A business acquisition looks financially attractive until the buyer discovers an unresolved ransomware incident, exposed customer data, unsupported software, or a security weakness that requires an expensive overhaul. Cyber due diligence identifies security risks before they become the buyer’s problem. It examines the target company’s technology, cybersecurity controls, data protection practices, previous incidents, third-party exposure, and ability to recover from an attack.
This article explains what cyber due diligence involves, which areas to assess, what to ask the target company, and how to turn the findings into decisions before and after an acquisition.
What Is Cyber Due Diligence?
Cyber due diligence is the process of assessing a company’s cybersecurity posture, technology risks, and data protection practices before a business transaction. In mergers and acquisitions (M&A), it helps the buyer understand whether the target organisation has security weaknesses, unresolved incidents, technology liabilities, or compliance gaps that could affect the value and success of the deal.
The review goes beyond checking whether the target company has antivirus software, a firewall, or a cybersecurity policy.
Why Cyber Due Diligence Matters in UK M&A
Cybersecurity weaknesses create financial and operational liabilities that traditional financial due diligence does not always reveal. A company might report strong revenue while carrying significant security risks that only emerge during a technical assessment.
Cyber due diligence helps buyers:
- Identify hidden liabilities: Unresolved vulnerabilities, previous breaches, regulatory issues, and contractual disputes can create costs after completion.
- Validate technology value: Buyers can assess whether the target’s software, infrastructure, and intellectual property are secure enough to support the agreed valuation.
- Assess data protection exposure: Reviewing personal data handling helps establish whether the target’s practices comply with applicable UK data protection requirements.
- Evaluate operational resilience: Backup systems, recovery procedures, and incident response capabilities determine how well the business can withstand a cyber incident.
- Plan integration costs: Outdated systems, weak identity controls, and incompatible security platforms can increase the cost and time required to combine two organisations.
- Strengthen deal negotiations: Material findings can inform the purchase price, contractual warranties, indemnities, completion conditions, and remediation commitments.
Cyber Due Diligence Checklist: 10 Areas Buyers Need to Assess
A structured cyber due diligence checklist helps deal teams examine the target consistently rather than relying on general assurances from management. The depth of the review depends on the target’s size, industry, technology, data sensitivity, and the proposed transaction.
Use the following checklist to organise the assessment.
M&A Cyber Review Checklist
1. Security governance and policies
Confirm who owns cybersecurity decisions and reports material risks to leadership.
Review security policies, risk assessments, and evidence of regular reviews.
Check whether the target maintains a security improvement plan with assigned owners.
2. Previous cyber incidents
Request a record of known breaches, ransomware events, and significant security incidents.
Review incident investigations, remediation records, and any unresolved findings.
Check for relevant customer notifications, regulatory reports, claims, and disputes.
3. IT infrastructure and assets
Obtain an inventory of servers, endpoints, networks, cloud platforms, and business-critical applications.
Identify unsupported operating systems, legacy equipment, and exposed services.
Review network segmentation, secure configurations, patching, and vulnerability management.
4. Identity and access management
Review privileged accounts, administrator access, and multi-factor authentication coverage.
Check how employee and contractor access is approved, monitored, and revoked.
Identify shared accounts, dormant users, and excessive permissions.
5. Data protection and privacy
Map the personal, financial, customer, and commercially sensitive data held by the target.
Review lawful bases, privacy notices, retention practices, and data-sharing arrangements where relevant.
Check encryption, access controls, processor contracts, and data breach records.
6. Applications and intellectual property
Review application security testing, secure development practices, and known vulnerabilities.
Check ownership and licensing of source code, software components, and other intellectual property.
Assess open-source dependencies, secrets management, and software supply chain risks.
7. Third-party and cloud security
Identify critical IT suppliers, managed service providers, and cloud platforms.
Review supplier security assessments, contracts, access permissions, and incident notification terms.
