Pre-acquisition cyber due diligence: a practical checklist

The short version

Pre-acquisition cyber due diligence checks what security risk and regulatory exposure you would take on with a target. The Cyber Security and Resilience Bill (CSRB) adds a new question: is the target regulated, or about to be, and can it meet those duties?

Buying a company usually means buying its past. Marriott is the standard warning. Attackers entered Starwood's systems around 2014, Marriott bought Starwood in 2016, and the breach came to light in 2018. The UK regulator proposed a fine of about £99 million, then issued a £18.4 million penalty. Reports of the case point to criticism of Marriott's due diligence and its post-deal handling of Starwood's systems.

This guide is general information. Your legal advisers should lead on deal terms.

Why the Bill changes the checklist

Under the Bill, an acquisition can change more than ownership:

• Size can change status. Micro and small enterprises are excluded from the digital and managed service categories. The EU definition the Bill uses can take linked businesses into account, so a small target may lose that exclusion when it joins a larger group. Take advice on how this applies.
• Fines scale with turnover. Maximum penalties for undertakings refer to turnover worldwide. Check how a group structure would affect exposure, with legal advice.
• New regulators appear. A buyer may gain the Information Commission, Ofcom or a sector authority as a regulator.
• Registration deadlines apply. RMSPs and RDSPs have three months from first meeting the conditions.
• Supplier designations could follow. A target may be, or may become, a critical supplier.

Four questions diligence must answer

1. Is there already a compromise? The most expensive finding is one nobody knows about yet.
2. Is the target regulated, or will it be? Which category, which regulator and from when?
3. Can it meet its duties at reasonable cost? Include remediation in the valuation.
4. Can you safely connect it to your business? Integration can spread a target's problems.

The checklist

Regulatory position

• Current status under the NIS Regulations 2018
• Expected status under the Bill: OES, data centre, RDSP, RMSP or possible critical supplier
• Regulator correspondence, inspections and enforcement history
• Incident reports to regulators in the past few years
• Personal data breach log and reports to the Information Commission
• Other regimes, such as FCA and PRA rules, DORA, NIS2 or the EU Cyber Resilience Act

Security governance

• Who owns cyber risk, and how often the board hears about it
• Risk register and accepted risks
• Budget, team and key-person dependency
• Certifications, their scope and expiry dates, such as Cyber Essentials or ISO 27001
• Any Cyber Assessment Framework self-assessment

Technical position

Depending on deal access, request or commission:

• external attack surface review
• recent penetration test reports, with evidence that findings were fixed
• identity and privileged access review
• end-of-life systems and patching figures
• backup testing results
• logging coverage and retention

Evidence of past compromise

A clean-looking test report doesn't show that nobody got in. Where possible, consider:

• threat hunting on key systems
• review of logs for known indicators
• credential exposure searches
• review of past incident files, including ones treated as minor

Short log retention limits what you can establish. If logs only go back a few months, record that as a limit of the diligence.

Third parties

• Key suppliers and their access
• Customer contracts with security commitments, notification deadlines, audit rights or uncapped liabilities
• Customer questionnaires, including answers given
• Whether the target's customers are regulated and might pass duties down

Insurance and disputes

• Cyber policy terms and claims history
• Effect of a change of control on the policy
• Current or threatened claims

How to stage it

Stage	Focus	Typical access
Pre-offer	External view, public incidents, regulatory status	No target access needed
Due diligence	Documents, management interviews, red flags	Data room and experts' sessions
Confirmatory	Technical testing, threat hunting on priority systems	Agreed scope with the target
Before completion	Fix critical issues, agree first-100-days plan	Target and deal teams
After completion	Isolate, assess, then integrate	Full access

Get written authorisation before any technical testing. Someone entitled to authorise it must agree, as testing without it can create a legal problem. See is penetration testing legal in the UK? Also manage what buyer and target can share at each stage, as competition rules may apply. Your lawyers will advise.

Turning findings into deal terms

Findings should change the deal, not sit in a report. With legal advisers, consider:

• Price. Reflect remediation and regulatory costs.
• Conditions. Require fixes for critical issues before completion.
• Warranties. Cover security incidents, compliance and regulator contact. Practitioners note these can have short survival periods, so check how long yours last.
• Indemnities. Cover specific known issues.
• Insurance. Check whether cyber policies or warranty insurance exclude what you found.

The first 100 days

The Marriott criticism also concerned what happened after the deal. Don't assume diligence ends at completion:

• Keep networks separate until you've assessed the target.
• Monitor key target systems as soon as you can.
• Reset privileged credentials and review third-party access.
• Check for new registration duties and update incident plans with regulator contacts.
• Run your own threat hunt if access was limited before completion.
• Follow a clear plan for retiring legacy systems.

Sources

• Orrick: analysis of the Marriott ICO fine
• Debevoise: the Marriott proposed fine and cybersecurity in M&A
• The Bill as brought from the Commons, HL Bill 32: sections 7, 9, 14 and 21