M&A Security Due Diligence Checklist: What to Audit Before You Close the Deal
The Marriott breach cost $123 million in fines and affected 500 million guests. The vulnerability that enabled it was in Starwood's systems -- inherited when Marriott acquired Starwood in 2016. The attackers had been inside Starwood's systems for two years before the acquisition closed. Marriott discovered the breach two years after they owned it.
You do not inherit only the assets of a company you acquire. You inherit the attackers already inside them, the unpatched systems, the forgotten SaaS subscriptions with customer data sitting in them, the ex-employees who still have access, and the undisclosed incident from 18 months ago that the target's security team decided not to report.
This checklist covers what to request during security due diligence, what answers tell you, what red flags look like, and how to price or walk away from security risk.
Phase 1: Initial Document Request (Pre-LOI or at LOI)
Request these documents at the earliest stage where it is commercially appropriate. Some sellers will not provide full documentation pre-LOI; start with the documents that inform your initial risk posture assessment.
Documents to request:
| Document | What it tells you | Red flag |
|---|---|---|
| Most recent penetration test report | What attackers find when they try; whether findings were remediated | Report older than 18 months; all findings marked 'remediated' with no retest evidence; firm is not reputable |
| SOC 2 Type II report (or equivalent) | Whether controls operate consistently | No SOC 2 at all for a SaaS company; qualified opinion with material exceptions; report older than 12 months |
| Incident history (last 3 years) | Prior breaches, ransomware, data loss | 'No incidents' from a company with no monitoring; incomplete incident log; incidents without root cause analysis |
| Current security policies (IS policy, AUP, IR policy) | Whether security is formalized or ad hoc | Policies that are undated, unsigned, or copied from templates with another company's name still in them |
| Data flow diagram | What data the company collects, where it lives, who has access | Data stored in locations not governed by the target's own policy; PII handled without documented controls |
| Vendor/sub-processor list | Which third parties have access to data | Vendors without security questionnaires; critical vendors without SOC 2 |
| Most recent vulnerability scan results | Current exposure level | No scans; scans that are 6+ months old; large backlog of critical and high findings |
| Employee offboarding procedures | Whether access is revoked when people leave | No documented process; no IdP in place; manual offboarding relying on manager memory |
Questions to ask before document review:
- When was your last security incident, and what was the nature of it?
- Have you ever paid a ransom to a threat actor?
- Are you aware of any active security investigations, regulatory inquiries, or pending breach notifications?
- What is your single biggest security concern with the business right now?
- Has any customer raised a security-related complaint or contractual concern in the last 12 months?
The answer to question 4 is often the most useful thing you hear in the entire diligence process. The target's CISO, if they are honest, will tell you exactly what they are worried about.
Phase 2: Technical Assessment (Post-LOI, Pre-Close)
After LOI, request access for a more detailed technical review. Depending on deal size and sensitivity, this may include an independent third-party technical assessment.
Identity and access review
Request an export from the target's identity provider:
- Total user count vs. active employee count (gap indicates stale accounts)
- MFA enrollment rate and enforcement status
- List of users with admin or elevated access to production systems
- Date of last access review
- Offboarding tickets for the last 10 departures -- did access get revoked within 24 hours?
Red flags:
- More IdP accounts than employees (orphaned accounts common after layoffs)
- MFA available but not enforced
- Admin list includes contractors, consultants, or former employees
- No documented access review in the last 12 months
Cloud environment review
Request read-only access to cloud accounts (or a trust-but-verify: have the target run the AWS Security Hub findings report and share it):
- Security Hub score and critical finding count
- GuardDuty enabled and active finding count
- CloudTrail coverage (all regions? cross-account logging?)
- Public S3 buckets (any?)
- RDS instances with public access
- Root account MFA status
- IAM users with programmatic access and no rotation
Red flags:
- No cloud security tooling in place (no GuardDuty, no Security Hub, no CSPM)
- Active GuardDuty findings that have not been investigated
- Public S3 buckets they cannot explain
- Root account used for day-to-day operations (access keys present)
Endpoint and network review
- EDR coverage: what percentage of endpoints have EDR deployed?
- Patch management: what is the current unpatched critical CVE count and average age?
- Network segmentation: is production separated from corporate?
- VPN or zero trust architecture in use for remote access?
Red flags:
- Less than 90% EDR coverage on production systems
- Critical CVEs more than 30 days old on internet-facing systems
- Corporate laptops on the same network segment as production databases
Data inventory and classification
- What categories of PII does the company collect and process?
- What regulated data types are present? (PHI, PCI, GDPR-regulated data, CCPA)
- Where is customer data stored? Is it in systems the target controls?
