MNA Tools in a dealDue diligence and integration, step by step.
What the IT team needs to know changes as a deal moves on: first what can be seen from outside, then whether the target's answers hold up, then what you actually inherit and what to fix first. Here is where each tool comes in, what it produces, and what you have at the end of each stage.
Before an offer · without the target's involvement
Screening: the outside view
Before anyone has signed a non-disclosure agreement, all you can see is what the target shows the internet. That is often enough to spot a problem that changes the deal, early and quietly.
DeepReview
- Assess the target from its main domain, using public information only
- Map what it owns online: domains, brands, hosting, and the systems nobody would think to list
- Read the grade and the breach-risk profile: leaked credentials, exposed admin panels, out-of-date software
HouseGRC
- Create an organisation for the target, separate from your own
- Log the red flags as risks against the deal, each with an owner on the deal team
What you have at the end
- An outside view the deal team can read without a security background
- The first questions to put to the target
- Early risks, already on the register
After the letter of intent · data room open
Due diligence: test what you are told
Now the target answers questions and shares documents. The job is to check what it says against what can be seen, and to make sure what is wrong is reflected in the price, the purchase agreement and the plan for day one.
DeepReview
- Compare the domains and systems in the data room with the footprint DeepReview found
- Assess the target's key suppliers the same way
- With the target's written permission, switch on the active check to confirm exposures
HouseGRC
- Adopt the frameworks you hold yourself to for the target, and record its answers as evidence or gaps
- Turn each confirmed issue into a scored risk the deal team can weigh
- Send the target's critical suppliers a security questionnaire they answer without an account
SubnetSleuth
- Where the target grants read-only access, inventory a site or a range to test its asset lists against the network itself
- Otherwise, agree now what day one needs: the ranges, the networks never to touch, and the read-only credentials
What you have at the end
- A due-diligence findings register, scored and owned
- A gap assessment against your own standards
- Input for the price, the purchase agreement and the day-one plan
Between signing and closing
Signing to closing: keep watching, get ready
The target is still run by its own team, and things change. Check that the promised fixes happen, and prepare everything day one depends on.
DeepReview
- Run the assessment again and see what changed: new exposures, and whether the fixes the target promised are visible from outside
HouseGRC
- Track what the target agreed to fix before closing, with dates
- Build the day-one plan: an owner and a date for each first action
SubnetSleuth
- Set up the scan scopes with the target's IT team: the ranges, the devices to start from and the networks never to touch
What you have at the end
- Evidence that the pre-closing fixes happened
- A day-one plan with owners
- Scan scopes agreed before anyone touches the network
From closing · the first hundred days
Day one and the first 100 days: know it, then fix it
The network is yours now, along with everything nobody wrote down. The first job is to know what you have. The second is to fix what matters, in the right order, with someone answerable for each item.
SubnetSleuth
- Inventory and map the network with the read-only credentials handed over, inside the agreed ranges
- Check its subnet list against your own addressing plan before the networks are joined
- Find the devices missing from the asset list, and those still answering to a factory-default community string
- Export the inventory, the maps and a report for the teams that run it next
HouseGRC
- Import SubnetSleuth's inventory into the asset register
- Turn the risk register into the remediation plan, ranked and dated
- Consolidate suppliers, with renewals tracked and offboarding checklists
- Report progress to the board in the board pack
DeepReview
- Keep watching the acquired external footprint until it moves under your own
What you have at the end
- An accurate inventory and current network documentation
- A ranked remediation plan with owners and dates
- Supplier decisions with the risk behind each one
When the integration is complete
Fully integrated: close it out
The last risks are closed, accepted or handed to the business owners who will carry them, the documentation matches the network, and the acquired business is part of your normal programme.
HouseGRC
- Close, accept or transfer the remaining risks, with each decision and its evidence kept for audit
- Bring the acquired business into your regular control checks, reviews and audits
SubnetSleuth
- Scan again after the cut-over so the documentation matches the network you now run
DeepReview
- Re-assess the combined external footprint from time to time, including the brands you retired
What you have at the end
- A closed register with a complete trail
- Documentation that matches the network
- One external footprint to watch
Start with the stage you are in
Screening a target? Ask about a DeepReview assessment. Closing soon? SubnetSleuth and HouseGRC are currently free for personal use, and organisations can license them by quote.