Cybersecurity Due Diligence Checklist: 10 Areas to Review in M&A

A cybersecurity due diligence checklist sets out what a buyer's team examines in a target's security before signing, and a complete one covers ten areas: incident and breach history, security ownership and budget, identity and privileged access, endpoint and network controls, cloud and application security, data inventory and privacy, third-party and vendor risk, compliance and customer commitments, resilience and recovery, and insurance and accepted risk. In each area the team requests documents, questions the people who run the controls, tests what access allows, and records red flags. Every material finding then needs a place in the deal: a price adjustment, a specific indemnity, an escrow, an exclusion from representations and warranties (R&W) insurance, a closing condition, a pre-close remediation covenant, a transition services term, or an item in the day-one plan. A finding with no place in the deal rarely survives the negotiation.

When does cybersecurity due diligence run, and how deep does it go?

Cyber diligence runs in three passes that follow the deal calendar. The outside-in pass needs nothing from the target, so it fits before the letter of intent (LOI). Document-based diligence starts when the data room opens during exclusivity. Technical validation depends on how much access the target will grant before signing.

The passes build on each other. An outside-in review that finds an unpatched remote access gateway shapes the first document request, and the interviews decide where technical validation is worth the target's goodwill. A compromise assessment, which hunts for signs of an active intrusion in endpoint and identity logs, belongs on deals where incident history is thin, logs are kept for days rather than months, or the outside-in pass found exposed services. Technology diligence uses the same evidence to ask whether the systems can carry the buyer's plan; our guide to technology due diligence red flags covers that side.

Why do cyber findings change deal terms?

Cyber findings change terms because the buyer inherits the target's systems, data, and breach history, including incidents nobody has found yet. After Yahoo disclosed data breaches during Verizon's purchase of its operating business, the companies amended the deal on February 21, 2017: the price fell by $350 million to about $4.48 billion, Yahoo agreed to bear 50% of certain post-closing cash liabilities from non-SEC government investigations and third-party litigation over the breaches, and liabilities from shareholder suits and SEC investigations stayed with Yahoo. The amendment also kept the breaches from counting toward a business material adverse effect. In April 2018 the SEC fined the company formerly known as Yahoo $35 million for failing to disclose a December 2014 breach that its security team had identified within days.

Marriott shows what a finding costs when it surfaces after closing. The FTC reports that Starwood notified customers of a payment card breach in November 2015, four days after Marriott announced it would acquire Starwood. A second intrusion into Starwood's guest reservation database had begun around July 2014 and went undetected until September 2018, about two years after the deal closed, and it reached about 339 million guest records. The UK Information Commissioner's Office fined Marriott £18.4 million in October 2020 for failing to secure that data from May 25, 2018, when the GDPR took effect, to September 17, 2018, and wrote that the duty of due diligence is not "time-limited or a 'one-off' requirement." In October 2024 the FTC, 49 states, and the District of Columbia settled with Marriott. The states collected $52 million, and the FTC's order, finalized in December 2024, requires an information security program, independent assessments every two years, and annual compliance certifications for 20 years. According to the Connecticut Attorney General, the states' settlement also requires Marriott to review the security of companies it acquires and to plan fixes for the gaps it finds during integration.

Breach costs explain why buyers price these findings. IBM's Cost of a Data Breach Report 2026, released July 29, 2026, put the global average cost of a breach at $4.99 million. Verizon's 2026 Data Breach Investigations Report, released May 19, 2026, found a third party involved in 48% of breaches, so the vendor row below matters as much as the target's own controls.

What should a cybersecurity due diligence checklist include?

The checklist follows the ten areas BD Emerson reviews on a standard buy-side engagement. Each row lists what to request and ask, the red flags that matter, and the deal lever a finding usually feeds.

Incident history, ownership, and access

Ask for help desk tickets as well as the formal incident log, because incidents handled quietly often appear only in the tickets. Then ask for the artifact behind each interview answer: the MFA enrollment report rather than the statement that MFA is on.

