Cyber Due Diligence Checklist

Stage 1

Before the LOI

Quick questions you can ask in a first meeting. No technical background needed.

Who looks after the company's technology day to day?Why it matters: if the answer is one person, or "a guy we call," you are buying a single point of failure.
Has the company had a security incident, scam or data loss in the last three years?Why it matters: past problems often come back, and how they were handled tells you more than the incident itself.
Does the company carry cyber insurance, and has it ever made a claim?Why it matters: insurers ask hard questions before they cover a business. A recent policy means someone has already checked the basics.
Is the business using AI tools, and is AI part of the growth story?Why it matters: if AI is in the pitch, find out early whether it is real and in use or still an idea.

Stage 2

During diligence

Ask for proof, not just answers. A short document or a screenshot is usually enough.

Can they produce a simple list of every system and software subscription they pay for?Why it matters: a company that cannot list its own tools usually cannot control them, and is often paying twice for the same thing.
Which outside vendors can see financial or customer information?Why it matters: a vendor with access to your data can become your problem if they are breached.
Do any key software contracts change or end if the company is sold?Why it matters: some contracts reprice or terminate on a change of ownership, and you want to know before you sign, not after.
Are backups tested, and how long would it take to get running again after an outage?Why it matters: "we have backups" is common. "We restored from them last quarter" is the answer you want.
Is a second step required to log in to email and key systems?Why it matters: a code on your phone stops most stolen-password break-ins. It is cheap and should already be on.
How many separate systems does finance pull from to produce monthly numbers?Why it matters: lots of manual stitching means slower reporting, more errors and a longer quality of earnings review.

Stage 3

Between signing and closing

This is when money moves and scammers pay the most attention.

Is every change to payment or wire details confirmed by phone, using a number you already had?Why it matters: fake "updated bank details" emails are one of the most common ways deal money goes missing.
Does everyone involved know who is allowed to approve a payment?Why it matters: scammers create urgency. A clear approval rule removes the pressure to act fast.
Is access to the deal documents limited to the people who need it?Why it matters: the fewer people with access, the fewer places a leak can start.

Stage 4

The first 100 days

Lock in what you bought before small gaps become expensive ones.

Has every password and admin account been handed over to people you control?Why it matters: if the old owner or a former employee still holds the keys, so does anyone who gets into their email.
Have accounts for people who left been switched off?Why it matters: old accounts that still work are one of the easiest ways in.
Is there a simple plan for combining or replacing duplicate systems?Why it matters: the cost savings in your model depend on it, and it rarely happens without an owner and a date.
Is there a written, one-page plan for what to do if something goes wrong?Why it matters: during an incident, nobody has time to work out who to call. Decide that now.

Answers that deserve a second look

"I'd have to check with our IT guy."
"We've never had a problem."
"Everyone has the same password, it's easier."
"We have backups somewhere."
"We just reply to the email to confirm payments."

None of these kills a deal. Each one is a cost, a delay or a negotiating point you want to know about now.

Want a second set of eyes on a live deal?

We'll go through this checklist with you for one portfolio company or target and point out the gaps that matter. No cost, and you keep the findings. You can also see where each risk hits hardest on our Deal Team Risk Map.

Secure a Strategic Debrief