Cybersecurity due diligence is the review a buyer or investor performs to learn what security risks and liabilities come with a company before the deal closes. It matters because a breach, a regulatory exposure, or a weak security program transfers with the business, and the price and terms of the deal are the last chance to account for it. Two well-known deals show the range. Verizon cut roughly $350 million from its price for Yahoo after breaches came to light, and Marriott was fined £18.4 million by the UK regulator for a breach it inherited from Starwood and did not find until two years after the acquisition. This article explains what a review covers, how deep to go, how sellers prepare, and what to do in the first days after close.
Why Cybersecurity Due Diligence Matters in a Deal
Liabilities Transfer With the Company
Marriott acquired Starwood in 2016. Starwood’s reservation system had been compromised since 2014, and the breach was found in 2018, affecting up to 339 million guest records. In October 2020 the UK Information Commissioner’s Office fined Marriott £18.4 million, and its findings included that Marriott had not carried out sufficient due diligence when it bought Starwood. Marriott argued that it could do only limited diligence on Starwood’s systems, and the regulator still held it responsible. The lesson is that a buyer cannot assume the seller’s history stays with the seller.
Findings Change Price and Terms
Verizon agreed to buy Yahoo for $4.83 billion in July 2016. After two earlier breaches came to light, the deal closed in 2017 at about $4.48 billion, a reduction of roughly $350 million, with some liabilities split between the parties. Cyber findings reach a deal in several ways: price adjustments, specific indemnities, escrows, and conditions to close. They can also affect representations and warranties insurance, because underwriters can ask for evidence of controls such as multifactor authentication, incident response plans, and penetration testing before covering cyber-related claims.
What a Cybersecurity Due Diligence Review Covers
A cybersecurity due diligence checklist varies with the target, but most reviews cover five areas.
Governance and Program Maturity
The buyer asks who owns security, whether policies exist and are followed, whether a risk assessment is current, and which frameworks the target holds, such as SOC 2 or ISO 27001. A report or certificate is evidence, but its scope matters: one that covers a single product says little about the rest of the company. Elevate’s cybersecurity risk assessment services guide describes what a current assessment contains.
Technical Posture
This area covers identity and multifactor authentication, endpoint protection, vulnerability management, cloud configuration, backups, logging and monitoring, and the date and findings of the last penetration test. The question is whether controls exist and whether anyone has tested them.
Incident and Breach History
The review looks at past incidents, how they were handled, notifications made to customers and regulators, claims under cyber insurance, and findings that were never closed. A history of incidents is not disqualifying. An incomplete or unexplained one is.
Data, Privacy, and Regulatory Exposure
The buyer needs to know what personal or regulated data the company holds, where it lives, which laws apply, such as GDPR, CCPA, or HIPAA, and whether customer contracts impose security obligations. The Marriott case shows why this area carries direct liability. Elevate’s GDPR and HIPAA services cover the two regimes most often involved.
Third Parties and Software
The last area covers critical vendors and their access, subprocessors, open-source and third-party code, and dependence on single suppliers. Elevate’s guide to vendor risk assessment covers how to review them.
| Area | What the buyer asks | Evidence the seller should have ready |
|---|---|---|
| Governance | Who owns security, and is the program documented and followed? | Policies, risk assessment, organization chart, SOC 2 report or ISO 27001 certificate with its scope |
| Technical posture | Are controls in place and tested? | Latest penetration test and remediation status, vulnerability reports, MFA and backup evidence |
| Incident history | What happened, and was it handled properly? | Incident log, notifications, post-incident reviews, insurance claims |
| Data and privacy | What data is held, and is it lawfully handled? | Data map, privacy notices, records of processing, regulator correspondence |
| Third parties | Who has access, and how are they overseen? | Vendor inventory, contracts, vendor risk assessments |
The table shows that the same documents answer the buyer’s questions and demonstrate the seller’s maturity. A seller that has them ready moves faster through the process, and a seller that does not signals that the program may exist only informally.
How Deep Should a Cybersecurity Due Diligence Review Go
Three Levels of Review
| Level | Method | When it fits | Output |
|---|---|---|---|
| Desktop review | Questionnaire, document request, and interviews | Early stage or lower-risk targets | Risk summary and open questions |
| Technical validation | Penetration test or vulnerability assessment of in-scope systems, with the seller’s consent | Targets that hold sensitive data or whose product is the business | Verified findings and remediation estimates |
| Compromise assessment | Search for signs of a current or past intrusion | High-risk targets or any target with an unexplained history | A view on whether an intrusion is present |
The table shows a ladder, not a menu. Most deals start with a desktop review because it is fast and needs no access to systems. Technical validation adds evidence that documents cannot provide, and it usually follows once the parties have committed to a process. A compromise assessment is reserved for targets where the history or the data justifies it, and it is the level that would have mattered in the Starwood case. Elevate’s penetration testing and risk assessment work correspond to the first two levels.
