---
title: "Cybersecurity due diligence in 2026: the SOC 2 report doesn't cover what you think"
lang: en
canonical_url: https://www.papermark.com/blog/cybersecurity-due-diligence
last_updated: 2026-08-15
published: 2026-07-30
category: [mergers-and-acquisitions]
author: "Marc Seitz"
summary: "Cybersecurity due diligence in 2026: the 9 control domains, the SOC 2 scope trap, inherited breach duties, and the data room for cybersecurity due diligence."
---

# Cybersecurity due diligence in 2026: the SOC 2 report doesn't cover what you think

Cybersecurity due diligence is the pre-close assessment of a target company's security posture, its incident history, and the regulatory exposure a buyer inherits at completion. It answers one uncomfortable question: if this company has already been compromised, does the acquirer now own both the breach and the duty to report it?

## Quick recap

- Cybersecurity due diligence assesses controls, incident history and inherited regulatory exposure, unlike IT due diligence, which prices the technology estate.
- A standard review covers 9 control domains, from identity and access through patching, segmentation, logging and backup to third-party risk.
- A SOC 2 Type II report outranks any policy PDF because an auditor tested controls over 3 to 12 months, but the scope statement decides what it is worth.
- Under GDPR Article 33 a personal data breach must be reported to the supervisory authority within 72 hours of awareness, and after closing that clock is the buyer's.
- NIS2 requires in-scope entities to file an early warning within 24 hours and a fuller notification within 72 hours; DORA has applied to EU financial entities since 17 January 2025.
- Penetration test findings are read on three axes: severity, age and retest evidence. A critical CVSS finding above 9.0 left open for 14 months is a governance failure.
- Cyber diligence takes 2 to 6 weeks and costs from roughly $5,000 for an external posture review to $150,000 or more for a large regulated target.
- A data room for cybersecurity due diligence needs different permissions from a financial one, because penetration test reports are the most attacker-useful documents in the deal.
- Papermark hosts a data room for cybersecurity due diligence with granular permissions, dynamic watermarking and per-visitor analytics from €99/month.

Cyber diligence used to be a paragraph inside the IT report. It is now its own workstream on any deal involving personal data, connected products or regulated customers, because the liability it uncovers does not stay with the seller. Breaches follow the legal entity, and so do the notification deadlines and the customer contracts that promised a security posture the target never had.

This guide covers what the reviewer assesses, how to rank the evidence, how to read a penetration test, which obligations transfer, and how findings turn into price and indemnities. It also covers the part most teams get wrong: the diligence documents are themselves dangerous, and a **data room for cybersecurity due diligence** stops the review from becoming the incident.

## 1. What is cybersecurity due diligence?

Cybersecurity due diligence is a structured assessment of how well a target protects the systems and data it holds, how it behaved when things went wrong, and what duties the acquirer picks up on completion. The buyer commissions it after the letter of intent, and the output ranks findings by severity, prices remediation, and says which items belong in the purchase agreement rather than the integration plan.

It sits next to two workstreams and overlaps both. [IT due diligence](/blog/it-due-diligence.md) prices the internal technology estate. [Technical due diligence](/blog/technical-due-diligence.md) assesses the product the company sells. Cyber diligence cuts across both and asks a narrower question neither answers well: do the controls work, has anyone independent tested them, and has the company already been breached?

The reason it deserves separate treatment is inheritance. A commercial finding is a forecast that turns out optimistic. A cyber finding can be a live intruder. Buying the shares means buying the compromised domain controller, the exfiltrated customer database, and the warranty the target gave a hospital customer two years ago about encryption it never implemented.

Scope follows what the target holds and who it sells to. A logistics business with no personal data needs a light review. A diagnostics company processing patient records for hospitals in six countries needs a deep one, because the buyer acquires special-category data under GDPR and customer security schedules that will be audited.

## 2. The 9 control domains a reviewer assesses

The nine domains below are what a competent reviewer works through. They are not a compliance checklist. Each is chosen because failure in it maps to a known attack path, and because each produces evidence a buyer can verify.

