How to Evaluate Cybersecurity Due Diligence

When evaluating a target entity, the acquirer faces a binary choice: rely upon the self-disclosed security assertions provided in a data room, or execute a forensic verification of the target's actual defensive posture. The former assumes a level of transparency that rarely exists in legacy environments, while the latter treats cybersecurity as a material valuation risk that can either justify a price reduction or terminate a transaction entirely.

The failure to distinguish between these two paths often leads to the inheritance of "silent" liabilities. As noted in the Cybersecurity Due Diligence: A Practical Guide by Kroll, a target company or its supply chain may harbour hidden security risks, ranging from undiscovered data breaches to systemic regulatory omissions, which can disrupt the merger or result in catastrophic post-closing fines.

Deconstructing the Governance and Control Stack

An authoritative evaluation begins not with a vulnerability scan, but with an analysis of the target's risk governance. One must determine whether security is a functional appendage of the IT department or a strategic pillar integrated into the corporate governance framework. A target that lacks a formal cybersecurity strategy often lacks the telemetry required to detect a breach, meaning that a "clean" report is frequently a symptom of blindness rather than a sign of health.

To move beyond surface-level assurances, the evaluator must scrutinise the following structural elements:

• The alignment of the cybersecurity strategy with the overall business objectives.
• The presence and efficacy of internal risk assessment procedures and the remediation timelines for identified gaps.
• The maturity of the disaster recovery and business continuity plans, specifically regarding their tested recovery time objectives.
• The scope and limits of existing cyber insurance policies and their adequacy relative to the target's risk profile.
• The historical record of data ownership and the legal frameworks governing the movement of sensitive information.
• The relationship and interface security between the target and its critical third-party vendors.

The objective here is to identify if the target possesses the operational maturity to manage risk or if they are merely reacting to incidents. If the governance is fragile, any subsequent technical findings are magnified, as there is no institutional mechanism to ensure permanent remediation. This structural analysis is a core component of a broader Technical Due Diligence Checklist.

Forensic Telemetry and the Detection of Silent Breaches

The most perilous risk in any acquisition is the "silent breach": a compromise that occurred months or years prior to the transaction and remains undetected. The Marriott acquisition of Starwood serves as the definitive cautionary tale; as highlighted by Safe Security, the breach went unnoticed for two years post-acquisition, eventually impacting over 500 million people.

Verification requires a shift from questionnaire-based diligence to telemetry-based analysis. This involves an inside-out examination of the environment to determine if the target is actually capable of seeing the threats it claims to defend against.

A comprehensive technical audit should evaluate:

• The deployment and configuration of endpoint detection and response tools across all network segments.
• The logs of identity and access management systems to detect anomalous privilege escalation.
• The integrity of the software supply chain and the provenance of critical components.
• The presence of undocumented "shadow IT" or legacy servers that bypass standard security controls.
• The effectiveness of patch management cycles for critical, internet-facing vulnerabilities.
• The actual response behavior of employees when faced with simulated or real security incidents.

The presence of a sophisticated security stack is irrelevant if the configuration is flawed or the monitoring is ignored.

Supply Chain Provenance and Ecosystem Risk

Modern cybersecurity due diligence cannot stop at the perimeter of the target entity. The risk surface extends to every ICT supplier and partner that possesses a connection to the target's environment. A vulnerability in a tertiary supplier can provide a direct conduit into the acquired network, rendering the target's internal controls moot.

The NIST SP 1326 guide emphasizes that due diligence should be the minimum amount of understanding an acquirer has regarding a supplier, regardless of perceived criticality. Evaluating this ecosystem requires a rigorous investigation into several high-risk vectors:

• Foreign Ownership, Control, or Influence (FOCI) over critical technology providers.
• The provenance of hardware and software components to mitigate the risk of embedded backdoors.
• The stability of key ICT vendors to ensure continuity of security updates.
• The tiered relationship of the supply chain to identify systemic bottlenecks or single points of failure.
• The adherence of suppliers to foundational cyber practices as verified by independent audits.

Security is only as strong as the weakest link in the interconnected chain.

Sources

• Cybersecurity Due Diligence: A Practical Guide: covers the value of cybersecurity due diligence in M&A and the risks of hidden security issues.
• SP 1326, NIST Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide: provides a framework for conducting due diligence on ICT suppliers and supply chain risk factors.
• 4 Steps to Cybersecurity Due Diligence for M&A - Safe Security: discusses the importance of early assessment and the risks of undetected breaches during acquisitions.