Cybersecurity due diligence is the pre-close assessment of a target company's security posture, its incident history, and the regulatory exposure a buyer inherits at completion. It answers one uncomfortable question: if this company has already been compromised, does the acquirer now own both the breach and the duty to report it?
Cyber diligence used to be a paragraph inside the IT report. It is now its own workstream on any deal involving personal data, connected products or regulated customers, because the liability it uncovers does not stay with the seller. Breaches follow the legal entity, and so do the notification deadlines and the customer contracts that promised a security posture the target never had.
This guide covers what the reviewer assesses, how to rank the evidence, how to read a penetration test, which obligations transfer, and how findings turn into price and indemnities. It also covers the part most teams get wrong: the diligence documents are themselves dangerous, and a data room for cybersecurity due diligence stops the review from becoming the incident.
Cybersecurity due diligence is a structured assessment of how well a target protects the systems and data it holds, how it behaved when things went wrong, and what duties the acquirer picks up on completion. The buyer commissions it after the letter of intent, and the output ranks findings by severity, prices remediation, and says which items belong in the purchase agreement rather than the integration plan.
It sits next to two workstreams and overlaps both. IT due diligence prices the internal technology estate. Technical due diligence assesses the product the company sells. Cyber diligence cuts across both and asks a narrower question neither answers well: do the controls work, has anyone independent tested them, and has the company already been breached?
The reason it deserves separate treatment is inheritance. A commercial finding is a forecast that turns out optimistic. A cyber finding can be a live intruder. Buying the shares means buying the compromised domain controller, the exfiltrated customer database, and the warranty the target gave a hospital customer two years ago about encryption it never implemented.
Scope follows what the target holds and who it sells to. A logistics business with no personal data needs a light review. A diagnostics company processing patient records for hospitals in six countries needs a deep one, because the buyer acquires special-category data under GDPR and customer security schedules that will be audited.
The nine domains below are what a competent reviewer works through. They are not a compliance checklist. Each is chosen because failure in it maps to a known attack path, and because each produces evidence a buyer can verify.
Identity comes first for a reason. Almost every material intrusion of the last decade started with a credential, so the reviewer wants multi-factor authentication coverage as a percentage of accounts rather than as a policy, with the exception list and the reason each exception exists. Privileged access follows: who holds domain administrator and cloud root, and whether the leaver process actually removed the last five departures.
The middle and later domains are about detection and containment. Endpoint detection matters less as a product name than as a deployment percentage with the gaps named, patch management is judged on mean time to remediate by severity from a real ticketing system, segmentation on whether a compromised laptop can reach the database tier, and backup on when a full restore was last tested rather than on whether backups run.
| # | Control domain | Evidence requested | Red flag |
|---|---|---|---|
| 1 | Identity and access | MFA coverage report, exception list, leaver records | MFA below 90 percent, or none on remote access |
| 2 | Privileged access | Admin account inventory, elevation logs, break-glass procedure | Shared admin accounts with static passwords |
| 3 | Endpoint detection | EDR deployment percentage by asset class, alert triage samples | Servers excluded from the agent rollout |
| 4 | Patch and vulnerability | Mean time to remediate by severity, scan output, exceptions | Critical vulnerabilities open beyond 90 days |
| 5 | Network segmentation | Segmentation diagram, firewall rule review, last internal test | Flat network reaching the database tier |
| 6 | Logging and detection | Log source inventory, retention period, alert-to-response samples | Retention under 30 days, or no central collection |
| 7 | Backup and restore | Restore test report with date, duration and result | No full restore tested in the past 12 months |
| 8 | Secure development | Code review policy, dependency scan output, secrets handling | Credentials committed to repository history |
| 9 | Third-party risk | Vendor register, sub-processor list, vendors with production access | No inventory of who can reach production |
The useful distinction across all nine is between an assertion and an artefact. An assertion is the security questionnaire the seller fills in, helpful as an index and worthless as proof. An artefact is a system-generated output with a date on it: the identity provider's MFA export, the scanner's remediation report, the backup platform's restore log, the ticket showing when a critical finding closed.
