Cyber Due Diligence in M&A: Pre-Deal to 100 Days

When a company buys another, it buys its attackers too: an intrusion that started before the deal becomes the buyer's breach, the buyer's regulatory case and the buyer's integration problem. Cyber due diligence is how a buyer finds that risk before signing, prices or protects against it in the deal documents, and contains it in the months after close. This guide covers the full deal timeline: what to ask before an offer, what to test in the data room and under clean team rules, which findings should change price or terms, how to connect the target safely on day one, and how to run the first 100 days of security integration. It is written for CISOs, deal teams, corporate development, legal counsel and integration leads on the buy side, with notes for sellers preparing for scrutiny. Identity integration detail is covered separately in the Identity Integration in M&A Guide.

Key takeaways

Inherited intrusions are the largest single risk. The Starwood guest database breach began around July 2014, Marriott acquired Starwood in 2016, and the intrusion was not detected until September 2018, according to the US FTC.
Diligence findings must change the deal. Every material finding should end up as a price adjustment, a specific warranty or indemnity, a condition before close, or a funded remediation line in the integration plan.
Access before close is limited, so plan for it. Questionnaires and data room documents show intent, not reality; schedule a compromise assessment and technical discovery for the first weeks after close.
Treat the target as untrusted until proven otherwise. Connect through controlled, monitored paths, not network merges or directory trusts, until discovery and threat hunting are complete.
Disclosure obligations do not pause for a deal. Yahoo's 2014 breach surfaced in 2016 while its sale to Verizon was closing, and the SEC later fined Altaba USD 35 million for misleading investors.

Why cyber risk belongs in the deal

The deal team usually values a target on revenue, customers and technology. Cyber risk touches all three, and it is one of the few risks that can be present but invisible at signing.

Inherited compromise: attackers already inside the target come with it, and once networks or identities are joined they can move into the buyer. The FTC's 2024 action against Marriott and Starwood covered three breaches affecting more than 344 million customers, including the Starwood guest database breach of 339 million records with 5.25 million unencrypted passport numbers. The FTC said Marriott became responsible for the data security practices of both brands after the 2016 acquisition.
Regulatory and legal liability: enforcement actions, fines and class actions attach to the entity, so they follow it into the group. The FTC order requires Marriott to run a comprehensive information security programme, certify compliance annually for 20 years and obtain independent assessments every two years.
Disclosure risk: undisclosed incidents can mislead investors. The SEC found Yahoo's security team learned of the December 2014 theft within days and reported it to senior management and legal, but Yahoo's filings for two years referred only to the risk of breaches. Listed buyers must also consider Form 8-K Item 1.05, generally due four business days after an incident is determined to be material.
Integration cost: legacy platforms, unsupported systems, missing logging and unowned machine credentials turn into unplanned spend after close.
Value erosion: stolen intellectual property, a damaged brand or a lost certification (for example a payment card or government authorisation) can remove the value the deal was meant to capture.

Due diligence across the deal timeline

Phase	Security goal	Typical access	Main activities
Screening and pre-offer	Spot deal-breakers early	Public information only	Outside-in review of internet exposure, leaked credentials, breach history, regulatory actions, dark web mentions, certifications claimed
Confirmatory diligence	Understand control maturity and known incidents	Data room, management interviews, questionnaire	Policies, risk register, incident log, penetration test reports, audit reports, insurance claims, regulatory correspondence, architecture diagrams
Clean team or deep dive	Test selected claims	Restricted, under NDA and clean team rules	Expert sessions with target security staff, review of logging coverage, privileged access, backups, third-party access; sometimes limited technical testing with the seller's consent
Signing to close	Protect value and prepare	Interim covenants, integration planning	Agree interim security obligations, notification of incidents before close, day one plan, compromise assessment scope
Day one	Connect safely	Full ownership	Minimum necessary connectivity, monitoring of all cross-company paths, emergency credential rotation for shared or exposed secrets
First 100 days	Find and fix	Full	Compromise assessment, asset and identity discovery, critical remediation, integration decisions

The findings from each phase should flow into one register owned by the deal lead, with a column for how each one is handled in the transaction.

What to assess

Outside-in, before access

Attack surface: internet-facing services, exposed remote access, end-of-life software visible from outside, expired or weak certificates, misconfigured cloud storage. See the Attack Surface Management Guide.
Credential exposure: employee credentials in public breach corpora and infostealer logs, secrets in public code repositories.
Public record: disclosed breaches, regulator decisions, litigation, and how the target responded.