Check the dependency on single providers and the process for ending supplier access.
8. Backup and disaster recovery
Confirm which systems and datasets are backed up and how frequently.
Check whether backups are isolated or protected against ransomware and unauthorised deletion.
Review recovery objectives and evidence from restoration and disaster recovery tests.
9. Compliance and contractual obligations
Review relevant UK GDPR, the Data Protection Act 2018, and sector-specific requirements.
Check security certifications, audit reports, customer security commitments, and outstanding findings.
Identify contracts or regulatory approvals affected by the change of ownership.
10. Post-acquisition integration
Identify systems, accounts, and data that will connect to the buyer’s environment.
Plan credential changes, access reviews, monitoring, and remediation of critical findings.
Assign risk owners, budgets, deadlines, and integration milestones before completion.
This checklist provides a starting point for the review, not a substitute for technical testing or legal advice. Buyers need evidence that controls work in practice, particularly where the target handles sensitive data or operates critical systems.
Cyber Security Due Diligence M&A: What Documents Should You Request?
The target company’s evidence is central to the assessment. Policies and management statements explain the intended approach, but technical records and independent reports help establish whether security controls are effective.
A buyer should organise the information request through a controlled data room, with access limited to authorised deal advisers and specialists.
| Document or evidence | What it helps establish |
| IT asset inventory and network diagrams | Which systems exist, how they connect, and which assets are critical |
| Information security policies and risk register | How security risks are governed and prioritised |
| Penetration test and vulnerability reports | Known technical weaknesses and outstanding remediation |
| Incident and breach records | Previous security events, business impact, and corrective actions |
| Backup and disaster recovery test results | Whether critical systems and data can be restored |
| Data protection records and privacy documentation | How personal data is collected, used, shared, and protected |
| Supplier contracts and security assessments | Third-party access, responsibilities, and exposure |
| Cyber insurance policy and relevant claims | Coverage terms, exclusions, notification duties, and claim history |
| Security certifications and audit reports | Independent evidence of selected controls and assurance activities |
| Software licences and development records | Intellectual property ownership, licensing restrictions, and software dependencies |
How to Handle Confidential Information During Due Diligence
The due diligence process itself creates a security risk because the buyer and its advisers need access to sensitive information before the deal closes. Customer records, source code, infrastructure details, and incident reports must not be circulated without appropriate safeguards.
Use a restricted virtual data room, strong authentication, access logs, and appropriate confidentiality agreements. Where possible, use anonymised or redacted records to answer questions without exposing unnecessary personal data. Technical testing also needs explicit authorisation, defined boundaries, and safeguards against disrupting the target’s operations.
Cyber Due Diligence Questionnaire: Questions to Ask the Target Company
A cyber due diligence questionnaire turns the review into a consistent set of questions for the target’s leadership, IT team, security specialists, and data protection staff. Answers need supporting evidence and follow-up questions where a response is unclear.
Security Management and Incident History
- Who is accountable for cybersecurity, and how are material risks reported to the board?
- Has the company experienced a significant cyber incident, data breach, or ransomware attack?
- What findings remain open from previous penetration tests, security audits, or risk assessments?
- Does the company have a documented incident response plan, and when was it last tested?
Systems, Access and Vulnerabilities
- Does the company maintain an accurate inventory of hardware, software, cloud services, and business applications?
- Which systems are no longer supported or have critical vulnerabilities?
- Is multi-factor authentication enforced for remote access, administrator accounts, and other high-risk services?
- How does the company patch systems, monitor endpoints, and remove access when employees leave?
Data Protection and Third Parties
- What categories of personal and commercially sensitive data does the company hold?
- Which external providers can access company systems or process customer data?
- Have any personal data breaches occurred, and were the relevant reporting and notification obligations assessed?
- Do customer and supplier contracts impose security, audit, data transfer, or incident notification requirements?
Resilience and Recovery
- Which business services would cause the greatest disruption if unavailable?
