A merger or acquisition is one of the most critical steps a company can take. However, alongside the opportunity it presents for business growth, it also poses significant security threats. A target company—or even its supply chain—may bring with it a host of hidden security risks. From undiscovered data breaches to regulatory compliance omissions, failing to uncover these issues at the right time could result in costly fines, reputational damage and even disruption of the merger or acquisition itself.
Cybersecurity due diligence enables organizations to better defend themselves against the many risks involved in mergers or acquisitions. This article outlines the value of cybersecurity due diligence, key aspects of the due diligence process, and associated risks to help your organization benefit from better-informed M&A decision-making.
What is Cybersecurity Due Diligence?
Cybersecurity due diligence helps firms considering an acquisition to understand cybersecurity risk and develop plans to address risks associated with their target. It involves review of risk governance, defensive capabilities and key controls used to secure the organization’s information assets to support better-informed M&A decisions, rather than relying solely on self-disclosures.
Cybersecurity due diligence allows deal teams to understand the target’s threat environment and security posture to inform negotiations and day 1 planning. By checking for and identifying any potential or existing security issues, businesses can reduce the risk of fines and costly remediation. This can also be highly advantageous for the company on the sell side as it enables them to better demonstrate that they work with robust cybersecurity practices, potentially enhancing their reputation and increasing the business valuation.
The Value of Cybersecurity Due Diligence in M&A
Cybersecurity due diligence plays a critical role in supporting successful M&A by ensuring that organizations gain comprehensive insight into the existing and potential risks associated with the target company. It helps to drive better M&A decision-making and reduces the potential for costly security issues further down the line. Cybersecurity due diligence achieves this by highlighting specific vulnerabilities and capability weaknesses to better inform the terms and conditions of an agreement. Any risks that are identified can then be addressed to ensure that the merger or acquisition is completed successfully and there are no unexpected financial costs.
The cybersecurity due diligence process is aimed at highlighting specific issues that have the potential to affect the value of an acquisition or the success of a merger. For example, it can help to identify key cybersecurity vulnerabilities that need to be addressed before the transaction is completed. The process can also identify signs of a breach, including previous breaches that the company has been affected by without its knowledge. Cybersecurity due diligence also involves investigating the target company’s approach to breach management, disaster recovery, business continuity and compliance with industry regulations.
Any organization pursuing a transaction can help protect value through a cybersecurity due diligence assessment. Companies that benefit from this type of support are private equity firms, hedge funds, investment banks and blue-chip organizations in a wide range of sectors.
The Benefits of Cybersecurity Due Diligence
Effective cybersecurity due diligence enables organizations to:
- Identify Cybersecurity Risks–Companies can more easily discover specific security risks and weaknesses present within an organization, including undisclosed or unknown security breaches and at-risk areas.
- Understand Financial Implications of Cyber Risks–Cybersecurity due diligence provides valuable insights into the potential financial impacts of identified cybersecurity risks on deal valuation.
- Inform the Negotiation Process–Knowledge of any potential remediation costs helps inform valuation and financial negotiations.
- Demonstrate Commitment to Data Security–Undertaking the cybersecurity due diligence process allows organizations to show stakeholders and regulators that they are committed to data security and compliance.
- Identify Risks Across the Business–Organizations can more easily uncover information security risks and shortfalls in governance, operations and technology, not just those solely related to security.
- Understand Readiness to Respond to Incidents–Companies can gain more precise insight into the target company’s readiness to identify, respond and recover from cybersecurity incidents.
- Streamline the M&A Process–Cybersecurity due diligence reduces the potential roadblocks to the completion of a merger or acquisition by enabling the structured identification and management of security issues as early as possible, helping to maximize return on investment.
- Defend Against Increased Attacker Attention Resulting from M&A–The M&A process itself has the potential to increase the level of risk a company must withstand. Threat actors recognize that this is a stage during which large volumes of sensitive information may be shared between companies and that key employees may be under pressure and therefore at risk of failing to follow key security steps. It is even more important to undertake in-depth assessments to limit risk upon announcement of a deal.
- Minimize Operational Disruption–Cybersecurity due diligence services help to reduce the risk of operational disruption through targeted recommendations associated with the planned integration or separation of the target’s cybersecurity functions.
Security Issues Covered by Cybersecurity Due Diligence Assessments
The cybersecurity due diligence process highlights specific areas of security, all of which have the potential to affect the value and success of M&A. These include:
- Key cybersecurity issues and vulnerabilities to address prior to closing
- Implementation status of key cybersecurity capabilities and controls
- Signs of an existing breach
- Signs of previous breaches that the company had without its knowledge
- Breach management
- Disaster recovery
- Business continuity
- Compliance with industry regulations
Key Aspects of the Cybersecurity Due Diligence Process
The cybersecurity due diligence process commonly covers the following aspects:
- Security Controls–The process should thoroughly test the effectiveness of a company’s security controls in safeguarding sensitive data and systems, covering areas such as incident response plans, firewalls, access controls and intrusion detection systems.
- Security Policies and Procedures–As the foundation of a company’s approach to managing security and adhering to industry and regulatory requirements, it is important to fully assess the company’s security policies, procedures and guidelines.