Identity comes first for a reason. Almost every material intrusion of the last decade started with a credential, so the reviewer wants multi-factor authentication coverage as a percentage of accounts rather than as a policy, with the exception list and the reason each exception exists. Privileged access follows: who holds domain administrator and cloud root, and whether the leaver process actually removed the last five departures.

The middle and later domains are about detection and containment. Endpoint detection matters less as a product name than as a deployment percentage with the gaps named, patch management is judged on mean time to remediate by severity from a real ticketing system, segmentation on whether a compromised laptop can reach the database tier, and backup on when a full restore was last tested rather than on whether backups run.

| # | Control domain | Evidence requested | Red flag |
| --- | --- | --- | --- |
| 1 | Identity and access | MFA coverage report, exception list, leaver records | MFA below 90 percent, or none on remote access |
| 2 | Privileged access | Admin account inventory, elevation logs, break-glass procedure | Shared admin accounts with static passwords |
| 3 | Endpoint detection | EDR deployment percentage by asset class, alert triage samples | Servers excluded from the agent rollout |
| 4 | Patch and vulnerability | Mean time to remediate by severity, scan output, exceptions | Critical vulnerabilities open beyond 90 days |
| 5 | Network segmentation | Segmentation diagram, firewall rule review, last internal test | Flat network reaching the database tier |
| 6 | Logging and detection | Log source inventory, retention period, alert-to-response samples | Retention under 30 days, or no central collection |
| 7 | Backup and restore | Restore test report with date, duration and result | No full restore tested in the past 12 months |
| 8 | Secure development | Code review policy, dependency scan output, secrets handling | Credentials committed to repository history |
| 9 | Third-party risk | Vendor register, sub-processor list, vendors with production access | No inventory of who can reach production |

### What each domain asks the seller to produce

The useful distinction across all nine is between an assertion and an artefact. An assertion is the security questionnaire the seller fills in, helpful as an index and worthless as proof. An artefact is a system-generated output with a date on it: the identity provider's MFA export, the scanner's remediation report, the backup platform's restore log, the ticket showing when a critical finding closed.

A good request list therefore names the system each artefact should come from, and the speed of the reply is itself a finding.

## 3. The evidence hierarchy and the SOC 2 scope trap

Not all security evidence carries the same weight, and the fastest way to improve a review is to rank the material before reading it. A policy proves somebody wrote a policy. A certificate proves an external party checked something once, against a scope somebody chose. A tested report proves an auditor sampled controls over a period and wrote down where they failed. Only the last tells a buyer how the company behaves on an ordinary Tuesday.

That is why a SOC 2 Type II report outranks nearly everything else in the folder. A Type I describes controls at a point in time. A Type II tests them across a period, typically 3 to 12 months, and includes the auditor's exceptions, which are the interesting part. Buyers who read only the opinion letter miss the section noting that access reviews were skipped in two of the four quarters sampled.

The trap sits in the scope statement, and it is the most common way a buyer talks themselves into comfort they have not earned. A SOC 2 describes a system, and the company chooses which system. A report scoped to the production platform says nothing about whether the finance team has multi-factor authentication, whether corporate laptops run endpoint detection, or whether the internal network is segmented. That is exactly where ransomware lands.

ISO 27001 has the same problem in a different place. The certificate is a single page; the document that matters is the Statement of Applicability, listing the Annex A controls applied and those excluded with justification. A long exclusion list plus a scope covering one legal entity out of five is a weaker artefact than the certificate implies.

| Evidence | What it proves | What it does not prove |
| --- | --- | --- |
| SOC 2 Type II report | Controls tested by an auditor over 3 to 12 months | Anything outside the system named in the scope statement |
| SOC 2 Type I report | Controls were designed and present on one date | That they operated for a single day afterwards |
| ISO 27001 certificate | A management system was certified for named entities | Which controls were excluded, without the Statement of Applicability |
| Penetration test report | A tester found issues on a defined scope and date | That anything was fixed, without a retest letter |
| Vulnerability scan export | Mean time to remediate by severity, from real tickets | Coverage of assets the scanner never saw |
| Security policy PDF | Somebody wrote and approved a document | That the described control operates anywhere |
| Security questionnaire | What the seller believes to be true | Anything at all, until an artefact backs each answer |

Trust dated system-generated artefacts first, tested reports second, certificates third, self-assessment last.