A Cybersecurity Due Diligence Checklist for Sellers
Build the Evidence Pack Before the Process Starts
A seller that assembles its evidence early controls the narrative. The pack should include the security policies and the latest risk assessment, the most recent penetration test with remediation status, any SOC 2 report or ISO 27001 certificate with its scope, the incident log and notifications, a vendor inventory, a data map, the cyber insurance policy, and an organization chart showing who owns security. These are the documents in the right-hand column of the first table, and requests for them arrive in the first week of a process.
Fix or Disclose Known Gaps
A known gap with a plan and a date is a negotiating point. A gap the buyer discovers is a credibility problem and can reprice the deal. Sellers should list their own weaknesses, attach a remediation roadmap, and fix critical items before the process begins where time allows. Overstating the program is the more expensive mistake, because every later finding then looks like concealment.
Prepare for Technical Testing Requests
If the buyer asks to test systems, agree on the scope and rules of engagement in advance, protect production, and identify who can approve testing, including any cloud providers that require it. Running an independent test first means the seller knows the findings before the buyer does. Elevate’s guide to how to choose a penetration testing company describes what to look for in a tester.
The First 100 Days After Close
Assess Before You Connect
Connecting the two networks gives any hidden compromise a path into the buyer. Review the target’s environment first, keep it segmented until it has been assessed, and fix critical findings before integration. This is the practical lesson of the Starwood breach, which went undetected through the acquisition and for two years afterward.
Align Programs and Reporting
Map the target’s controls to the buyer’s frameworks, decide who owns security for the combined business, and update incident reporting and vendor oversight to cover the new entity. A buyer without a full-time security lead can use a Virtual CISO to lead the integration. Whether you are buying or selling, book a call with an Elevate advisor to scope the review.
Conclusion
Cybersecurity due diligence exists because security risk transfers with a company. Verizon renegotiated a price after breaches surfaced, and Marriott paid a regulatory fine for a compromise it inherited and did not find. In both cases the information that mattered existed before closing and was not found in time.
For buyers, the practical answer is a review proportionate to the target: a desktop review for most, technical validation where the data or the product justifies it, and a compromise assessment where the history is unclear. For sellers, it is an evidence pack assembled early, honest disclosure of gaps, and a tested environment. Both sides benefit when the same documents answer the same questions.
Elevate Consult prepares organizations for audits and builds the risk assessments, penetration tests, and security programs that due diligence reviews examine. Book a call with an Elevate advisor to prepare for a transaction or to review a target.
Key Takeaways
A deal inherits the target’s security history, and the review should match the risk.
- Liabilities transfer with the company. Marriott was fined £18.4 million for a breach it inherited from Starwood and did not find.
- Findings move price and terms. Verizon’s Yahoo deal closed about $350 million lower after breaches surfaced.
- Five areas cover most reviews. Governance, technical posture, incident history, data and privacy, and third parties.
- Depth is a ladder. Start with a desktop review, add technical validation where justified, and reserve compromise assessment for high-risk targets.
- Sellers should disclose first. A known gap with a plan is a negotiating point; one the buyer finds can reprice the deal.
- Assess before connecting networks. Integration without review gives a hidden compromise a path into the buyer.
Frequently Asked Questions
What is cybersecurity due diligence?
Cybersecurity due diligence is the review a buyer or investor performs to understand the security risks and liabilities of a company before an acquisition or investment. It examines the security program, technical controls, incident history, data and privacy exposure, and third-party dependencies. The findings can change the price, the contract terms, or whether the deal proceeds. Sellers also run a version of it to prepare for the buyer’s review.
What does a cybersecurity due diligence review cover?
Most reviews cover five areas: governance and program maturity, technical posture, incident and breach history, data, privacy, and regulatory exposure, and third parties and software. For each area the buyer asks whether controls exist, whether they have been tested, and whether the evidence supports the answers. The scope depends on the target, and a company that holds sensitive data or whose product is the business usually receives a deeper review.
When should cybersecurity due diligence happen in an M&A deal?
It should begin early and deepen as the deal progresses. A desktop review of documents and interviews usually comes first because it is fast and needs no access to systems. Technical validation, such as a penetration test with the seller’s consent, usually follows once the parties are committed to a process, and it should finish before signing where possible. A review after closing does not replace one before it, because the price and the terms are already set.
Does cybersecurity due diligence include a penetration test?
It can. A penetration test or vulnerability assessment is part of technical validation, which suits targets that hold sensitive data or whose product is the business. It requires the seller’s consent and an agreed scope and rules of engagement to protect production systems. Many reviews begin with documents and interviews and add testing only where the findings or the risk justify it.
How can a company prepare for cybersecurity due diligence?
Build the evidence pack before the process starts: policies, the latest risk assessment, the most recent penetration test, any SOC 2 report or ISO 27001 certificate, the incident log, a vendor inventory, a data map, and the cyber insurance policy. List known gaps with a remediation plan and fix critical items where time allows. Agree testing rules in advance and run an independent test first so the findings are known before the buyer sees them.