- Are there data retention and deletion policies? Are they enforced?
Red flags:
- Company collects PII but has never done a GDPR or CCPA assessment
- Customer data found in SaaS tools the target forgot about (Zendesk, Mixpanel, Segment, HubSpot) without appropriate DPAs
- No data deletion capability -- cannot honor customer deletion requests
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Phase 3: Incident History Deep Dive
Incident history is the most underinvestigated area in security due diligence. Sellers have incentives to downplay incidents. Acquirers rarely push hard enough.
What to request:
- Full incident log for the last 36 months, including minor incidents and near-misses
- For any incident involving customer data or regulated data: the incident report, timeline, customer notification record, and regulatory notification record
- Evidence of cybersecurity insurance claims filed in the last 5 years
- Any legal matters, regulatory inquiries, or customer complaints related to data security or privacy
The questions that reveal undisclosed incidents:
- Have you ever received a ransomware demand? What happened?
- Have you ever had a data exposure where customer data was accessible externally?
- Have you ever rotated credentials org-wide due to a suspected compromise?
- Has your cyber insurance carrier ever raised premiums or required remediation following a claim?
- Have you received any notifications from threat intelligence services or law enforcement about your systems?
Question 5 is particularly revealing. FBI Ic3, CISA, and threat intel vendors frequently notify companies that their credentials or data appear in criminal forums. Companies that received such notifications may have had a breach they did not fully investigate.
Technical indicators of undisclosed past compromise:
If you get read-only access to the target's environment, look for:
- CloudTrail events showing unusual API activity in the prior 12-24 months (mass S3 downloads, bulk IAM changes)
- EDR or AV alerts that were dismissed without investigation
- Active scheduled tasks, cron jobs, or startup scripts that cannot be attributed to known software
- Outbound connections to unusual destinations in firewall or flow logs
- Accounts created at unusual times (late night, weekends) that are still active
These are not proof of compromise -- they are indicators that warrant further investigation before close.
Risk Pricing: Which Findings Affect Deal Value vs. Which Kill the Deal
Not all security findings are equal. The question is not 'are there security issues?' -- there are always security issues. The question is: which issues are priced into the deal, which require remediation escrow, and which are deal-breakers.
Price into the deal (common, remediable):
- Missing SOC 2 (but a credible roadmap to achieve it within 12 months)
- Vulnerability backlog that is large but has no evidence of exploitation
- Missing security tools (EDR gaps, no CSPM, limited logging)
- Policy gaps (undated policies, missing sections)
- No formal vendor security review process
- Moderate pentest findings with no active exploitation
Structure as: remediation cost estimate in the purchase price adjustment, or a post-close remediation plan with defined milestones.
Remediation escrow (significant, fixable with resources):
- Active critical vulnerabilities on internet-facing systems
- Significant data in uncontrolled SaaS tools without DPAs
- Regulatory exposure from undisclosed potential breach (GDPR, HIPAA)
- Known security debt requiring 6-18 months to remediate at material cost
- Cyber insurance lapse or coverage dispute
Structure as: holdback or escrow equal to the estimated remediation cost, released on defined milestones post-close.
Deal-breakers or require re-pricing:
- Active, ongoing compromise that the target has not remediated
- Undisclosed breach that should have triggered regulatory notification but did not
- Ransomware payment in the prior 24 months with no confirmed eradication of the threat actor
- Material misrepresentation of security posture in representations and warranties
- Regulatory investigation currently underway that was not disclosed
- Customer data stored in jurisdictions that create immediate compliance violations
Representations and warranties to require in the purchase agreement:
- Target represents no undisclosed security incidents in the prior 36 months involving customer data
- Target represents compliance with all applicable data protection laws in the jurisdictions where it operates
- Target represents all customer data processing agreements (DPAs) are in place with all sub-processors
- Cyber R&W insurance is available and recommended for material deals -- covers undisclosed pre-close liabilities
Cyber R&W insurance:
For deals above $50M, consider representations and warranties insurance with a cyber endorsement. This covers undisclosed pre-close security liabilities discovered post-close. Premiums: typically 2-4% of deal value for the insured limit.
Post-Close: The First 100 Days Integration Checklist
Closing the deal creates new risk. Network interconnection before security review, inherited credentials, and legacy systems now connected to your environment are the vectors of most post-acquisition breaches.