## 4. Reading penetration test findings and the external attack surface

Penetration test reports are the most quoted and least carefully read documents in cyber diligence. A buyer who accepts three reports as proof of a mature programme has usually not checked the three things that decide whether they mean anything: what was in scope, how old each finding is, and whether a retest confirmed the fix.

Scope first. A test against one public web application is a different artefact from an internal network test, and the methodology section will say which it was. Many targets present an annual external application test as evidence of a tested environment while nobody has ever tested the corporate network, which is where an intruder will actually be.

Then severity and age together. Findings are usually scored with CVSS, where 9.0 to 10.0 is critical, 7.0 to 8.9 high, and 4.0 to 6.9 medium. A critical finding raised last month is a technical issue. The same finding still open 14 months later across two test cycles is a governance issue: the target has a security function that finds problems and an engineering function that does not fix them. Retest evidence is the third axis and the one most often missing, since a finding is closed when the tester reissues a letter confirming it, not when the seller says so.

![Screenshot protection applied to penetration test findings in a data room for cybersecurity due diligence](https://assets.papermark.io/upload/file_Jd6mEvqdytkqTP7BJhRyn7-screenshot-protection-cover-papermark-.png)

_Penetration test findings are a list of unfixed ways into the company, which is why they belong behind view-only access and watermarking._

There is also work the buyer can do before the data room opens, and it is unusually cheap. External attack-surface discovery enumerates internet-facing hosts, expired certificates, exposed administrative interfaces and open cloud storage, all from public sources. Credential-exposure checks against breach and dark-web corpora show whether employee credentials from unrelated incidents are circulating, and whether any still work.

Both matter because they are unmediated: they show what an attacker sees rather than what the seller chose to disclose, and a wide gap between the two is itself the finding. A target presenting a clean questionnaire while running an exposed remote-access portal on an unpatched appliance has answered the most important question in the review without meaning to.

## 5. Incident history and the obligations you inherit

Incident history is where cyber diligence stops assessing controls and starts assessing honesty. The reviewer asks for the incident register, post-incident reviews, supervisory authority correspondence, customer breach notifications, and the cyber insurance claims history. Claims history is especially useful because it is externally verified: a company can forget an incident when filling in a questionnaire, but rarely one it claimed against.

The structural point is uncomfortable. The absence of a disclosed breach is not evidence of the absence of a breach. Intrusions are frequently discovered long after they begin, and often by a third party rather than the victim. A target can sign a share purchase agreement with an attacker already inside, and the buyer owns the discovery, the investigation and the customer fallout. That is why mature buyers run a compromise assessment where access permits.

That is what makes the disclosure schedule matter. A breach the seller disclosed is a negotiation. A breach the seller knew about and did not disclose is a warranty claim and possibly a fraud claim. A breach nobody knew about is an uninsured cost landing in the first quarter after completion.

### What transfers to the buyer

Notification duties attach to the entity, not the shareholder, so a share purchase carries them straight across. Under GDPR Article 33 a personal data breach must be notified to the supervisory authority within 72 hours of awareness where feasible, and under Article 34 the affected individuals must be told without undue delay where the risk to them is high. Maximum administrative fines reach €20 million or 4 percent of global annual turnover, whichever is higher.

Sector regimes layer on top. The EU NIS2 directive covers essential and important entities in sectors including energy, transport, health and digital infrastructure, requiring an early warning within 24 hours, a fuller notification within 72 hours, and a final report within one month. DORA has applied to EU financial entities since 17 January 2025, adding an ICT risk framework, incident reporting and a register of third-party providers. HIPAA requires individual notification no later than 60 days where protected health information is involved. All 50 US states maintain breach notification statutes, several with 30-day deadlines, and a listed US acquirer faces the SEC requirement to disclose a material incident on Form 8-K within four business days.

