Introduction: Why Cyber Due Diligence Belongs in Every High-Stakes Transaction
An undisclosed breach, a pile of unmanaged admin accounts, or backups nobody has ever restored can change what a deal is worth after it closes. Verizon learned this with Yahoo: the amended agreement cut the price by $350 million.
This guide helps buyers, boards, executives, and deal teams assess cyber risk, request evidence, spot red flags, and tie findings to decisions. It covers the checklist, the diligence process, deal-term implications, and the first 90 days after closing.
Key Takeaways
- Test whether controls operate in practice, not whether policies exist.
- Review ten areas, from governance to cyber insurance.
- Log every material finding with impact, cost, owner, and deadline.
- Turn findings into price, protection, or post-close work.
What Cyber Due Diligence Is and Why It Matters
Cyber due diligence is a structured review of a target's security posture, exposure, governance, controls, obligations, and ability to detect, respond to, and recover from incidents. Kroll's guide frames it as acquisition-focused, supporting both transaction decisions and later planning.
Cyber Diligence vs. Technology Diligence
The two overlap but ask different questions.
- Technology diligence: architecture, systems, technical debt, scalability, and integration.
- Cyber diligence: confidentiality, integrity, availability, access, resilience, and security obligations.
Cyber is often one component of the broader technology review.
Why It Affects Decisions
Findings feed directly into deal choices:
- Remediation costs that change the financial model
- Regulatory and customer exposure
- Integration blockers
- Insurance limitations
- Risks that alter valuation or structure
Scope should match the target's sector, data, operating model, deal thesis, and integration plan. A retailer holding card data needs a different review than a SaaS firm with enterprise customer commitments. One identical checklist for every company wastes effort.
Cyber Due Diligence Checklist: 10 Areas to Review
For each area, identify the evidence to request, the question to ask management, the control to validate, and the business consequence if it fails. The ten areas below are grouped into five clusters.
Governance, Ownership, and Risk Management
Review:
- Security org or role structure and executive accountability
- Board reporting, roadmap, and budget
- Risk register, exception process, and decision rights
Ask who owns cyber risk when priorities conflict or an incident needs escalation.
Can the target explain its key systems, data, threat scenarios, and accepted risks in business language? Generic policy statements are not an answer.
Incident History, Identity, and Access
Request:
- Incident logs and post-incident or forensic reports
- Regulator and customer notifications
- Help desk records and cyber claims history
- Privileged-account lists, MFA coverage, service accounts, and offboarding records
Look for:
- Incidents recorded inconsistently or not at all
- Shared administrator credentials
- Privileged accounts without strong authentication
- Former users still active
- Service accounts with no owner
CISA's performance goals point to phishing-resistant MFA where possible, separate admin accounts, and defined offboarding.
Infrastructure, Endpoint, Cloud, and Application Security
Review:
- Asset inventory, network and cloud architecture, and internet-facing services
- Endpoint coverage, patch reports, and unsupported systems
- Secrets management, application testing, and API controls
- Deployment processes and production access
A clean-looking report can hide weak controls. Check:
- Scope: does it cover the systems that matter?
- Dates: is it current?
- Open findings: what remains unresolved?
- Ownership: who is fixing each item?
- Repeat issues: do the same findings keep returning?
Data, Privacy, and Third-Party Risk
Examine the data inventory, data flows, retention and deletion, encryption, access permissions, privacy notices, processing agreements, and customer commitments. On the vendor side, review the inventory, security reviews, and contracts covering breach notification and audit rights.
Flag:
- Sensitive or regulated data and unapproved data uses
- Excessive retention
- Vendors with production access and concentrated critical suppliers
- Weak contract protections
- Undocumented open-source dependencies
Third parties were involved in 48% of breaches in the 2026 Verizon DBIR, so this area is not optional.
Resilience, Compliance, and Cyber Insurance
Request materials covering incident response, continuity, disaster recovery, backup, restore testing, insurance, compliance, and audits. Read the scope of each report. A SOC 2 report covers the described service system, and an ISO 27001 certificate covers a defined scope. Neither proves every asset is protected.
Then test the claims:
- Are backups isolated and actually restorable?
- Are recovery priorities understood?
- Has the response plan been exercised?
- Do insurance application answers match today's environment?
- Does an accountable owner hold each sector-specific obligation?
Backups deserve particular scrutiny. A Sophos study found 94% of ransomware victims reported attempts to compromise their backups. Check current US requirements for the target's industry (HIPAA, FTC Safeguards, NYDFS, SEC), and confirm with counsel. This guide is not legal advice.
How to Conduct Cyber Due Diligence
Follow this sequence:
- Scope the review. Anchor it to the transaction, business model, critical assets, sensitive data, customer commitments, integration approach, and the access you will have before signing.
