Introduction: What Cybersecurity Due Diligence Reveals
Cybersecurity due diligence is an evidence-based examination of how an organization actually defends itself. It is not a review of policies or a stack of certificates.
The stakes are real. Nearly 1 in 4 executives FTI Consulting surveyed reported a cyber incident during or shortly after a transaction. Only 23% said they proactively manage cyber risk after close.
Hidden incidents, weak controls, regulatory exposure, and unmet customer commitments all land on the buyer's balance sheet. Left unchecked, they can shift valuation, deal terms, and continuity.
This guide covers how to define scope, gather and validate evidence, review ten core areas, turn findings into actions, and keep the work going after signing or onboarding.
Key Takeaways
- Due diligence tests whether controls work in practice, backed by current evidence.
- Cover ten areas, from governance to insurance.
- Match depth to the deal, data sensitivity, and time available.
- Give every material finding a rating, owner, date, and treatment.
What Is Cybersecurity Due Diligence and Why Does It Matter?
What cybersecurity due diligence means
Cybersecurity due diligence is a structured evaluation of policies, people, processes, technology, data obligations, third parties, and incident history. The goal is to understand current and inherited cyber risk.
Scope shifts with context:
- M&A diligence evaluates a target before and after the transaction.
- Vendor diligence evaluates an external relationship.
- Internal assessment measures your own security maturity.
Why it matters for transaction decisions
Findings affect price, integration complexity, insurance, customer commitments, and whether to proceed at all. Verizon's Yahoo deal is the clearest example.
A February 2017 Verizon SEC filing records a $350M reduction to roughly $4.48B in cash after breaches came to light. Yahoo also retained 50% of certain breach-related liabilities and 100% of shareholder suits and SEC matters.
That is one negotiated outcome, not a standard cyber discount. But it shows how breach facts turn into contract terms.
Due diligence versus compliance
Compliance shows alignment with a defined framework, law, or audit scope. Due diligence asks whether controls are appropriate, effective, current, and relevant to real risk.
Review every assurance artifact for:
- Scope: does it cover the primary product or only part of the business?
- Assessment period: Type II SOC 2 reports cover a period, Type I a point in time
- Exceptions noted by the auditor
- Subservice organizations and complementary user-entity controls
ISO 27001 works the same way. An ISMS may cover only part of a larger organization, so read the Statement of Applicability. A HIPAA risk analysis must reach all ePHI the organization creates, receives, maintains, or transmits.
Who should participate
- Corporate development or investment teams
- Security and IT leaders
- Legal and privacy counsel
- Compliance and finance
- Operations and owners of critical systems
External specialists help when documentation is thin, the timeline is compressed, technical access is restricted, or the environment is regulated or highly technical.
How to Conduct Cybersecurity Due Diligence
Define scope, objectives, and risk tolerance
Start with the decision the assessment must support. Then list systems in scope, sensitive data, critical services, third-party dependencies, and regulatory obligations.
Depth varies. An acquisition, vendor onboarding, divestiture, or a high-risk change such as adopting AI or connecting operational technology each warrants a different level of effort. NIST SP 800-30 puts the same emphasis on purpose, assumptions, constraints, and information sources up front.
Request evidence, not yes-or-no answers
Ask for:
- Incident and breach records, risk registers, and policies
- Asset inventories and identity reports
- Vulnerability data and penetration tests
- Cloud configurations and application assessments
- Vendor inventories and recovery test results
- Insurance documents and compliance reports
Then interview security, IT, engineering, legal, privacy, and operations staff. The goal is to find where documented process and daily practice diverge.
Validate technically, with authorization
Begin outside-in: internet-facing assets, exposed services, email security, public breach information, and leaked credentials. This needs no sensitive access. NIST notes external scanning sees only what perimeter controls expose, so it reveals much less than an internal review.
Read-only console reviews, configuration checks, scanning, compromise assessments, and penetration testing need written authorization, a defined scope, and coordination with counsel and the target's technical team. DOJ's 2022 CFAA charging policy is not blanket permission to test.
Analyze gaps and inconsistencies
Compare documents against system evidence. Watch for:
- MFA claimed company-wide but excluding privileged accounts
- A certificate that excludes the main product
- Unsupported systems missing from the asset inventory
- Vendors with production access absent from the risk register
- Cyber insurance applications describing stronger controls than exist
The insurance point matters. In Travelers v. International Control Systems, the insurer alleged inaccurate MFA representations, and the policy was declared void from inception by stipulation. That was not a fraud finding, but it shows the risk.
Produce a decision-ready report
The report should state methodology, scope limits, evidence reviewed, open questions, validated findings, ratings, business impact, and next steps. Extend it through signing, closing, Day 1, and post-close, with an owner, date, budget, and verification method for each priority.
Cybersecurity Due Diligence Checklist: 10 Areas to Review
1. Governance, ownership, budget, and policies
Review the org chart, staffing, budget history, board reporting, policies, risk register, and awareness program. Flag informal accountability, persistent high-risk exceptions, and outdated or unsigned policies. FTI found 34% of CISOs were not heavily involved in transaction decisions.
2. Incident, breach, and response history
Request incident registers, forensic reports, regulator and customer notices, ransomware records, tabletop results, and root-cause analyses. Probe for undisclosed incidents, delayed notifications, repeated failures, and any inability to say how long an intrusion existed. Mandiant found 52% of investigated intrusions were first detected internally.