- Are backups protected from ransomware and tested through actual restoration exercises?
- What recovery time and recovery point objectives apply to critical systems?
- Does the business have the staff, documentation, and supplier support needed to recover after a major incident?
Technology and Intellectual Property
- Who owns the source code, software, databases, and other technology assets included in the deal?
- Are there unresolved software licence restrictions or open-source compliance issues?
- Have security tests covered the applications and infrastructure that generate the target’s revenue?
- Which systems need remediation or replacement before they can connect safely to the buyer’s environment?
A completed questionnaire helps identify areas requiring deeper investigation. It does not replace independent verification: a target can report that multi-factor authentication is enabled, for example, while privileged accounts or legacy systems remain outside the policy.
UK Legal and Regulatory Issues in Cyber Due Diligence
Cyber due diligence in the UK needs to consider the target’s actual legal obligations, industry, customer base, and data processing activities.
UK GDPR and Data Protection Act 2018
Personal data is a significant part of many acquisitions. Buyers need to establish what personal information the target holds, why it was collected, how it is protected, and whether the proposed transaction changes who controls or processes it.
The Information Commissioner’s Office (ICO) specifically addresses data-sharing due diligence in mergers and acquisitions. Where a transaction involves transferring personal data to a different or additional controller, the parties need to consider the original purposes for collecting the data, the lawful basis for sharing it, transparency obligations, governance, and security.
Sector-Specific Security Obligations
Businesses in financial services, healthcare, telecommunications, and other regulated sectors can face additional security, operational resilience, and reporting obligations. The buyer needs to identify which rules apply to the target and whether the transaction affects existing approvals, contracts, or control requirements.
For example, a regulated business could have security remediation commitments or operational resilience obligations that affect the timing and cost of integration. These issues need input from the appropriate legal, compliance, and technical specialists.
Cyber Insurance and Contractual Commitments
Cyber insurance does not remove the need for a security review. Buyers need to inspect the policy’s limits, exclusions, conditions, claims history, and change-of-control provisions. They should also confirm whether coverage continues after completion or whether the buyer needs a replacement policy.
Customer contracts can create separate exposure. Security warranties, breach notification commitments, audit rights, and service availability obligations can affect the target’s liability if its existing controls fall short.
How to Assess and Prioritise Acquisition Cyber Risk
A list of vulnerabilities does not tell a buyer which findings threaten the transaction. An acquisition cyber risk assessment needs to connect technical weaknesses to financial exposure, business continuity, legal obligations, and integration requirements.
Classify Findings by Business Impact
A useful assessment distinguishes between immediate threats, material control weaknesses, and longer-term improvements.
| Risk level | Example | Recommended deal response |
| Critical | Active compromise, exposed sensitive data, or an exploitable weakness affecting a core revenue system | Investigate immediately; contain active threats and agree a resolution or formal risk decision before completion |
| High | Unsupported systems, weak privileged access controls, or unremediated vulnerabilities affecting critical assets | Define remediation deadlines, owners, costs, and contractual protections |
| Medium | Incomplete monitoring, inconsistent policies, or weaknesses in supplier assurance | Include corrective actions in the integration plan and track progress |
| Low | Documentation gaps or lower-impact improvements with limited immediate exposure | Assign an owner and schedule remediation after completion |
Estimate the Cost of Remediation
The financial impact of cyber risk includes more than purchasing security software. The buyer needs to estimate the staff time, specialist support, infrastructure upgrades, testing, and operational disruption involved in fixing identified issues.
For example, replacing unsupported systems could require application redevelopment, data migration, compatibility testing, and staff training. Remediating a compromised identity environment could involve resetting credentials, rebuilding access policies, investigating historical activity, and increasing monitoring.
These costs belong in the acquisition model. Where the findings are material, they can inform price negotiations, escrow arrangements, indemnities, warranties, or conditions that must be met before completion. Legal advisers should determine which contractual protections are appropriate for the transaction.
