Introduction
A merger or acquisition changes identities, systems, authority, data access, and employee behavior all at once. Cyber risk can climb fast during that window.
The numbers back this up. An FTI Consulting survey of 278 US executives found nearly 1 in 4 had experienced a cyber incident during or shortly after a transaction. Of respondents, 42% reported significant deal-value reduction.
This guide is for boards, executives, CISOs, counsel, and integration leaders. It covers how to assess cyber risk before signing, protect the deal before close, and integrate without creating avoidable exposure. The framework: due diligence, Day 1 safeguards, post-close governance, and a 90-day plan.
Key Takeaways
- Treat cyber findings as inputs to price, contract terms, and the go/no-go decision.
- Name accountable leaders and approved communication channels before data or systems move.
- Demand evidence in diligence, not policy statements.
- Track a handful of stable risk indicators with owners, trends, and deadlines.
Why Cybersecurity Becomes a Board-Level M&A Issue
The attack surface expands overnight
Closing a deal hands you the target's applications, cloud accounts, identities, vendors, data stores, and facilities. It also hands you their security obligations and any history of compromise.
Marriott learned this the hard way. It acquired Starwood in 2016, and the FTC says a Starwood breach that began around 2014 stayed undetected until 2018. Marriott became responsible for both brands' data-security practices.
People become the softest target
Uncertainty breeds mistakes. Employees don't know who has authority, which emails are real, or who to call. That opens the door to:
- Impersonation of executives or integration leads
- Phishing aimed at new colleagues
- Fraudulent payment requests
- Access misuse by people with unclear roles
The FBI's IC3 annual report logged 24,768 business email compromise complaints and over $3 billion in reported losses. That isn't M&A-specific data, but it shows what fraudsters exploit when payment authority gets murky.
What boards actually face
Cyber findings flow into deal value, business continuity, customer trust, regulatory exposure, disclosure duties, insurance, and management accountability. Verizon's discovery of Yahoo's breaches during diligence led to a $350 million price reduction. Yahoo also kept liability for shareholder lawsuits and SEC actions.
Directors don't need to manage every control. They do need five answers:
- What is the likely financial, uptime, or trust impact?
- What changed since the last briefing?
- What decision is being requested?
- What happens if we do nothing?
- What's the fastest path to reduce exposure?
Cybersecurity Due Diligence Before Signing
Identify the target's assets, data, and exposure
Inventory what will transfer or connect:
- Critical applications and cloud accounts
- Endpoints, identities, and access paths
- Sensitive data and intellectual property
- Operational technology where relevant
- Third-party services and internet-facing assets
- Business processes tied to those assets
Separate confirmed assets from unknown or unverified ones. Poor visibility is itself a finding. It widens the range of possible outcomes and should raise the integration budget.
Test the control environment
Review identity and access management, privileged accounts, multifactor authentication, endpoint protection, and patching. Cover segmentation, encryption, logging, backups, disaster recovery, and security testing as well.
Ask for proof. Useful artifacts include:
- Recent assessments and penetration-test summaries
- Remediation records and patch-exception registers
- Tabletop exercise reports
- Restore test results for a critical system
- Privileged-access reviews and management-approved exceptions
Keep each request narrow: one control area, one business unit, one crown-jewel system.
Investigate incidents and third parties
Look for known and suspected breaches, ransomware, material outages, unresolved critical vulnerabilities, litigation, and customer complaints. Check for gaps between reported incidents and documented response.
Software supply chain and vendors matter equally. Black Duck's 2025 OSSRA report, drawn primarily from M&A targets, found 81% of risk-assessed codebases held high- or critical-risk vulnerabilities. It recommends identifying problem open source before terms are set.
Also examine managed service providers, data processors, subcontractors, and change-of-control or security clauses in customer contracts. List the top critical vendors and ask what happens if one is down for 72 hours.
Map legal, regulatory, and insurance exposure
Verify which US federal, state, and sector rules apply. Their clocks differ:
| Regime | Key point |
|---|---|
| SEC Form 8-K Item 1.05 | Four business days after a materiality determination |
| HIPAA | Individual notice within 60 days of discovery |
| FTC Safeguards Rule | 30 days for qualifying events affecting 500+ consumers |
| NYDFS Part 500 | 72 hours after determination; acquisitions require risk assessment updates |
| State laws | All 50 states have breach-notification statutes with varying terms |
Review cyber insurance coverage, exclusions, notification duties, claims history, indemnities, and representations and warranties. Matters known to the deal team are typically excluded from warranty and indemnity insurance. Counsel should confirm all legal conclusions.
Convert findings into transaction decisions
Don't hand the board an undifferentiated issue list. Rank findings by severity, exploitability, business impact, remediation cost, owner, and time to fix. Offer two to three decision options, each with cost, time, operational impact, and residual risk.
Material findings can change:
- Purchase price
- Escrow or indemnity terms
- Closing conditions and remediation commitments
- Integration sequencing and transitional services
- The decision to pause or walk away
At a Fortune 100 retailer, a CISO-led review found weak encryption and key management across customer data. Legal then structured a conditional indemnity tied to remediation timelines.
For issues that can't be fixed before close, require written risk acceptance: accountable executive, expiration date, interim control, and committee visibility.
Secure Day 1 and Post-Merger Integration
Build a signing-to-close security plan
Create a joint workstream that covers:
- Named leaders from both sides
- A decision log and approved communication channels
- Confidentiality boundaries
- A schedule for risky activities such as access changes and data migration
Define three buckets:
- Must finish before close
- Can wait for Day 1
- Stays separated until visibility improves
Protect identities and privileged access
Attackers love the seams between two identity systems. In one scenario, a linked network, uneven endpoint protection, and unreviewed admin accounts let a single phished credential move across both environments by day 10.