A good request list therefore names the system each artefact should come from, and the speed of the reply is itself a finding.
Not all security evidence carries the same weight, and the fastest way to improve a review is to rank the material before reading it. A policy proves somebody wrote a policy. A certificate proves an external party checked something once, against a scope somebody chose. A tested report proves an auditor sampled controls over a period and wrote down where they failed. Only the last tells a buyer how the company behaves on an ordinary Tuesday.
That is why a SOC 2 Type II report outranks nearly everything else in the folder. A Type I describes controls at a point in time. A Type II tests them across a period, typically 3 to 12 months, and includes the auditor's exceptions, which are the interesting part. Buyers who read only the opinion letter miss the section noting that access reviews were skipped in two of the four quarters sampled.
The trap sits in the scope statement, and it is the most common way a buyer talks themselves into comfort they have not earned. A SOC 2 describes a system, and the company chooses which system. A report scoped to the production platform says nothing about whether the finance team has multi-factor authentication, whether corporate laptops run endpoint detection, or whether the internal network is segmented. That is exactly where ransomware lands.
ISO 27001 has the same problem in a different place. The certificate is a single page; the document that matters is the Statement of Applicability, listing the Annex A controls applied and those excluded with justification. A long exclusion list plus a scope covering one legal entity out of five is a weaker artefact than the certificate implies.
| Evidence | What it proves | What it does not prove |
|---|---|---|
| SOC 2 Type II report | Controls tested by an auditor over 3 to 12 months | Anything outside the system named in the scope statement |
| SOC 2 Type I report | Controls were designed and present on one date | That they operated for a single day afterwards |
| ISO 27001 certificate | A management system was certified for named entities | Which controls were excluded, without the Statement of Applicability |
| Penetration test report | A tester found issues on a defined scope and date | That anything was fixed, without a retest letter |
| Vulnerability scan export | Mean time to remediate by severity, from real tickets | Coverage of assets the scanner never saw |
| Security policy PDF | Somebody wrote and approved a document | That the described control operates anywhere |
| Security questionnaire | What the seller believes to be true | Anything at all, until an artefact backs each answer |
Trust dated system-generated artefacts first, tested reports second, certificates third, self-assessment last.
Penetration test reports are the most quoted and least carefully read documents in cyber diligence. A buyer who accepts three reports as proof of a mature programme has usually not checked the three things that decide whether they mean anything: what was in scope, how old each finding is, and whether a retest confirmed the fix.
Scope first. A test against one public web application is a different artefact from an internal network test, and the methodology section will say which it was. Many targets present an annual external application test as evidence of a tested environment while nobody has ever tested the corporate network, which is where an intruder will actually be.
Then severity and age together. Findings are usually scored with CVSS, where 9.0 to 10.0 is critical, 7.0 to 8.9 high, and 4.0 to 6.9 medium. A critical finding raised last month is a technical issue. The same finding still open 14 months later across two test cycles is a governance issue: the target has a security function that finds problems and an engineering function that does not fix them. Retest evidence is the third axis and the one most often missing, since a finding is closed when the tester reissues a letter confirming it, not when the seller says so.
Penetration test findings are a list of unfixed ways into the company, which is why they belong behind view-only access and watermarking.
There is also work the buyer can do before the data room opens, and it is unusually cheap. External attack-surface discovery enumerates internet-facing hosts, expired certificates, exposed administrative interfaces and open cloud storage, all from public sources. Credential-exposure checks against breach and dark-web corpora show whether employee credentials from unrelated incidents are circulating, and whether any still work.
Both matter because they are unmediated: they show what an attacker sees rather than what the seller chose to disclose, and a wide gap between the two is itself the finding. A target presenting a clean questionnaire while running an exposed remote-access portal on an unpatched appliance has answered the most important question in the review without meaning to.
Incident history is where cyber diligence stops assessing controls and starts assessing honesty. The reviewer asks for the incident register, post-incident reviews, supervisory authority correspondence, customer breach notifications, and the cyber insurance claims history. Claims history is especially useful because it is externally verified: a company can forget an incident when filling in a questionnaire, but rarely one it claimed against.