- Compliance and Regulatory Requirements–Effective security addresses how a company complies with legal, regulatory and industry requirements around data protection and information security. This will vary according to sector but may include the Digital Operational Resilience Act, General Data Protection Regulation, ISO 27001, HIPAA or Payment Card Industry Data Security Standard.
- Incident Response Capability–With incident response playing a key role in an organization’s cyber resilience, it is vital that aspects such as incident reporting mechanisms, incident response plans and incident management procedures are fully assessed.
- Risk Management Framework–The evaluation of a company’s risk management framework covers areas such as risk assessment processes, risk identification, risk mitigation strategies, and risk monitoring and reporting mechanisms.
The Structure of the Cybersecurity Due Diligence Process
The cybersecurity due diligence process and its duration are defined by an organization’s specific requirements, the target company and the nature of the business deal. It is usually divided into two key areas: pre- and post-transaction.
Pre-Transaction
Example steps include evaluation of:
- Cybersecurity control implementation
- Risk scenarios and a sector-aligned threat profile for the target
- Target’s external digital footprint
- Readiness to comply with security standards and regulations
- Third-party risk and dark web exposure
- Cyber insurance coverage
Post-Transaction
Example steps include:
- Assessing IT hygiene and compromise
- Developing governance artifacts, including policies and standards
- Simulating adversaries and penetration testing
- Acting as virtual chief information security officer
- Evaluating operational risk, including Intellectual Property, financial and personal data
- Preparing the company’s security strategy to meet business goals and compliance requirements
- Building and managing third-party cyber risk programs
- Guiding security incident response and recovery
Streamlining M&A with Cybersecurity Due Diligence
Cybersecurity due diligence involves more specialist and in-depth methods of assessment and investigation than general due diligence. It is particularly valuable during M&A because of its role in identifying and uncovering existing or potential security issues. The knowledge gained from a due diligence assessment can have a critical impact on the nature of a business deal’s terms or cost. It also removes the risks of relying solely on the target organization’s self-disclosed information. Gaining a full picture of the company’s security posture is more important than ever in an increasingly complex threat landscape. Cybersecurity due diligence also helps companies streamline the process of a merger or acquisition to keep moving forward at the required pace, reducing the potential pitfalls and costs of delays.
Cybersecurity Due Diligence in Third-Party Risk Management
Third-party or supply chain risk management is key to cybersecurity due diligence because of the potential security issues posed by a company’s supply chain or other external parties with access to its data, systems or privileged information. While third parties such as vendors, suppliers, consultants and contractors can add great value to your organization, they also bring with them the potential for additional security risks. A vulnerability or issue caused by a third party could lead to security incidents such as data breaches or IP theft. Cybersecurity due diligence in third-party risk management can significantly reduce, mitigate or remediate the many types of risks created by third-party relationships.
Risks Associated with Cybersecurity Due Diligence
As a complex process encompassing many areas of a company’s security and broader ecosystem, undertaking cybersecurity due diligence as an organization can present a number of pitfalls. These include:
- Time Constraints–It is critical that enough time is allocated to the process to remove the risk of oversights or omissions in identifying and addressing issues.
- Failure to Assess All Relevant Areas–An effective cybersecurity due diligence process must assess all relevant aspects of a company’s approach to security because overlooking any could lead to missing security weaknesses or even breaches.
- Addressing Only One Side of the Process–Depending on the nature of the deal, organizations need to avoid the risk of only looking at issues at the pre-merger or acquisition stage when there may be aspects that should be addressed post-merger.
Cybersecurity Due Diligence Case Study: Global Investment Firm
A leading global investment firm with over $150 billion in assets under management asked for Kroll’s help in developing a cybersecurity due diligence framework to evaluate the maturity of its M&A targets. The company needed the framework to be as accurate as possible due to time constraints and limited access to internal systems in order to support a large number of fast-moving investments.
Kroll’s cyber risk experts developed a security evaluation based on the CIS Top 18 Critical Security Controls™ to determine a company’s risk of being breached and its overall cyber posture. The light-touch evaluation provided a high-level overview and included three core areas:
- Review of the existing policies and procedures of the investment target, including incident response plans
- Completion of a written questionnaire or phone interview
- Analysis of previous assessment reports (such as SOC 2) when available
Once implemented, Kroll’s cybersecurity due diligence framework required less than two hours from the investment company’s information security team, providing the key insights needed for a more judicious valuation of each deal.
Enhance Your M&A Decision-Making with Kroll
Gain a thorough evaluation of the cybersecurity capabilities and potential cyber risks associated with a potential transaction through Kroll’s cybersecurity due diligence service. Our cybersecurity due diligence services support better-informed investment decision-making at the start of the deal life cycle, giving you earlier visibility into security risks. Our real-time threat intelligence and three-tier assessment framework will uncover hidden vulnerabilities and enable your organization to better understand the potential financial implications before finalizing a deal.
Our clients benefit from frontline threat intelligence drawn from thousands of M&A, incident response and regulatory engagements undertaken every year. From pre-deal assessments to post-merger integration, our experts provide continual guidance, ensuring comprehensive risk management across all stages of the M&A transaction. We ensure that you achieve the highest level of insight with minimal business disruption by leveraging remote and minimally invasive technologies to reduce potential disruptions to your business operations.
