Cyber Security Due Diligence: What Buyers Ask
Cyber security due diligence is the review an acquirer or investor runs over your security posture before completing a transaction. They examine seven areas: governance, certification, testing, incident history, privacy, third parties and access control. Findings rarely kill a deal outright. They become price adjustments, warranties and conditions. The work that protects your valuation happens before the term sheet, not after it.
Australian technology businesses are acquired and funded constantly, and security diligence has moved from a tick-box annex to a workstream with its own specialists. If you are two years from a transaction, the sections below are a roadmap. If you are four weeks out, they are a list of what you are about to be asked.
What is cyber security due diligence?
Cyber security due diligence is the assessment a buyer, investor or lender performs to understand the security and privacy risk they are taking on through a transaction. It covers how security is governed, what independent assurance exists, what incidents have occurred, how personal information is handled, and what liabilities might follow the deal across.
It differs from a security audit in both purpose and tone. An audit asks whether you meet a standard. Due diligence asks what the acquirer is buying, what it will cost to fix, and what might surface after completion. That is why diligence teams dig into incident history and unresolved findings rather than simply confirming a certificate exists.
Scope varies with deal size. A small acquisition may be a questionnaire and a two hour management session. A larger transaction may add technical review, external scanning and interviews with your engineering team. Either way the questions come from the same seven areas.
When should cyber security due diligence be carried out?
Cyber security due diligence is usually carried out after a term sheet is signed and during the exclusivity period, which commonly runs four to eight weeks. By that point the price has been proposed. Anything diligence uncovers moves the price downward or adds conditions, which is why preparation belongs well before the term sheet.
The sequence is predictable. Scope is agreed, a document request lands with a short deadline, a technical review runs in parallel, your management team is questioned without a script, and findings are written up. The document request is the moment most sellers discover their policies are undated or their risk register has not been touched in a year.
Sell-side preparation, sometimes called vendor due diligence, means running the same review on yourself before you go to market. It costs a fraction of what a discovered problem costs in price adjustment, and it lets you fix issues rather than explain them.
What goes in a cyber security due diligence questionnaire?
A cyber security due diligence questionnaire typically runs to between forty and two hundred questions covering governance, certification, technical controls, incidents, privacy and third party risk. The questions themselves are rarely difficult. What catches sellers out is being asked to evidence an answer within days.
| Area | What they ask | What you should have ready |
|---|---|---|
| Governance | Who owns security, and what is approved | Dated policies, a named owner, board or director visibility |
| Certification | ISO 27001, SOC 2 or a roadmap | The certificate, scope statement and last audit report |
| Testing | When were you last tested independently | Recent penetration test report and the remediation record |
| Incidents | Every incident and breach in recent years | An honest incident log and what changed afterwards |
| Privacy | What personal information you hold and where | A data map and your Notifiable Data Breach process |
| Third parties | Who touches your data | A supplier register with risk ratings and current reports |
| Access | How access is granted and removed | MFA coverage evidence and offboarding records |
The pattern is that buyers want artefacts, not assurances. A statement that you take security seriously carries no weight. A dated access review covering the last four quarters carries a great deal.
What weakens a deal in cyber security due diligence?
The findings that damage value in cyber security due diligence are usually about honesty and neglect rather than technical sophistication. Buyers accept imperfect security. They react badly to a seller who did not disclose something, or to evidence that known risks were ignored for years.
- An undisclosed incident that diligence uncovers. This is the single worst outcome, because it recalibrates the buyer’s view of everything else you told them.
- Penetration test findings still open from two or more years ago, which evidence a known risk that was accepted without any decision being recorded.
- Policies created in the weeks before the process started, visible from file metadata and approval dates.
- No clear picture of where personal information is held, which makes Privacy Act exposure impossible for the buyer to price.
- Critical suppliers that have never been assessed, particularly ones with production access.
- Shared administrative accounts and departed staff whose access was never removed.