Documents and interviews

Area	Ask for	What good evidence looks like	Red flag
Governance	Security charter, org chart, board reporting, risk register	Named security lead, regular board reporting, risks with owners and dates	No security lead, or security reported only through IT
Incident history	Incident log for three to five years, forensic reports, notifications made	Incidents logged with root cause and closure; regulator notifications where required	"No incidents" from a company of any size; unresolved investigations
Assurance	ISO/IEC 27001 certificate and scope, SOC 2 reports, PCI DSS attestations, penetration test reports	Current certificates covering the systems in the deal; findings tracked to closure	Certificate scope excludes the products being acquired
Identity and access	Directory and IdP design, MFA coverage, privileged account list, service account inventory	Phishing-resistant MFA for admins, PAM, NHI inventory with owners	Shared admin accounts, no inventory of service accounts or API keys
Detection and response	Logging coverage, SOC or MDR contract, retention, IR plan and exercise records	Central logging for identity, endpoint and cloud, tested IR plan	Logs kept days not months, which makes a compromise assessment unreliable
Resilience	Backup design, recovery tests, ransomware readiness	Immutable or offline backups, recent restore tests	Backups reachable from the domain with production credentials
Data and privacy	Data inventory, records of processing, cross-border transfers, retention	Data mapped to systems and lawful bases	Personal data retained indefinitely with no inventory
Product and software	SDLC, dependency management, SBOMs, vulnerability disclosure	Secure SDLC, SBOMs for shipped products, a disclosure policy	No process for third-party component vulnerabilities
Third parties	Key suppliers, MSP access, outsourced IT, contracts	Tiered supplier register, MSP access controlled and logged	An MSP with standing domain admin across the estate
Insurance	Cyber policy, claims history, exclusions, change of control terms	Policy in force with known run-off arrangements	Claims declined for control failures

For data and privacy questions, the Data Mapping and ROPA Guide sets out what a mature inventory contains. For suppliers, use the tiering method in the Third-Party Risk Management Guide.

Questions for the target's security lead

A one-hour session with the person who runs security often reveals more than the data room. Useful questions:

What was the most serious incident in the past three years, how was it found, and what changed afterwards?
Which systems would you least like an attacker to reach, and what stands between them and the internet?
How many accounts have domain, tenant or cloud administrator rights today, and how do you know?
Which service accounts, API keys or integrations could you not rotate this week without breaking production?
How long are identity, endpoint and cloud logs kept, and who reviews alerts out of hours?
When did you last restore a critical system from backup, and how long did it take?
Which suppliers or managed service providers hold privileged access, and how is it controlled?
What is on your remediation list that has not been funded?

Hesitation on the administrator count or the rotation question is itself a finding: it signals that privileged and non-human identities are not inventoried.

Turning findings into deal terms

Diligence that does not change the transaction is an expensive report. Agree with counsel early how each class of finding is handled. The mechanisms below are standard deal tools; their use and wording are for your legal advisers.

Finding	Typical handling	Example
Known, quantifiable remediation	Price adjustment or funded line in the integration budget	Replace end-of-life VPN and directory servers
Known incident with uncertain outcome	Specific indemnity, escrow or holdback	Pending regulator investigation of a past breach
Unknown but plausible risk	Specific warranties on security and incidents, with disclosure against them	Warranty that no undisclosed security incident occurred in a defined period
Critical gap that must close first	Condition before close or pre-close covenant	Revoke shared administrator accounts before integration
Ongoing behaviour between signing and close	Interim covenants and incident notification duty	Seller must notify the buyer of any security incident before close
Risk the buyer accepts	Documented risk acceptance by the deal sponsor	Weak logging in a small subsidiary scheduled for decommissioning

Check how warranty and indemnity insurance treats cyber: underwriters often exclude matters found in diligence, so known incidents usually need specific protection instead. See the Cyber Insurance Guide.

Day one and the first 100 days

Before close, decide the day one posture: list the few services the target genuinely needs on day one (email and collaboration, named applications, finance reporting) and provide them through brokered access, not a network or directory merge.
Rotate what may be exposed: credentials shared during diligence, vendor accounts used by the seller's advisers, and any shared administrator accounts. See the Leaked Credential Response Playbook.
Deploy detection first: put endpoint detection and log forwarding on the target estate before connecting it. A compromise assessment depends on telemetry.
Run a compromise assessment (weeks 1 to 6): hunt for persistence, unknown administrator accounts, suspicious OAuth grants and cloud keys, and signs of past data staging. See the Compromise Assessment Guide.
Discover assets and identities (weeks 1 to 8): build the asset inventory, map privileged and non-human identities, and assign owners. Inherited service accounts, app registrations and CI tokens are covered in the Identity Integration in M&A Guide.
Remediate critical findings (weeks 4 to 12): close internet-exposed vulnerabilities, enforce MFA on remote and administrative access, fix backups.
Decide the integration pattern: keep separate, connect selectively, or consolidate. Only consolidate identities and networks once the compromise assessment is clean.
Keep a rollback route: every cross-company connection should be removable within hours, with a named owner and a documented switch-off, until integration is complete.