Data, vendors, commitments, recovery, and insurance

Read compliance documents for scope before conclusions. A SOC 2 report covers only the system and period its auditor tested, and our article on SOC 2 and cybersecurity in M&A due diligence explains how to read one in a deal. Where the target trains or runs AI models on customer data, the data row extends into data rights and model diligence, covered in our guide to AI due diligence.

Which regulatory obligations does a buyer inherit?

A buyer takes on the target's regulatory obligations at closing, and a public acquirer also brings the target into its own disclosure regime. Deal counsel allocates these obligations in the purchase agreement; diligence establishes where the target stands on each.

Public acquirers report under the SEC's cybersecurity rules, adopted July 26, 2023. Form 8-K Item 1.05 requires disclosure within four business days after a company determines that an incident is material, and Regulation S-K Item 106 requires an annual description of cyber risk management, strategy, and governance. Item 106 defines information systems as resources "owned or used by the registrant," so the target's systems count as the acquirer's after closing, and the item's question on oversight of third-party service providers puts the target's vendor program into the acquirer's next annual report.

FTC orders travel with the business. The FTC's data security order against Drizly, proposed in October 2022 when Drizly was already a subsidiary of Uber, binds Drizly's successors and assigns for 20 years, and the FTC said the order "will follow" the CEO, who for 10 years must put a security program in place at any business he controls or runs that holds data on 25,000 or more consumers. Request the order and every assessment filed under it.

Sector rules set their own floor. HIPAA requires a covered entity or business associate to perform an accurate and thorough risk analysis under 45 CFR 164.308(a)(1)(ii)(A). The FTC's Safeguards Rule requires non-bank financial institutions to name a qualified individual, use MFA and encryption, keep an incident response plan, and report to the board each year, and since May 13, 2024 they must notify the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. The future-dated requirements of PCI DSS v4.0.1 became mandatory on March 31, 2025, so an older attestation may not cover them. For defense targets, the DFARS CMMC rule took effect on November 10, 2025: on contracts that carry a CMMC requirement, contracting officers check CMMC status in the Supplier Performance Risk System at award and before exercising options, and contractors must report changes to the CMMC identifiers of assessed systems, which an integration plan has to account for.

How does each finding become a deal term?

Each finding goes to the lever that matches its economics, and one area can feed several levers. The levers, and the findings that usually feed them, are these:

• Price adjustment, for a quantifiable one-time cost such as replacing end-of-life systems, or a recurring cost such as a missing security function, which moves price through the earnings multiple.
• Specific indemnity and escrow, for contingent exposure such as an unresolved incident, a regulatory inquiry, or privacy claims.
• R&W insurance exclusion, the insurer's answer to known issues and thin diligence, which the buyer covers with a specific indemnity or finished diligence.
• Closing condition, when something must be true before funds move, such as confirmed containment of an active compromise.
• Pre-close remediation covenant, for fixes the seller can finish before closing, such as MFA on every privileged account.
• Transition services term, when a carve-out target will rely on the seller's identity, monitoring, or email services after closing.
• Day-one and 100-day plan items, for work that can wait but needs an owner, a budget, and a date.

The figure maps the ten areas against the five most common levers.

The common error is matching the lever to the size of the number instead of its nature. A large one-time remediation cost belongs in price, while an open regulatory inquiry belongs in a specific indemnity even when today's estimate is small, because the estimate can grow after closing. Our guide to private equity due diligence places the cyber workstream in a buyout timeline.

How do R&W insurers treat cyber diligence?

R&W underwriters cover unknown breaches of the seller's representations, and they read the buyer's diligence reports to decide what is unknown. McGriff's July 2022 advisory on cyber risk and R&W insurance lists how insurers respond when cyber diligence is thin or turns up problems: flat exclusions, conditional exclusions that stay until outstanding diligence arrives, deemed edits that narrow the cyber representations, lower sublimits or higher retentions, and a requirement that the buyer buy separate cyber coverage when the target holds none. It also lists what underwriters ask about, including MFA for remote access and privileged accounts, tested offline backups, incident response plans, patching, vendor risk, penetration testing, and claims history.

