Security due diligence asks two questions. How likely is the target to suffer a serious incident, and has it already had one that nobody has noticed? The answers feed the price and the purchase agreement, and above all they decide when and how the two organisations are connected.
The most expensive mistake is joining a compromised network to your own. Whoever is inside the target is then inside you, and the incident, the clean-up and any notification duties become yours. The second is inheriting a breach that happened before closing and only comes to light afterwards, when the contract no longer gives you a remedy.
When it happens
It runs alongside IT due diligence. The outside view can start at screening, before the target is involved. The questionnaire, evidence requests and management sessions happen once the data room opens.
Hands-on work such as a compromise assessment needs access the seller may not grant before signing. Agree early what can be done before signing, what between signing and closing, and what must be finished after closing before any connection is made.
Who is involved
- The security diligence lead, who owns the scope, the assessment and the connectivity gate.
- The IT diligence lead, sharing the request list and the management sessions.
- Legal counsel, for breach history, notification duties, privacy law, representations and indemnities.
- The privacy or data protection officer, where personal data is a material part of the business.
- The target's security lead or IT manager, and its managed security provider if it has one.
- An independent incident response provider, if you plan a compromise assessment.
- The deal team, who need the findings in terms they can weigh against price and timing.
The steps
1. Build the outside-in view
Before you ask the target anything, look at what it shows the internet. It costs the target nothing and gives you specific questions to ask.
- Domains and brands, including those from earlier acquisitions
- Internet-facing services, remote access gateways and administration interfaces
- Certificates and email authentication (SPF, DKIM and DMARC)
- Staff credentials in public breach data
- Anything you find that the data room does not mention
2. Send a questionnaire and ask for evidence
A questionnaire gives breadth; evidence gives you the truth. For each answer that matters, ask for the artefact behind it. Read the scope of every certification or attestation. An ISO/IEC 27001 certificate covers the scope stated on it, which may be one product or one site. A SOC 2 report covers named systems over a stated period, lists exceptions, and expects the customer to run certain controls of its own. A PCI DSS attestation covers the cardholder data environment only.
- Policies and their last review dates
- Recent penetration test reports and the status of each finding
- Certificates and attestation reports, read in full, including scope, period and exceptions
- The security risk register and open audit findings
- Who runs security, how many people, and what is outsourced
3. Establish the breach and incident history
Ask for incidents over a defined period, not just "major" ones. Ask what changed after each. Notification duties under laws such as GDPR, PIPEDA, HIPAA, NIS2 and DORA differ by jurisdiction and sector. Whether the target met them is a question for counsel, as is how any exposure is handled in the agreement.
- Incident log and post-incident reports
- Notifications made to regulators, customers or individuals
- Investigations, claims or extortion demands still open
- Whether any ransom was paid, which counsel must review
- Cyber insurance policy, claims history and exclusions
4. Assess the controls that decide outcomes
Not every control matters equally. Spend your time on the ones that most often decide whether an intrusion is contained or becomes a crisis.
- Identity and privileged access: the number of administrator accounts, shared administrator accounts, service accounts with standing privileges, and how access is granted and reviewed
- Multi-factor authentication: coverage of remote access, email, administrator and cloud console access, and the list of exceptions
- Vulnerability and patch management: scan coverage, how quickly internet-facing systems are patched, the backlog, unsupported systems
- Backups and recovery: offline or immutable copies, separate credentials, the date and result of the last full restore test
- Endpoint protection: coverage measured against the asset count, and who acts on alerts
- Logging and monitoring: what is collected, how long it is kept, whether anyone watches outside office hours
- Third parties: suppliers with remote access or sensitive data, and how they are assessed
5. Plan a compromise assessment
Treat the target's environment as untrusted until shown otherwise. A compromise assessment looks for signs of a current or past intrusion: persistence mechanisms, unexpected accounts, unusual sign-ins, known attacker tooling, data staged for exfiltration. It is not a penetration test. It needs telemetry from endpoints, the directory and the email platform, so agree the timing and access with the seller, often as a pre-closing undertaking or as the first task after closing.
- Scope: directory service, endpoints, email platform, internet-facing systems, cloud tenancies
- Look-back period, limited by how long logs are kept
- Who performs it, and who receives the findings
- What happens if it finds something: incident response, notification and deal consequences, agreed with counsel in advance
6. Set the connectivity gate
Write down the criteria that must be met before any network link, directory trust or shared administration joins the two estates. Have them signed off by whoever owns security risk for the buyer, so day-one pressure does not override them.
- Compromise assessment complete, with no unresolved findings
- Multi-factor authentication on all remote access and privileged accounts
- Privileged accounts reviewed; stale and shared administrator accounts removed
- Endpoint protection deployed and monitored across the in-scope estate
- Critical internet-facing vulnerabilities fixed
- Backups verified by a test restore
- Logs forwarded to a monitored service
- A named owner who can approve exceptions, in writing
7. Turn findings into deal outputs
Score each finding for likelihood and impact, then agree a treatment with the deal team and counsel: price, purchase agreement, pre-closing fix, day-one action or accepted risk.
Red flags
- Remote access gateways or administration panels on the internet without multi-factor authentication
- Recent staff credentials in breach data, combined with no multi-factor authentication on email
- A certification scoped to one product or site, presented as covering the company
- An attestation report that is out of date, or has exceptions nobody can explain
- No incident ever recorded, which usually means nobody is looking
- Backups reachable with the same administrator credentials as production
- Dozens of administrator accounts, used for everyday work
- Security run by one person, or by an outsourcer with no handover terms
- Logs kept for days, or not at all
- Refusal to allow any compromise assessment before connection
What you hand over
- The security due diligence report
- The outside-in profile, reconciled with the data room
- A scored findings register with owners and treatments
- The breach and incident history, with counsel's view on notification duties
- Compromise assessment scope, timing and access arrangements
- The connectivity gate criteria, signed off
- Pre-closing fixes and day-one security requirements for day-one readiness
Where MNA Tools helps
- DeepReview gives you the outside-in view from public information: footprint, exposures, leaked credentials, an A to F grade and a breach-risk profile. It is passive by default; the optional active check runs only with the target's written permission. Available on request.
- HouseGRC lets you adopt your own frameworks for the target, record its answers as evidence or gaps, assess its critical suppliers, and keep every finding as a scored, owned risk in the target's own organisation.
A general guide to the technology side of a deal, not legal, tax or financial advice. Adapt it to the deal in front of you, and take advice where the stakes call for it.