Where identity fits: the fastest way for an inherited intrusion to reach the buyer is through identity: a directory trust, a synchronised admin group or a service account granted access to both estates. Treat identity integration as the final step of security integration, not the first.

Decision guidance: depth and size

Small bolt-on (tens of staff): a focused questionnaire, outside-in scan and interview may be enough, with a full compromise assessment after close and a plan to absorb the target into the buyer's controls quickly.
Mid-sized acquisition: add document review across the areas in the table above, a clean team session with the target's security lead and specific security warranties.
Large or regulated target: add expert-led technical deep dives, external counsel on regulatory exposure, review of regulator correspondence and a detailed interim covenant schedule. Expect the target to operate separately for longer.
Carve-outs and divestitures: the transaction creates a transition services agreement in which one party runs systems for the other. Scope, log and time-box it, and rotate shared secrets at exit.
Seller side: sellers who prepare an honest security pack (incident history, certificates, remediation plans) shorten diligence and reduce the chance of price chips late in the process.

Detection and measurement

Diligence coverage: percentage of assessment areas with evidence reviewed, not just questionnaire answers.
Finding disposition: share of material findings mapped to a deal term, remediation budget or documented acceptance before signing.
Telemetry coverage at day 30: percentage of target endpoints, servers and cloud accounts sending logs to the buyer's SOC.
Compromise assessment completion: days from close to a signed-off assessment result.
Identity ownership: percentage of inherited privileged and non-human identities with a named owner and decision (keep, rotate, retire).
Critical remediation: number of internet-exposed critical vulnerabilities on the target estate at day 30, 60 and 90.

Framework mapping

Framework	Reference	How it applies to M&A
NIST CSF 2.0	GV.SC-01, GV.SC-07	Treat the target as a high-risk third party until integrated; assess, record and monitor its risk
NIST CSF 2.0	ID.AM-01, ID.AM-02, ID.AM-07	Hardware, software and data inventories for the acquired estate
NIST SP 800-53 Rev. 5	RA-3	Risk assessment of the target environment before connection
NIST SP 800-53 Rev. 5	SA-9, AC-20	Controls on external system services and use of external systems during transition
NIST SP 800-53 Rev. 5	SR-6, PM-30	Supplier assessments and supply chain risk strategy for the target's suppliers
NIST SP 800-53 Rev. 5	CM-8	System component inventory after close
ISO/IEC 27001:2022	Annex A 5.19 to 5.22	Supplier relationships and monitoring, applied to the target and transition services

Common failure patterns

Security brought in after the price is agreed: findings arrive when the only remaining lever is a post-close budget request.
Trusting the questionnaire: yes and no answers stand in for evidence. Ask for the artefact behind each important answer.
Connecting before hunting: a directory trust or flat network link on day one gives any inherited intruder a path into the buyer. The Starwood intrusion, which began before the acquisition, went undetected for around two years after it, according to the FTC.
No interim incident duty: the seller is not obliged to tell the buyer about incidents between signing and close.
Logs too short to investigate: the target keeps a few days of logs, so the compromise assessment cannot look back far enough; start retaining immediately after close.
Inherited machine credentials left running: service accounts, API keys and OAuth integrations outlive the integration project because nobody owns them.

Practitioner checklist

Join the deal team before the offer, with an outside-in review of the target in the screening phase.
Use a standard diligence request list covering governance, incidents, assurance, identity, detection, resilience, data, product and suppliers.
Ask for evidence behind each material answer, not only questionnaire responses.
Record every finding in one register with its deal treatment: price, indemnity, warranty, condition, covenant or acceptance.
Include an incident notification duty and security covenants between signing and close.
Define a day one posture with minimum brokered connectivity and no directory or network merge.
Deploy detection and log forwarding on the target estate before connecting it.
Complete a compromise assessment before consolidating identities or networks.
Inventory and assign owners to inherited privileged and non-human identities within 60 days.
Report diligence and integration metrics to the deal sponsor until integration closes.

Cyber Due Diligence in Mergers and Acquisitions Guide