![Link settings restricting the incident history folder in a cybersecurity due diligence data room](https://assets.papermark.io/upload/file_SX7LYvmpHoD3BZUW9fgAbY-password-protection-link-settings.png)

_Incident history and regulator correspondence warrant their own link, with email verification and an expiry date rather than open circulation._

## 6. Deal mechanics: reps, indemnities, escrow and W&I insurance

Findings only matter if they land in the documents, and cyber diligence output converts into five instruments. Choosing the wrong one is how buyers end up with a warranty claim they cannot value.

Cyber representations and warranties are the baseline. A modern set covers compliance with data protection law, the absence of known breaches in a stated look-back period, the adequacy of the disclosed controls, and compliance with security commitments in customer contracts. Warranties are capped and only pay where the buyer proves loss, which is hard when the loss is reputational.

Specific indemnities are the right instrument for a known but unquantified exposure: a disclosed incident, an open supervisory authority file, a critical finding that will not close before completion. An indemnity shifts a named risk pound for pound instead of subjecting it to the general cap. Costed remediation belongs in the price or the day-one budget, while exposure with a long tail belongs in escrow.

| Finding | How it surfaces | Deal remedy |
| --- | --- | --- |
| Undisclosed historical breach | Insurance claims history or dark-web credential exposure | Specific indemnity plus extended escrow period |
| Open supervisory authority file | Correspondence in the compliance folder | Specific indemnity, separately capped |
| Critical findings open past two test cycles | Penetration test reports with no retest letter | Price adjustment sized to the remediation quote |
| MFA coverage below full deployment | Identity provider export against the headcount list | Day-one condition, often required by the insurer |
| Backups never restore-tested | Absence of a dated restore test report | First-year budget line and integration milestone |
| Customer security terms not met | Security schedules compared against actual controls | Warranty plus remediation before customer audit |
| Sub-processor never disclosed | Vendor register against the published sub-processor list | Pre-closing covenant to notify and update |

Warranty and indemnity insurance is where thin diligence becomes visibly expensive. Insurers underwrite off the diligence file, and the underwriting call is largely a conversation about what the buyer actually looked at. Where the review was substantive, insurers will often cover the cyber warranties, sometimes with a dedicated sublimit. Where it was shallow, cyber is commonly excluded or narrowed sharply, and two things are excluded almost universally: anything the buyer already knew, and anything the buyer chose not to investigate.

The last instrument is not legal at all. Day-one controls are what the buyer imposes at completion regardless of the agreement: multi-factor authentication everywhere, rotated privileged credentials, the target's network isolated until the compromise assessment is clean, and an incident response retainer in place. Our guide to [document security software](/blog/document-security-software.md) covers the sharing side.

## 7. Worked scenario: cyber diligence on Lindmark Diagnostics

A mid-market fund agrees terms to acquire Lindmark Diagnostics, a €38M revenue clinical diagnostics software company in Malmö with 240 employees and hospital customers in six countries. It processes patient records, so the deal brings special-category data under GDPR, and its hospital customers are NIS2 essential entities, pushing security obligations down onto Lindmark as a supplier.

Before the data room opens, the reviewer runs external checks. Attack-surface discovery finds a forgotten staging subdomain exposing a remote-access appliance two versions behind. Credential-exposure checks return 1,900 Lindmark addresses in breach corpora, and testing confirms 12 still authenticate.

The room then produces two penetration test reports, 14 months and 4 months old, carrying 47 open findings between them: 22 low severity, 19 medium, and 6 high or critical with CVSS scores above 7.0. All 6 appear in both reports, and no retest letter exists for any of them.

Control evidence fills in the rest. Multi-factor authentication covers 71 percent of staff accounts and is absent on the VPN used by the support team, which also holds production database access. Log retention is 14 days, and no full restore has been tested in 19 months. The SOC 2 Type II report is genuine, but its scope covers only the hosted diagnostics platform and excludes corporate IT.