When Should Cyber Due Diligence Take Place?
Cyber due diligence needs to begin early enough for the buyer to act on the findings. Leaving the assessment until the final days before completion limits the time available to investigate serious issues or negotiate protections.
- Before signing, identify material risks.
Conduct an initial review of the target’s security posture, major incidents, technology dependencies, and data protection obligations. Investigate issues that could affect valuation, deal structure, or the decision to proceed. - During detailed due diligence, verify the evidence.
Review technical reports, contracts, asset inventories, and security controls. Commission targeted testing or specialist analysis where the evidence reveals material uncertainty. - Before completion: agree on risk ownership.
Confirm which issues must be resolved before closing, which require contractual protection, and which can be addressed after the acquisition. Assign responsibility for each decision. - Immediately after completion: secure the transition.
Review access rights, privileged accounts, remote connections, logging, backups, and third-party permissions. Avoid connecting systems before the integration team has assessed the associated risks. - During integration: track remediation.
Combine security policies and monitoring processes carefully, address priority weaknesses, and measure progress against the agreed remediation plan.
Common Cyber Due Diligence Mistakes to Avoid
Even a detailed review can miss material risks when the deal team treats cybersecurity as a document collection exercise instead of a risk assessment.
- Relying on questionnaires alone: Verify answers against technical evidence, independent reports, and relevant system records.
- Reviewing only the target’s current controls: Examine previous incidents, unresolved findings, and evidence of recurring weaknesses.
- Ignoring suppliers and cloud providers: Third parties can retain access to systems or data and introduce risks that the buyer inherits.
- Treating certification as proof of complete security: A certification applies to a defined scope and does not guarantee that every system is secure.
- Overlooking integration risks: Connecting environments can expose both organisations to weak credentials, incompatible controls, and inherited vulnerabilities.
- Leaving remediation costs out of the deal model: Security upgrades, incident response, and system replacement can materially affect the economics of the acquisition.
- Failing to assign ownership: Findings without named owners, budgets, and deadlines are likely to remain unresolved after completion.
How Cybersecurity Services UK Supports M&A Cyber Due Diligence
Cyber due diligence requires a clear view of the target’s technology, security controls, data exposure, and outstanding risks. Buyers need evidence that supports transaction decisions and a practical plan for addressing issues after completion.
Cybersecurity Services UK helps businesses assess cybersecurity risks, review technical weaknesses, and identify areas that need remediation. For M&A transactions, a structured security review helps deal teams understand which findings need immediate attention, which affect integration planning, and which require further specialist investigation. The scope of support depends on the target’s systems, industry, data sensitivity, and transaction timetable.
FAQs
1. What is cyber due diligence in mergers and acquisitions?
Cyber due diligence is the assessment of a target company’s cybersecurity controls, technology assets, data protection practices, incident history, and security liabilities before an acquisition. It helps buyers understand risks that could affect the deal’s value, legal exposure, operational continuity, and integration costs.
2. What should a cyber due diligence checklist include?
A checklist should cover security governance, previous incidents, IT assets, identity and access management, data protection, application security, third-party providers, backups, compliance obligations, and post-acquisition integration.
3. When should cybersecurity due diligence take place during an acquisition?
The process should begin before signing so material risks can inform the deal decision and negotiations. Detailed technical reviews continue during due diligence, while remediation planning and secure system integration take place before and after completion.
4. How does UK GDPR affect cyber due diligence in M&A?
UK GDPR and the Data Protection Act 2018 are relevant when an acquisition involves personal data. Buyers need to review the target’s security controls, data processing practices, breach history, and the implications of transferring data to a different or additional controller.
5. Who conducts an acquisition cyber risk assessment?
The assessment is typically coordinated by the buyer’s technology and security teams, supported by specialist cybersecurity assessors and, where needed, legal, privacy, and financial advisers.