The structural point is uncomfortable. The absence of a disclosed breach is not evidence of the absence of a breach. Intrusions are frequently discovered long after they begin, and often by a third party rather than the victim. A target can sign a share purchase agreement with an attacker already inside, and the buyer owns the discovery, the investigation and the customer fallout. That is why mature buyers run a compromise assessment where access permits.
That is what makes the disclosure schedule matter. A breach the seller disclosed is a negotiation. A breach the seller knew about and did not disclose is a warranty claim and possibly a fraud claim. A breach nobody knew about is an uninsured cost landing in the first quarter after completion.
Notification duties attach to the entity, not the shareholder, so a share purchase carries them straight across. Under GDPR Article 33 a personal data breach must be notified to the supervisory authority within 72 hours of awareness where feasible, and under Article 34 the affected individuals must be told without undue delay where the risk to them is high. Maximum administrative fines reach €20 million or 4 percent of global annual turnover, whichever is higher.
Sector regimes layer on top. The EU NIS2 directive covers essential and important entities in sectors including energy, transport, health and digital infrastructure, requiring an early warning within 24 hours, a fuller notification within 72 hours, and a final report within one month. DORA has applied to EU financial entities since 17 January 2025, adding an ICT risk framework, incident reporting and a register of third-party providers. HIPAA requires individual notification no later than 60 days where protected health information is involved. All 50 US states maintain breach notification statutes, several with 30-day deadlines, and a listed US acquirer faces the SEC requirement to disclose a material incident on Form 8-K within four business days.
Incident history and regulator correspondence warrant their own link, with email verification and an expiry date rather than open circulation.
Findings only matter if they land in the documents, and cyber diligence output converts into five instruments. Choosing the wrong one is how buyers end up with a warranty claim they cannot value.
Cyber representations and warranties are the baseline. A modern set covers compliance with data protection law, the absence of known breaches in a stated look-back period, the adequacy of the disclosed controls, and compliance with security commitments in customer contracts. Warranties are capped and only pay where the buyer proves loss, which is hard when the loss is reputational.
Specific indemnities are the right instrument for a known but unquantified exposure: a disclosed incident, an open supervisory authority file, a critical finding that will not close before completion. An indemnity shifts a named risk pound for pound instead of subjecting it to the general cap. Costed remediation belongs in the price or the day-one budget, while exposure with a long tail belongs in escrow.
| Finding | How it surfaces | Deal remedy |
|---|---|---|
| Undisclosed historical breach | Insurance claims history or dark-web credential exposure | Specific indemnity plus extended escrow period |
| Open supervisory authority file | Correspondence in the compliance folder | Specific indemnity, separately capped |
| Critical findings open past two test cycles | Penetration test reports with no retest letter | Price adjustment sized to the remediation quote |
| MFA coverage below full deployment | Identity provider export against the headcount list | Day-one condition, often required by the insurer |
| Backups never restore-tested | Absence of a dated restore test report | First-year budget line and integration milestone |
| Customer security terms not met | Security schedules compared against actual controls | Warranty plus remediation before customer audit |
| Sub-processor never disclosed | Vendor register against the published sub-processor list | Pre-closing covenant to notify and update |
Warranty and indemnity insurance is where thin diligence becomes visibly expensive. Insurers underwrite off the diligence file, and the underwriting call is largely a conversation about what the buyer actually looked at. Where the review was substantive, insurers will often cover the cyber warranties, sometimes with a dedicated sublimit. Where it was shallow, cyber is commonly excluded or narrowed sharply, and two things are excluded almost universally: anything the buyer already knew, and anything the buyer chose not to investigate.
The last instrument is not legal at all. Day-one controls are what the buyer imposes at completion regardless of the agreement: multi-factor authentication everywhere, rotated privileged credentials, the target's network isolated until the compromise assessment is clean, and an incident response retainer in place. Our guide to document security software covers the sharing side.