3. Identity, access, endpoint, network, and vulnerability management
Assess MFA coverage, privileged and service accounts, joiner-mover-leaver processes, EDR coverage, segmentation, patching, remote access, and end-of-life systems.
In one DBIR cloud dataset, 37% of organizations had an IaaS admin account without MFA. Vulnerability exploitation drove 31% of initial access. Check findings against CISA's Known Exploited Vulnerabilities catalog.
4. Cloud, application, software, AI, and API security
Review cloud account inventories, secrets management, infrastructure-as-code, deployment access, testing, dependencies, and AI data or model governance. Look for public storage, excessive permissions, long-lived credentials, production data in test, and insecure APIs.
The OWASP API and LLM lists give useful test criteria, though they are risk frameworks, not prevalence data.
5. Data inventory, privacy, and third-party risk
Examine data maps, retention, privacy notices, consent records, data-processing terms, vendor inventories, and subcontractors. Flag unknown data stores, indefinite retention, vendors without security terms, and missing breach-notification duties.
Third parties were involved in 48% of breaches in the 2026 DBIR.
6. Compliance, customer commitments, resilience, and insurance
Review frameworks, customer security clauses, audit reports and their scopes, backup architecture, restoration evidence, recovery objectives, continuity plans, cyber policies, and claims history.
Check for commitments the company cannot meet, unexercised recovery plans, backups reachable with production credentials, and change-of-control terms that may end coverage at closing.
Regulatory clocks differ: SEC's four business days run from materiality determination, HIPAA's 60 days from discovery, and the FTC Safeguards Rule's 30 days from discovery.
How to Turn Findings Into Decisions and Actions
Rate findings by risk, confidence, and business impact
Separate findings into confirmed compromise, material exposure, control weakness, compliance gap, documentation deficiency, and accepted risk. Record confidence and the evidence behind each.
Then weigh impact on sensitive data, critical operations, contracts, regulatory duties, integration effort, insurance, and remediation cost.
Match each finding to a treatment
| Finding type | Typical treatment |
|---|---|
| Known incident or contingent liability | Specific indemnity, escrow, price adjustment |
| Unacceptable unresolved exposure | Pre-close remediation or closing condition |
| Insurance gap | R&W exclusion review, policy renegotiation |
| Operational control gap | Funded Day 1 or 100-day remediation |
| Low-impact issue | Documented risk acceptance |
Legal commentary from SGR discusses folding identified cyber risks into valuation or specific indemnities. That is 2018 guidance, not a market-frequency benchmark.
Make the report useful to executives and counsel
Lead with an executive summary that separates deal-critical issues from manageable gaps and states which decision each finding informs. Back each finding with:
- Evidence and affected assets
- Dependencies and remediation assumptions
- Owners, deadlines, and any scope limitation that could affect insurance or negotiation
Continue diligence after signing
Cyber risk shifts after integration, leadership changes, or major rollouts. ACA's 100-day playbook is useful guidance, not a hard deadline:
- Day 1: access revocation
- Days 1 to 30: ownership and exposure assessment before connecting networks
- Days 31 to 60: remediation tracking
- Days 61 to 100: a unified program
Keep monitoring newly connected systems, inherited accounts, third-party access, security-tool coverage, and incident reporting.
Common Pitfalls and When to Bring in Specialists
Common mistakes:
- Treating questionnaires, policies, certifications, or security ratings as proof. Ratings can be inaccurate or incomplete, and are not an internal control assessment.
- Accepting compressed timelines without adjusting. FTI found that 1 in 4 CISOs said leaders prioritized closing quickly over thorough diligence.
- Failing to record what was not reviewed, so decision-makers cannot judge residual risk.
When time is short or data-room access is partial, triage by risk. Cover identity, exposed assets, incident history, and critical vendors first. Write down every limitation so the decision-makers know how much confidence the findings carry.
Specialist help makes sense when you:
- Lack a 24/7 security function
- Are consolidating fragmented providers
- Face a regulated transaction
- Need coordinated advisory, offensive security, threat intelligence, monitoring, and GRC expertise
DeepSeas is one option for enterprise and mid-market organizations. Its practitioner-led services span strategic advisory, offensive security, threat intelligence, managed detection and response, the CyberFusion SOC, and governance, risk, and compliance. GRC work is informed by ISO Lead Auditor-certified specialists.
In one life sciences M&A engagement, a DeepSeas compromise assessment of the target ran before network integration and produced a full risk profile.
Frequently Asked Questions
What is considered due diligence?
It is a reasonable, structured investigation of risks, evidence, obligations, and facts before a business decision. Cybersecurity due diligence applies that process to security posture and cyber risk.
What is the difference between due diligence and compliance?
Compliance measures alignment with a defined requirement. Due diligence evaluates broader risk, control effectiveness, evidence quality, and business consequences.
What are the four main types of due diligence?
Investopedia lists commercial, legal, financial, and tax. Taxonomies vary. Cybersecurity is a specialized workstream that overlaps several of these.
What is a red flag DD report?
It highlights material issues needing escalation or a decision. Cyber red flags include undisclosed incidents, privileged-access weaknesses, critical unpatched exposure, regulatory gaps, and untested recovery.
What are the four P's of due diligence?
The best-known version, from investment-manager selection, is people, philosophy, process, and performance. It is not a cybersecurity standard and should not replace a documented scope, evidence review, and risk-based findings.