Start here:
- Revalidate workforce, contractor, service-account, admin, and vendor access
- Remove dormant accounts and fix ex-employee and shared admin accounts first
- Rotate privileged, service-account, API-key, and repository secrets in the first week
- Confirm break-glass accounts exist and are monitored
- Plan federation and MFA without assuming the directories are ready to merge
Joint agency guidance on Active Directory compromises documents trust-bypass paths worth examining before connecting directories.
Connect systems in stages
Don't link networks until admin access is controlled and endpoints are visible on both sides. Use segmentation, allow-listed connections, monitored transfer paths, encryption, malware scanning, and tested rollback.
Staged migration beats a big-bang move when inventories, configurations, or recovery procedures are incomplete. A failed all-at-once cutover with no clean fallback is the worst version of this problem.
Maintain continuity and response capability
Update continuity, disaster recovery, backup, crisis communication, and incident response plans for the combined company. Stand up joint response basics:
- Incident bridge and contact tree
- Shared severity model
- Evidence-preservation process
- Clear authority to isolate systems
Validate at least one restore of a critical system in the first 30 days. Backups that have never been restored are a hope, not a control.
Address employees, customers, and third parties
Tell employees how to report concerns, who has authority, how to verify requests, and how to spot impersonation. Prepare customer, supplier, regulator, and insurer messages for a material incident. Coordinate those drafts across legal, communications, privacy, and executives before you need them.
Governance, Metrics, and the First 90 Days
Assign decision rights and escalation thresholds
Define roles across the board or audit and risk committee, executive sponsor, CISO, CIO, general counsel, privacy lead, business owners, HR, communications, and the integration office. A simple map of who decides, who executes, and who is consulted prevents stalls.
Set explicit escalation triggers for:
- Material vulnerabilities and suspected compromise
- Failed recovery tests
- Regulatory issues and customer-impacting outages
- Expired risk acceptances
The World Economic Forum's board governance principles name M&A among decisions requiring cyber-risk analysis and call for clear ownership.
A practical 30-60-90 roadmap
- Days 1-30: Establish visibility, review privileged access, check endpoint coverage and logging, validate backups, set incident contacts, contain the highest-consequence exposures.
- Days 31-60: Close control gaps, rationalize overlapping tools, validate vendor and data-transfer arrangements, test response procedures, assign owners to architecture decisions.
- Days 61-90: Report remediation progress, residual risk, control effectiveness, dependencies, and next investment decisions to executives and the board.
Treat these as planning targets, not a hard finish line. Secure integration often runs past day 90 as residual risk and architecture decisions surface.
Use a stable executive dashboard
Keep it to a page. Cover:
- Critical assets inventoried
- Privileged accounts reviewed
- Endpoint and logging coverage
- High-risk vulnerabilities and overdue remediation
- Recovery-test status
- Third-party risks, open incidents, and accepted exceptions
Each metric needs a trend, business impact, owner, target date, and the decision required. A red metric should name an action owner and a deadline. Skip volume counts that add noise. A 99% training-completion rate can sit beside a breach.
Keep the operating model usable
Overlapping tools, duplicate policies, inherited technical debt, and competing priorities strain the people defending the business. In a global workforce study, ISC2 found 48% of security professionals felt exhausted keeping up.
When forcing standardization would overload the team, temporary separation, compensating controls, external support, or a dedicated integration security team can be safer.
Add experienced transition leadership
Some organizations lack the capacity or independence to run this alone. Tyson Martin advises boards and serves as an interim or fractional CISO during transitions. The work centers on decision rights, plain-English reporting, escalation thresholds, and a 90-day plan with owners and measurable outcomes.
The role is advisory and oversight-focused. It doesn't include security operations, penetration testing, or tool implementation, and it doesn't promise specific deal results.
Board-Ready Cybersecurity M&A Checklist
Before signing
- Review the target's assets, data, identities, incidents, vulnerabilities, vendors, regulatory obligations, and insurance
- Document material unknowns and remediation commitments
Between signing and close
- Assign accountable leaders and restrict sensitive information sharing
- Validate communication channels and prepare Day 1 access changes
- Agree on incident escalation and decide which systems stay separate
After close
- Track the 30-60-90 roadmap on a stable dashboard
- Test recovery and incident response, including a tabletop with the integration leader, IT, legal, and HR
- Close high-consequence gaps first
- Ask which top three residual risks are being accepted and why, and report them to the right committee
Frequently Asked Questions
What is the role of cybersecurity in mergers and acquisitions?
It identifies technology, data, access, regulatory, and operational risks that can affect valuation, deal terms, continuity, and integration success. Remediation costs belong in the overall transaction budget.
What should be included in cybersecurity due diligence for an acquisition?
Cover asset and data inventories, identity controls, vulnerabilities, incident history, third parties, privacy and regulatory exposure, insurance, contracts, and evidence of remediation.
When should cybersecurity due diligence begin in an M&A transaction?
Before signing. It should continue through signing-to-close planning, Day 1 readiness, and post-close validation. If only one phase is possible, start at close.
How can companies protect data during a merger or acquisition?
Use least-privilege access, MFA, encryption, staged transfers, tested backups, monitoring, segmentation, and verified requests. Test rollback plans before connecting environments.
Who is responsible for cybersecurity during M&A integration?
Accountability is shared across the executive sponsor, CISO, CIO, legal, privacy, HR, business owners, and the integration office. One person should be the designated decision owner.
What happens if a cyber incident is discovered after an acquisition?
Contain it, preserve evidence, and have counsel assess legal and regulatory duties. Notify insurers and customers where required, escalate to executives, fix root causes, and review deal protections.