A cyber report that states its scope and answers those questions with evidence gives the underwriter a basis to cover the cyber representations. SRS Acquiom's 2026 deal terms study found that 22% of the 2025 deals it covered had no cybersecurity representation, up from 5% in 2024, and a policy cannot respond to a breach of a representation the agreement never made. Our guide to representations and warranties insurance covers pricing, exclusions, and claims.

What do you cut when the diligence window is short?

A compressed timeline forces choices that should follow the deal thesis and the data the target holds. Three areas are hard to justify dropping. Incident history comes first, because an undisclosed incident moves price and trust more than any control gap. Internet-facing exposure and identity come next: Verizon's 2026 report found that exploitation of vulnerabilities, at 31% of breaches, overtook stolen credentials as the most common way in for the first time in the report's 19 years, and both areas are quick to test. Customer commitments stay because the contracts transfer with the entity.

Rank the remaining areas by exposure. A healthcare or financial services target keeps data inventory and regulatory compliance in full scope, a software company keeps cloud and application security, and a manufacturer keeps endpoint, network, and recovery, where an outage halts output. The areas cut first are usually deep application testing and the long tail of vendors, sampled down to those that hold data or reach production. Whatever is cut, the report should list it, because underwriters exclude what diligence did not cover, and the day-one plan should pick it up after closing.

How BD Emerson runs cybersecurity due diligence

BD Emerson runs cybersecurity due diligence for buyers and sellers as a workstream inside the deal team. We scope the work against the deal calendar and state in writing which of the ten areas we are narrowing or dropping when the window is short. Our practitioners read the documents, interview the people who run security, IT, and engineering, and inspect identity, cloud, endpoint, logging, and backups directly where the target grants access. Each material finding leaves with a cost range, an owner, a date, and a recommended lever, and we work through the findings with deal counsel, who drafts the representations, indemnities, and covenants. The remediation plan then becomes the day-one and 100-day plan. When cyber runs alongside financial, technology, and operational diligence through our M&A due diligence practice, the target answers each question once.

Frequently asked questions

What is cybersecurity due diligence in M&A? Cybersecurity due diligence is the review a buyer runs on a target's security before signing an acquisition. It examines breach history, access controls, endpoint, network, and cloud configuration, data obligations, vendors, customer security commitments, recovery, and cyber insurance. Each material finding leaves with a cost and a recommended deal term, such as a price adjustment, a specific indemnity, an escrow, a closing condition, or an item in the day-one plan.

What documents should a buyer request for cyber due diligence? Start with the incident log and forensic reports, the last two penetration tests, SOC 2 reports and ISO 27001 certificates with their scopes, the cyber insurance policy and application, the MFA enrollment report, the privileged account list, backup restore test records, the vendor inventory, and the security terms in the largest customer contracts. Ask for help desk tickets tagged security too, because quietly handled incidents often appear only there.

What is a cybersecurity due diligence questionnaire? It is the written list of questions a buyer sends the target's management at the start of diligence, usually with the document request. Good questionnaires ask for evidence instead of yes or no answers: rather than asking whether the company uses MFA, ask for the enrollment report covering privileged accounts. Treat the answers as leads to test, because a questionnaire records what management believes and only testing shows what the systems do.

Does representations and warranties insurance cover cyber risk? It can cover breaches of the cybersecurity and privacy representations that the buyer did not know about at signing. Underwriters exclude known incidents, and where cyber diligence was thin they often add exclusions, sublimits, or higher retentions, according to McGriff's 2022 advisory. Buyers protect coverage by finishing cyber diligence before the underwriting call and documenting controls such as MFA, tested offline backups, and incident response plans.

Can a buyer scan a target's systems before signing? A buyer can scan only with the target's written permission. Before signing, most targets limit buyers to documents, interviews, and an outside-in review built from public information. Where the target agrees, read-only access to identity and cloud consoles, or a screen-shared walk-through, gives evidence without touching production. Active scanning and penetration testing usually wait for access rights in the purchase agreement, with counsel confirming scope and authorization first.

If you are preparing a first document request or an underwriting call on a target that holds customer data, our cybersecurity due diligence team can run the ten areas on your deal calendar and give counsel priced findings with a recommended deal term for each.