The remedy for most of these is time rather than money. Closing out old test findings, dating and approving your policies properly, and building a supplier register are all inexpensive. They simply cannot be done credibly in the four weeks after a term sheet. Our guide to where to start with cyber security strategy covers the sequencing if you are beginning from a low base.
Does ISO 27001 or SOC 2 help in due diligence?
Certification materially shortens cyber security due diligence because it replaces assertions with independently tested evidence. An acquirer reviewing a current ISO 27001 certificate or SOC 2 Type 2 report can skip large parts of the questionnaire, and diligence teams routinely say so.
The caveat is scope. A certificate covering only one product line, or an ISO 27001 scope statement carefully drawn around a small part of the business, will be read closely and may raise more questions than it settles. Buyers check the scope statement before they check the certificate. Our guides to ISO 27001 certification in Australia and SOC 2 for Australian businesses cover what each one actually proves.
Certification is not a prerequisite for a good outcome. Plenty of businesses pass diligence comfortably without it by having a recent independent penetration test, a clean remediation record, and documented decisions. What does not survive scrutiny is a claim of alignment with a framework that has never been independently checked.
What are the privacy obligations buyers check in Australia?
In an Australian transaction, buyers examine whether you comply with the Privacy Act 1988, whether you can identify where personal information sits, and whether you have a working process for the Notifiable Data Breach scheme. They check this because privacy liability transfers with the business and penalties have risen significantly.
The practical test a buyer applies is simple: can you produce a data map. Not a diagram of your architecture, but a list of what categories of personal information you hold, in which systems, under whose control and for how long. Many otherwise well-run Australian SMBs cannot produce one, and it is the item most likely to generate a condition at completion.
The Office of the Australian Information Commissioner publishes the requirements of the Notifiable Data Breach scheme, including the thirty day assessment window that applies once you suspect an eligible breach. Our guide to the Australian Privacy Principles sets out the obligations in business terms.
Common questions
What is cyber security due diligence?
Cyber security due diligence is the review an acquirer, investor or lender performs over a target company’s security and privacy posture before completing a transaction. It examines governance, certification, testing history, incidents, privacy handling, third party risk and access control, and its findings typically translate into price adjustments, warranties or conditions rather than a withdrawal.
What is the difference between due diligence and due care in cyber security?
Due care is the ongoing obligation to act reasonably in protecting information, such as patching systems and training staff. Due diligence is the act of investigating and verifying, whether of your own posture or of a counterparty’s before a transaction. Put simply, due care is what you do continuously, and due diligence is what you check at a decision point.
When should cyber security due diligence be carried out?
Buy-side diligence typically runs during exclusivity after a term sheet, over four to eight weeks. Sell-side preparation should begin twelve to twenty-four months earlier, because the items that most affect valuation, such as closing old penetration test findings and building a supplier register, take time to establish credibly and cannot be manufactured once a process is underway.
What goes in a cyber security due diligence questionnaire?
A typical questionnaire covers governance and policy ownership, certifications held and their scope, independent testing and remediation, incident and breach history, personal information handling and Notifiable Data Breach readiness, third party and supplier risk, and access management including multi-factor authentication and offboarding. Expect between forty and two hundred questions depending on deal size.
Who is most likely to perform cyber security due diligence?
On larger transactions it is usually a specialist team within an advisory or accounting firm, working alongside the legal and financial diligence streams. On smaller Australian deals it is often the acquirer’s own technology leadership, sometimes supported by an external consultant. Lenders and insurers increasingly run a lighter version of the same review.
Preparing before you are asked
The businesses that come through security diligence well are not the ones with the largest security budgets. They are the ones that can produce dated evidence quickly and explain their decisions honestly. If you are planning a raise or an exit and want to know how your current posture would read to a buyer, our cyber security advisory services and vCISO support are built for exactly this kind of preparation. Get in touch for a conversation.