Day 1 to Day 30: Isolation and Inventory
Before any network interconnection:
- Complete asset inventory of the acquired company's systems
- Identity audit: export all IdP users, identify duplicates with your environment, flag elevated access accounts
- Revoke all administrative access until it can be reviewed and re-granted through your provisioning process
- Do not connect the acquired company's network to yours until a segmentation review is complete
- Deploy your EDR to all acquired endpoints before any connection
Day 30 to Day 60: Access and Credential Hygiene
- Force password reset for all inherited accounts
- Enforce your MFA policy on all acquired accounts before they access your systems
- Migrate secrets from the target's secrets manager to yours
- Audit and close the target's SaaS subscriptions that are not being retained
- Review all shared credentials (service accounts, API keys) and rotate
Day 60 to Day 100: Security Program Integration
- Include the acquired company's systems in your vulnerability management scanning
- Include acquired systems in your next pentest scope
- Bring acquired employees through your security awareness training
- Update your incident response plan to include the acquired company's systems and contacts
- Report inherited security risk to your board as part of the post-acquisition integration update
The interconnection gate:
Do not merge networks until you can answer yes to all of these:
- EDR deployed to 100% of acquired endpoints?
- All admin and elevated accounts reviewed and re-provisioned?
- MFA enforced on all inherited accounts?
- No active critical vulnerabilities on internet-facing systems?
- No active GuardDuty or equivalent findings in the inherited environment?
Complete asset inventory before network join
No acquired system joins your network until it is catalogued, scanned, and has EDR deployed
Force credential reset day one
Inherited passwords, API keys, and service account credentials rotate before any integration activity begins
MFA enforcement before access grant
Acquired employees enroll in your MFA program before they receive access to any of your systems
Vulnerability baseline scan within 30 days
Run your standard vulnerability scanner against all inherited systems and triage findings before integration completes
Include in next pentest scope
Acquired systems appear in the next pentest scope; do not assume the prior target's pentest covers your risk
The bottom line
Security due diligence is not a compliance checkbox -- it is how you price the real cost of the deal. A target with $50M in undisclosed security remediation needs either a $50M price reduction or $50M in escrow. The acquirers who absorb post-close breaches are the ones who did not ask the hard questions before close, or who heard the answers and did not take them seriously. The checklist above covers the questions. Taking them seriously is the judgment call only you can make.
Frequently asked questions
When in the M&A process should security due diligence start?
Ideally at or immediately after LOI, before significant deal costs are incurred. A high-level security risk assessment (incident history questions, pentest report review, SOC 2 status) can often be completed pre-LOI in 2-3 days with publicly available information and basic document requests. The detailed technical assessment (cloud environment review, identity audit, data inventory) happens post-LOI during the full diligence period. Starting security diligence at the same time as financial and legal diligence, not after, is the key discipline.
What should I do if the target refuses to provide security documentation?
Treat resistance as a red flag. Most mature companies are comfortable sharing pentest executive summaries and SOC 2 reports under NDA -- that is what they exist for. A company that resists sharing basic security documentation either does not have it (they have not invested in security) or has it and does not want you to see it (they know what it shows). Either case is material to the deal decision. Insist on minimum documentation as a condition of proceeding.
How much does a security due diligence assessment cost?
A high-level document review and interview-based assessment: $15,000-$40,000 from a specialized security consulting firm. A full technical assessment including cloud configuration review, penetration testing of the target, and data inventory: $50,000-$150,000. For deals above $50M, this cost is trivial relative to the potential liability. Many acquiring companies use their existing relationship firms (the same one that does their annual pentest) for target diligence, which often provides cost and timeline advantages.
What is cyber representations and warranties insurance?
Representations and warranties (R&W) insurance covers breaches of seller representations in the purchase agreement -- including security representations. If the seller represents that there are no undisclosed incidents and a pre-close breach is discovered post-close, cyber R&W insurance covers the loss. It is purchased by the buyer at close, typically with limits of 10-20% of deal value. For deals above $50M with material technology or data assets, it is increasingly standard. Premiums run 2-4% of the insured limit.
What is the biggest security mistake acquirers make post-close?
Connecting the acquired company's network to their own before completing a security baseline. The moment you create a network trust relationship with a newly acquired company, their vulnerabilities and any attacker already inside their environment can pivot into yours. Run EDR on all acquired endpoints, complete your access and credential review, and enforce your security policies on inherited systems before any network integration. Every day of delay on this is a day of unquantified risk.
A prior breach at the target was not disclosed in due diligence. What now?
Consult legal immediately. Undisclosed breaches can trigger representations and warranties claims against the seller, escrow release conditions, or deal price adjustments depending on your purchase agreement language. If the breach involved regulated data and notification obligations were not met, you may have inherited an active regulatory liability -- legal counsel and potentially direct contact with the relevant regulator is required. Cyber R&W insurance, if purchased, covers this scenario. This is exactly why the incident history questions and the R&W language both matter.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.
The Mythos Brief is free.
AI that finds 27-year-old zero-days. What it means for your security program.