The deal reflects all of it. The fund budgets €1.15M of remediation over 12 months, negotiates a €2.4M cyber indemnity held in escrow for 24 months, and accepts a policy that sublimits cyber cover at €5M conditional on full multi-factor authentication within 90 days. Diligence runs through a data room holding 180 documents across nine control folders, with four reviewer links and the penetration test folder view-only.

## 8. Timeline, cost and the mistakes that recur

A focused review runs 2 to 6 weeks on a mid-market target once the room is populated, and 4 to 8 weeks where technical testing or a compromise assessment is included. Rapid external-posture reviews turn around in 5 to 7 days and are worth commissioning early, because they cost little and occasionally reprice the deal before anyone has spent real money.

Cost tracks scope rather than deal size. An external attack-surface and credential-exposure review starts at around $5,000. A full control review on a mid-market target lands in the tens of thousands. A large regulated target with penetration testing can reach $150,000 or more. Our breakdown of [due diligence cost](/blog/due-diligence-cost.md) puts these numbers beside the other workstreams.

The mistakes repeat across deals. The first is accepting certifications without reading their scope, which is the trap this article is named for and the one that survives into integration, because nobody re-reads the SOC 2 after closing. The second is treating security as a compliance exercise: a target can hold ISO 27001 and a clean questionnaire while running a flat network with 14 days of logs. The third is starting late, since a €1.15M remediation plan found in the final week of exclusivity is hard to reflect in a price already agreed.

The fourth deserves stating plainly because it is the most self-inflicted. The cyber diligence file is the most attacker-useful material in the transaction: unfixed vulnerabilities, an identity architecture diagram, a network map, and a list of vendors that can reach production. Circulating that by email to a lender, a consultancy, an insurer and two integration leads creates genuine exposure, and the seller carries it even if the deal dies. The same discipline applies on the sell-side of a [vendor due diligence checklist](/blog/vendor-due-diligence-checklist.md).

## 9. Data room for your cybersecurity due diligence

A **data room for cybersecurity due diligence** is not the same artefact as the one finance uses. The financial folder holds numbers that are commercially sensitive and, if leaked, embarrassing. The security folder holds a working guide to compromising the company, and a leak there means an intrusion rather than an awkward conversation.

It also breaks the assumption that everyone in the deal sees the same documents. Cyber diligence is unusually asymmetric: the CISO needs everything, the external specialist needs the technical findings, the lender needs the risk summary, the W&I insurer needs incident history, and the integration lead needs the remediation plan.

[Papermark](/data-room.md) is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

![Papermark data room for cybersecurity due diligence organised by control domain](https://img.papermarkassets.com/upload/file_35DtVER7SdS1G6unRE8unv-papermark-data-room.png)

_A cybersecurity due diligence data room with one folder per control domain, so permissions differ by folder._

### Why you need a data room for cybersecurity due diligence

Most cyber diligence still runs over email attachments and a shared drive link, and this is the workstream where that habit can produce the outcome the review exists to prevent. There are four reasons a dedicated data room for cybersecurity due diligence earns its place. If you are still choosing a platform, our comparison of the [best virtual data rooms](/blog/best-virtual-data-rooms.md) covers pricing and compliance.

**The documents are an attack plan.** A penetration test report is a list of unfixed ways into the company, with severity ratings telling an attacker which to try first. A segmentation diagram shows where to aim, and a vendor register names the softer targets. The seller carries that exposure whether or not the deal completes.

**Five reviewers need five different scopes.** The CISO reads everything. The external specialist reads the technical findings but has no business seeing the commercial risk memo. The lender needs the summary and the remediation cost, not the vulnerability list. A shared drive gives you one permission set; a data room for cybersecurity due diligence gives you one per link over the same documents.

**Evidence arrives in waves, and the waves are the review.** The reviewer reads the SOC 2 scope statement, then asks for the corporate IT controls it excludes. Reads the penetration test, then asks for retest letters that may not exist. Across 180 documents an email thread loses that sequence.