- Start outside-in. Identify public-facing assets, exposed services, leaked credentials, and domain and email-security issues to shape your request list. Get written authorization before any intrusive testing.
- Request artifacts, not yes/no answers. Ask for an MFA enrollment report, not a statement that MFA is on. Ask for restore-test results, not a claim that backups exist.
- Interview the owners. Talk to security, IT, engineering, legal, privacy, risk, and operations. Compare answers against policies, logs, diagrams, and contracts. Ask which controls exist on paper but fail in practice.
- Validate proportionately. Use read-only console reviews, configuration walkthroughs, access reviews, or a targeted compromise assessment when risk signals and deal permissions justify them.
- Record every material finding. Capture the affected asset or obligation, business impact, exposure, evidence, remediation cost range, owner, target date, and recommended deal treatment.
Keep validation narrow when time is short: one control area, one business unit, one crown-jewel system.
Red Flags and How to Prioritize Them
These signals warrant a deeper look during diligence:
- No clear cybersecurity owner
- Incomplete asset inventory
- Missing MFA on privileged or remote access
- Unmanaged internet-facing systems
- Unsupported production technology
- Repeated unresolved critical findings
- Untested backups and weak offboarding controls
- Unexplained incidents
- Customer obligations the target cannot meet
Contradictions Matter Most
The loudest signal is a gap between documentation and reality. A policy promises regular access reviews, but no evidence exists. A penetration test found serious issues, but there is no remediation tracker. Management says there has never been an incident, yet operational indicators suggest otherwise.
A Prioritization Method
Rank each finding on:
- Exposure and control maturity
- Remediation effort and time to fix
- Legal or customer consequences
- Dependency on the deal or integration plan
For vulnerabilities, treat each scoring system separately. CVSS rates severity, EPSS estimates the probability of exploitation in the next 30 days, and CISA's KEV catalog lists vulnerabilities already exploited. Fix KEV-listed items first.
Separate isolated hygiene lapses from clusters. One or two weak signals can be normal. A cluster points to structural problems in governance, visibility, accountability, or technical debt.
Turning Findings Into Deal Terms and a Post-Close Plan
Price It, Protect Against It, or Improve It
- Price it when remediation cost or expected exposure changes the financial model.
- Protect against it when the issue creates legal, regulatory, customer, insurance, or closing risk.
- Improve it when a funded post-close initiative can manage it.
Findings often land in the deal as:
- Price adjustments
- Specific indemnities or escrow
- Closing conditions and pre-close remediation covenants
- Transition-services terms or day-one access restrictions
Known issues found in diligence are generally not covered by R&W insurance. Work through deal terms with transaction counsel.
One Fortune 100 retailer example: lax encryption and key management across customer PII led to a conditional indemnity tied to remediation timelines, saving millions in post-close costs.
Day One and the First 90 Days
- Clean up identity and privileged access: fewer admins, no shared or stale accounts, logged emergency access
- Verify backup scope, isolation, and restore tests
- Establish monitoring, logging, and incident escalation
- Fix critical vulnerabilities on internet-facing assets
- Review key vendors and assign policy owners
- Map integration dependencies
Reporting to the Board
Boards need a clear view of:
- Risk posture and what changed
- Unresolved material issues, with owners and deadlines
- Accepted exceptions
- Progress against the plan
Favor stable trend metrics such as admin MFA coverage, restore success, and time to fix critical vulnerabilities over technical trivia.
Tyson Martin supports boards and executives with board advisory and interim CISO leadership when they need clear decision rights, credible reporting, escalation thresholds, and a 90-day plan with owners, without slowing operations.
A Practical Test
Diligence is done only when decision-makers can say what could go wrong, how significant it is, what it will take to fix, who owns the work, and how the deal documents or post-close plan address it.
Frequently Asked Questions
What should be included in a cyber due diligence checklist?
Cover governance, incident history, identity and access, infrastructure and applications, data and privacy, third parties, resilience, compliance, and insurance. For each, ask for evidence that proves the control works.
What are red flags in cyber due diligence?
Unclear ownership, missing MFA, unmanaged assets, unresolved critical vulnerabilities, untested backups, and unexplained incidents. Contradictions between policy and evidence are the strongest warning.
What is technological due diligence in cybersecurity?
Technology diligence evaluates systems, architecture, technical debt, scalability, and integration. Cyber diligence evaluates security exposure, controls, access, resilience, and obligations. They overlap on identity, cloud, and application controls.
What documents should you request for cyber due diligence?
Incident records, security policies, asset and architecture inventories, access reports, testing and remediation records, and backup evidence. Add vendor contracts, customer commitments, compliance reports, and cyber insurance documents.
How does cyber due diligence affect an M&A deal?
Material findings can shift valuation, indemnities, escrow, insurance coverage, closing conditions, remediation covenants, and transition services. They also shape the first 90 days after closing.