A mid-market fund agrees terms to acquire Lindmark Diagnostics, a €38M revenue clinical diagnostics software company in Malmö with 240 employees and hospital customers in six countries. It processes patient records, so the deal brings special-category data under GDPR, and its hospital customers are NIS2 essential entities, pushing security obligations down onto Lindmark as a supplier.
Before the data room opens, the reviewer runs external checks. Attack-surface discovery finds a forgotten staging subdomain exposing a remote-access appliance two versions behind. Credential-exposure checks return 1,900 Lindmark addresses in breach corpora, and testing confirms 12 still authenticate.
The room then produces two penetration test reports, 14 months and 4 months old, carrying 47 open findings between them: 22 low severity, 19 medium, and 6 high or critical with CVSS scores above 7.0. All 6 appear in both reports, and no retest letter exists for any of them.
Worked scenario. The 6 high and critical findings appear in both test cycles with no retest letter, which makes them a governance finding rather than a technical one.
Control evidence fills in the rest. Multi-factor authentication covers 71 percent of staff accounts and is absent on the VPN used by the support team, which also holds production database access. Log retention is 14 days, and no full restore has been tested in 19 months. The SOC 2 Type II report is genuine, but its scope covers only the hosted diagnostics platform and excludes corporate IT.
The deal reflects all of it. The fund budgets €1.15M of remediation over 12 months, negotiates a €2.4M cyber indemnity held in escrow for 24 months, and accepts a policy that sublimits cyber cover at €5M conditional on full multi-factor authentication within 90 days. Diligence runs through a data room holding 180 documents across nine control folders, with four reviewer links and the penetration test folder view-only.
A focused review runs 2 to 6 weeks on a mid-market target once the room is populated, and 4 to 8 weeks where technical testing or a compromise assessment is included. Rapid external-posture reviews turn around in 5 to 7 days and are worth commissioning early, because they cost little and occasionally reprice the deal before anyone has spent real money.
Cost tracks scope rather than deal size. An external attack-surface and credential-exposure review starts at around $5,000. A full control review on a mid-market target lands in the tens of thousands. A large regulated target with penetration testing can reach $150,000 or more. Our breakdown of due diligence cost puts these numbers beside the other workstreams.
The mistakes repeat across deals. The first is accepting certifications without reading their scope, which is the trap this article is named for and the one that survives into integration, because nobody re-reads the SOC 2 after closing. The second is treating security as a compliance exercise: a target can hold ISO 27001 and a clean questionnaire while running a flat network with 14 days of logs. The third is starting late, since a €1.15M remediation plan found in the final week of exclusivity is hard to reflect in a price already agreed.
The fourth deserves stating plainly because it is the most self-inflicted. The cyber diligence file is the most attacker-useful material in the transaction: unfixed vulnerabilities, an identity architecture diagram, a network map, and a list of vendors that can reach production. Circulating that by email to a lender, a consultancy, an insurer and two integration leads creates genuine exposure, and the seller carries it even if the deal dies. The same discipline applies on the sell-side of a vendor due diligence checklist.
A data room for cybersecurity due diligence is not the same artefact as the one finance uses. The financial folder holds numbers that are commercially sensitive and, if leaked, embarrassing. The security folder holds a working guide to compromising the company, and a leak there means an intrusion rather than an awkward conversation.
It also breaks the assumption that everyone in the deal sees the same documents. Cyber diligence is unusually asymmetric: the CISO needs everything, the external specialist needs the technical findings, the lender needs the risk summary, the W&I insurer needs incident history, and the integration lead needs the remediation plan.
Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).
A cybersecurity due diligence data room with one folder per control domain, so permissions differ by folder.
Most cyber diligence still runs over email attachments and a shared drive link, and this is the workstream where that habit can produce the outcome the review exists to prevent. There are four reasons a dedicated data room for cybersecurity due diligence earns its place. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing and compliance.
The documents are an attack plan. A penetration test report is a list of unfixed ways into the company, with severity ratings telling an attacker which to try first. A segmentation diagram shows where to aim, and a vendor register names the softer targets. The seller carries that exposure whether or not the deal completes.