**The disclosure record decides the warranty claim.** If a breach surfaces eighteen months after completion, the question is what the seller disclosed, to whom, and on what date. That is the difference between a warranty claim and an allegation of misrepresentation. A per-visitor audit log answers it. An inbox does not.

The rest of this section is the practical setup: five steps to build a data room for cybersecurity due diligence that handles all four.

### Step 1: build the room by control domain

Create one folder per domain from the matrix in section 2, plus one for certifications and scope statements, one for incident history and regulator correspondence, and one for customer security schedules. That structure doubles as the request list, because a reviewer sees immediately which folder is thin. **Automatic file indexing** on the Data Rooms Plus plan maintains the index as documents land.

### Step 2: set permissions per reviewer, not per document

This is where a cyber room differs most from a financial one. Five parties need five different views of the same document set, and the differences are not cosmetic.

| Reviewer | Folders granted | Download | Watermark |
| --- | --- | --- | --- |
| Buyer CISO | All nine control domains plus incident history | - | ✔️ |
| External cyber specialist | Test reports, vulnerability data, architecture | - | ✔️ |
| Lender | Executive summary and remediation cost only | ✔️ | ✔️ |
| W&I insurer | Incident history, certifications, final report | ✔️ | ✔️ |
| Integration lead | Remediation plan and day-one controls | - | ✔️ |

**Granular file-level permissions** are set per link rather than per user account, so each party gets its own link carrying its own folder scope, **email allowlist or domain restriction**, and download rule. No reviewer creates an account, which removes the friction that makes busy specialists ask for the files by email instead.

![Granular folder-level permissions applied per reviewer link in a Papermark data room](https://assets.papermark.io/upload/file_LkU4BNY6MKUKMgDucSzzFg-papermark-granular-permissions.png)

_Permissions are set per link, so the lender and the external cyber specialist open the same room and see different folders._

### Step 3: lock down the folders that would help an attacker

Set the penetration test, architecture and vulnerability folders to view-only, then turn on **dynamic watermarking**, which renders the viewer's email, IP address and a timestamp onto every page. **Screenshot protection** adds a further deterrent on the test findings, and **email verification** with a one-time passcode confirms the person opening the link controls the address it went to.

The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged here, and why watermarking exists. It makes a leak attributable to a named viewer rather than merely regrettable.

![Dynamic watermark showing viewer email, IP address and timestamp on a security diligence document](https://assets.papermark.io/upload/file_Ks2dtpU7UXaoreiAAtXr54-watermarked-document.png)

_Dynamic watermarking renders viewer identity onto every page, which makes a leaked penetration test traceable._

### Step 4: run the evidence waves through Q&A

Cyber diligence is a sequence of follow-ups, and the sequence is the substance of the review. The **Q&A module** attaches each question to the document that prompted it, so the request for retest letters sits against the penetration test report rather than in a thread three people were not copied on. Permissions control who sees which threads, and the log exports for the closing file.

### Step 5: read the analytics, then freeze the room

**Page-level analytics** show which reviewer opened which document, when, and for how long. In cyber diligence that is an early warning system: a specialist who spends forty minutes on the vulnerability export and then asks for the exception register has found something, and you will hear about it a week before the report lands.

![Per-visitor analytics across cybersecurity due diligence documents in a Papermark data room](https://assets.papermark.io/upload/file_YVZLbYwELYa8SxfjBg3mGe-virtual-data-room-analytics-.png)

_Per-visitor analytics show which security documents each reviewer opened and for how long._

After completion, **data room freeze** makes the room immutable and exports it as an archived ZIP with a certificate, which is the record when the argument eighteen months later becomes what was disclosed and when. **Link expiration** and the **audit log** close out reviewer links so the attack plan is not sitting in five inboxes.

### What it costs

The [Data Rooms plan](https://www.papermark.com/pricing.md?view=datarooms) is **€99/month** with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. **Data Rooms Plus at €249/month** adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. **Premium at €549/month** adds 10 team members, AI redaction, the public API, SSO and white-labelling. **Data Rooms Unlimited at €999/month** removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. For buy-side teams running several targets at once, unlimited data rooms means one room per target with no per-project fee.

