Before the Letter of Intent: Five Cyber Questions About the Target

By the time formal diligence starts, the deal has momentum, the price has a frame, and nobody wants to find something that slows it down. That is exactly when expensive surprises surface.

A short set of cyber questions asked before the letter of intent - in the first management meetings, when everyone is still courteous - tells you what diligence will need to prove and whether the timeline is realistic.

None of these questions requires access to the target's systems. All of them can be answered in a management presentation or a follow-up call.

Key takeaways

• Ask early, while answers are still cheap to give and cheap to walk away from.

• A target that cannot describe its own environment will not pass deeper diligence quickly.

• Past incidents matter less than how they were handled and what changed.

• Contractual security commitments to customers become your commitments at close.

• The answers shape diligence scope, timeline and the questions for week one.

The five questions to ask before the letter of intent

What would you lose if your most important system went down for a week?

This is a business question with a security answer. It tells you whether the target knows its own critical dependencies, and whether the thing you are buying survives a bad week.

A management team that answers crisply - this system, this revenue, this recovery arrangement - runs a tighter operation than one that delegates the question down the hall.

Have you had a security incident in the last three years, and what changed afterward?

The honest answer is rarely 'nothing, ever.' What you are listening for is the after-action discipline: what they learned, what they fixed, and whether the fix was verified.

A well-handled incident with real change behind it is a better sign than a claimed clean record with no evidence anyone was watching.

What security commitments have you made to customers or partners?

Contracts, security exhibits and customer promises survive the transaction. At close, they become yours to keep.

Ask for the list early. A target with heavy contractual commitments and a thin security program has handed you a gap to close on day one, priced into the deal or not.

Who is responsible for security today, and what happens if they leave?

In smaller companies the answer is often one person, or one person's spare time. That is not disqualifying, but it is a concentration you are acquiring.

Ask what is documented. A one-person security function with good records is a manageable transition. The same function living entirely in someone's head is a cost line you have not booked yet.

Which third parties would hurt most if they failed?

Every company runs on vendors now: hosting, payroll, the platform the product sits on. The target's dependency list is part of what you are buying.

Listen for whether they have ever mapped it. An answer with names, contracts and alternatives suggests the operational maturity diligence will confirm. A blank look tells you to budget the time to build that map yourself.

The related discussion of CISO value in M&A and post-merger integration is worth your time alongside this one.

Frequently asked questions

Will asking these questions slow the deal?

They take one agenda slot in a management meeting. What slows deals is discovering late that diligence needs three more weeks because nobody asked basic questions up front.

What if the target refuses to answer before signing?

High-level answers before a letter of intent are normal and cost them little. A refusal to discuss security at all is itself an answer about the culture you are buying.

Do these replace technical diligence?

No. They scope it. The answers tell you where to point the deeper review and how much time to schedule for it.

A Defensible Next Step

Add these five questions to the agenda of your next first meeting with a target. The answers cost nothing now and get expensive only when nobody asked. Book a Decision-Clarity Call if you want a diligence checklist built for your deal size.