilities, diagrams, forensic reports. Often limited to the buyer’s security adviser rather than the whole deal team.
In the data room, each tier is a folder with its own permission group. Tier 3 should be view-only, watermarked with the individual’s name and time, with downloads off. Our guide to screenshot protection explains which of those controls carry the most weight.
Expert sessions instead of documents
For the most sensitive topics, some sellers replace documents with a recorded or minuted call between the buyer’s security adviser and the target’s security lead. The adviser gets their answers, nothing exploitable is uploaded, and the minutes go into the room as the record.
What does good evidence look like?
Buyers’ advisers see a lot of documents that exist but prove nothing. The difference is usually dates, ownership and follow-through.
| Weak evidence | Stronger evidence |
|---|---|
| A security policy last reviewed four years ago | Policies with a review date in the last year and a named owner |
| A pen test report with no follow-up | The report plus a remediation tracker showing fixes and retests |
| ”MFA is enabled” | MFA coverage figures by system, with exceptions listed |
| A backup policy | Results of the latest restore test, with recovery times |
| ”No incidents” | An incident log, even a short one, showing what was investigated |
That last row surprises sellers. An empty incident log tends to raise more questions than a short one with sensible entries, because every organisation has minor events. A log shows the company notices them.
Which findings tend to change a deal?
Most findings end up as integration tasks. A few tend to escalate into price or terms:
- An undisclosed or poorly handled breach, especially one involving personal data that may still trigger notification duties or claims.
- No working backups, or backups that have never been restored in a test. Ransomware exposure becomes a valuation question.
- Missing MFA on remote access or email, which advisers often treat as a high-likelihood attack route.
- Critical software at end of life that cannot be patched without a major project.
- Heavy dependence on one unreviewed vendor for core systems or data.
Our article on due diligence red flags looks at the broader set of warning signs buyers see in a data room, beyond the security workstream.
How do buyers use the results in the contract?
The findings flow into the transaction documents in a few standard ways:
| Finding type | Typical contract response |
|---|---|
| Known gap with a clear fix | Pre-closing covenant to remediate, or a price adjustment |
| Past incident with possible claims | Specific indemnity, sometimes backed by escrow |
| General uncertainty about posture | Broader security and data protection warranties |
| Risk too large to price | Deal restructured, or the buyer walks away |
Warranty and indemnity insurers also review cyber diligence. Thin diligence can lead to exclusions in the policy for exactly the risks the buyer is most worried about, which is another reason to answer the questions fully.
How should the data room itself be set up for the cyber workstream?
A few configuration choices make a cyber workstream run smoothly:
- A dedicated top-level folder for security, numbered to match the request list, with tier subfolders.
- A separate Q&A category routed to the target’s security lead, so technical questions do not wait in the general queue.
- Two-factor login enforced for every guest, which also happens to be one of the first things the buyer’s adviser will check about the room.
- An exportable audit trail, so the seller can show which parties accessed tier 3 if anything later leaks.
Every provider in our reviews lists an audit trail, but per-folder permission depth and Q&A routing vary. For a broader view of which rooms suit M&A processes, see our ranking for mergers and acquisitions.
When should a seller start preparing?
Ideally before the sale process starts. A pre-sale readiness review, run by the seller’s own adviser, finds the issues a buyer will find, with time to fix them or at least to write a clear explanation. Fixing MFA coverage takes weeks. Explaining a missing control during exclusivity, under deadline, takes credibility.
A practical sequence: commission the review three to six months before launch, fix what can be fixed quickly, prepare tier 1 and tier 2 documents, and decide in advance who will see tier 3 and under what conditions.
Choosing a room for a security-sensitive sale?
Compare permission depth, watermarking and audit features across providers.
Frequently asked questions
What is included in cybersecurity due diligence?
Typically six areas: governance and policies, incident history, security testing, third-party and vendor risk, identity and access management, and resilience including backups and recovery. Advisers often map the review against a framework such as the NIST Cybersecurity Framework.
Who performs cybersecurity due diligence in an acquisition?
Usually a specialist cyber adviser engaged by the buyer, or the buyer's internal security team for strategic acquirers. Their findings feed into the legal and financial workstreams and the transaction documents.
Should a seller share penetration test reports with bidders?
Executive summaries are commonly shared with shortlisted bidders. Full findings, especially unresolved ones, are best limited to named advisers in confirmatory diligence, in a view-only, watermarked folder.
Can cybersecurity issues reduce a company's sale price?
Yes. Serious gaps can become price adjustments, escrow, specific indemnities or pre-closing remediation obligations. In extreme cases, such as an unresolved breach, a buyer may restructure or withdraw.
When should a company prepare for cyber due diligence?
Three to six months before a sale process is a sensible minimum. A readiness review finds the issues buyers will find and leaves time to fix the quick ones and document the rest.