Five reviewers need five different scopes. The CISO reads everything. The external specialist reads the technical findings but has no business seeing the commercial risk memo. The lender needs the summary and the remediation cost, not the vulnerability list. A shared drive gives you one permission set; a data room for cybersecurity due diligence gives you one per link over the same documents.
Evidence arrives in waves, and the waves are the review. The reviewer reads the SOC 2 scope statement, then asks for the corporate IT controls it excludes. Reads the penetration test, then asks for retest letters that may not exist. Across 180 documents an email thread loses that sequence.
The disclosure record decides the warranty claim. If a breach surfaces eighteen months after completion, the question is what the seller disclosed, to whom, and on what date. That is the difference between a warranty claim and an allegation of misrepresentation. A per-visitor audit log answers it. An inbox does not.
The rest of this section is the practical setup: five steps to build a data room for cybersecurity due diligence that handles all four.
Create one folder per domain from the matrix in section 2, plus one for certifications and scope statements, one for incident history and regulator correspondence, and one for customer security schedules. That structure doubles as the request list, because a reviewer sees immediately which folder is thin. Automatic file indexing on the Data Rooms Plus plan maintains the index as documents land.
This is where a cyber room differs most from a financial one. Five parties need five different views of the same document set, and the differences are not cosmetic.
| Reviewer | Folders granted | Download | Watermark |
|---|---|---|---|
| Buyer CISO | All nine control domains plus incident history | ||
| External cyber specialist | Test reports, vulnerability data, architecture | ||
| Lender | Executive summary and remediation cost only | ||
| W&I insurer | Incident history, certifications, final report | ||
| Integration lead | Remediation plan and day-one controls |
Granular file-level permissions are set per link rather than per user account, so each party gets its own link carrying its own folder scope, email allowlist or domain restriction, and download rule. No reviewer creates an account, which removes the friction that makes busy specialists ask for the files by email instead.
Permissions are set per link, so the lender and the external cyber specialist open the same room and see different folders.
Set the penetration test, architecture and vulnerability folders to view-only, then turn on dynamic watermarking, which renders the viewer's email, IP address and a timestamp onto every page. Screenshot protection adds a further deterrent on the test findings, and email verification with a one-time passcode confirms the person opening the link controls the address it went to.
The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged here, and why watermarking exists. It makes a leak attributable to a named viewer rather than merely regrettable.
Dynamic watermarking renders viewer identity onto every page, which makes a leaked penetration test traceable.
Cyber diligence is a sequence of follow-ups, and the sequence is the substance of the review. The Q&A module attaches each question to the document that prompted it, so the request for retest letters sits against the penetration test report rather than in a thread three people were not copied on. Permissions control who sees which threads, and the log exports for the closing file.
Page-level analytics show which reviewer opened which document, when, and for how long. In cyber diligence that is an early warning system: a specialist who spends forty minutes on the vulnerability export and then asks for the exception register has found something, and you will hear about it a week before the report lands.
Per-visitor analytics show which security documents each reviewer opened and for how long.
After completion, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate, which is the record when the argument eighteen months later becomes what was disclosed and when. Link expiration and the audit log close out reviewer links so the attack plan is not sitting in five inboxes.
Papermark is our #1 VDR provider for M&A transactions right now. In two deals we used custom branding, dynamic watermarking, and granular permissions.
Tyler
The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. Premium at €549/month adds 10 team members, the public API, SSO and white-labelling. For buy-side teams running several targets at once, unlimited data rooms means one room per target with no per-project fee.
No credit card required.
Technical due diligence in 2026: a 9-area checklist, the 4-week process, real costs, the copyleft trap, and the data room for technical due diligence.
IT due diligence in 2026: the 8-domain checklist, the licence trap that costs buyers most, TSA timelines, and how to run it in a data room for IT due diligence.
Financial due diligence in 2026: 3 pillars, a 6-week timeline, the working capital peg that costs more than EBITDA, and the data room for financial due diligence.