_No credit card required._

## FAQ

### What is cybersecurity due diligence?

It is the pre-close assessment of a target company's security controls, incident history, and the regulatory exposure the buyer inherits at completion. A standard review works through 9 control domains, from identity and access to third-party risk, and ranks findings by severity with a costed remediation plan.

### How much does cybersecurity due diligence cost?

Scope drives the number more than deal size does. An external attack-surface and credential-exposure review starts at around $5,000, a full control review on a mid-market target lands in the tens of thousands, and a large regulated target with penetration testing can reach $150,000 or more.

### How long does cybersecurity due diligence take?

Typically 2 to 6 weeks on a mid-market target once the data room is populated, and 4 to 8 weeks where technical testing is included. A rapid external-posture review can be delivered in 5 to 7 days and is worth running early, because it costs little and occasionally changes the deal.

### Who performs cybersecurity due diligence?

Usually a specialist cyber advisory firm or the security practice of a technology diligence provider, engaged by the buyer after the letter of intent and working alongside the buyer's own CISO. The work combines document review with interviews of the target's CTO and security lead, typically 6 to 10 sessions on a mid-market deal.

### What is the difference between cybersecurity due diligence and IT due diligence?

IT due diligence prices the internal technology estate across 8 domains, including licensing, run-rate cost and integration readiness. Cybersecurity due diligence goes deep on one of those domains and adds what the IT review does not cover: incident history, penetration test quality, external attack surface, and the notification duties the buyer inherits after closing.

### Is a SOC 2 Type II report enough on its own?

No, and the scope statement is the reason. A Type II report tests controls over 3 to 12 months, which makes it far stronger than a policy document, but the company chooses the system it covers. A report scoped only to the production platform says nothing about whether corporate IT has multi-factor authentication, which is where ransomware usually lands.

### Does the buyer inherit the breach notification obligations of the target?

Yes on a share purchase, because the duties attach to the entity. GDPR Article 33 requires notification to the supervisory authority within 72 hours of awareness, and Article 34 requires notification to affected individuals where the risk is high. NIS2 adds a 24-hour early warning, and HIPAA sets a 60-day limit in the United States.

### What are the biggest red flags in cybersecurity due diligence?

Multi-factor authentication short of full coverage with the gaps on remote access, critical vulnerabilities open beyond 90 days, log retention under 30 days, no full restore test in the past 12 months, a SOC 2 scope that excludes corporate IT, and no inventory of which vendors can reach production. Each of the 9 domains has its own characteristic red flag, listed in the matrix above.

### Do I need a data room for cybersecurity due diligence, or is a shared drive enough?

A shared drive gives you one permission set, and cyber diligence needs five: the CISO sees everything, the specialist sees the technical findings, the lender sees the summary, the insurer sees incident history, the integration lead sees the remediation plan. A data room for cybersecurity due diligence sets permissions per link over the same documents and produces the per-visitor audit record that decides a warranty claim later. The Data Rooms plan covers 3 team members at €99/month.

### How do I share penetration test reports safely with a buyer security team?

Put them in their own folder, set it view-only with no download, restrict the link to a named email allowlist with one-time passcode verification, and turn on dynamic watermarking so every page carries the viewer email, IP and timestamp. Add screenshot protection and set a link expiry of 30 to 60 days so the report is not sitting in an inbox after closing.

## Related resources

- [Best virtual data rooms in 2026](/blog/best-virtual-data-rooms.md)
- [IT due diligence](/blog/it-due-diligence.md)
- [Technical due diligence](/blog/technical-due-diligence.md)
- [Vendor due diligence checklist](/blog/vendor-due-diligence-checklist.md)
- [Document security software](/blog/document-security-software.md)
- [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md)

---

_Markdown version of [this article](https://www.papermark.com/blog/cybersecurity-due-diligence) for AI agents and LLMs._
_More Papermark content: [llms.txt](https://www.papermark.com/llms.txt) · [full index](https://www.papermark.com/llms-full.txt)._