Security program advisory
Organize security decisions, responsibilities, and priorities.
Services
Cybersecurity due diligence
Bring security questions into your transaction planning.
How an engagement runs
What we’ll cover
Define the information available, the transaction timeline, and assessment boundaries.
Review security documentation and technical risks within the agreed scope.
Summarize findings, limitations, and follow-up questions for decision makers.
The work
What security due diligence covers
Documentation review
Security policies, prior assessment reports, incident history and key contracts made available in the data room, reviewed for gaps and open risks.
Technical review
Where access is permitted, an outside-in look at the target's internet-facing exposure and selected technical checks within the agreed boundaries.
A summary for decision makers
Findings, limitations of the review and follow-up questions, written for the deal team and advisers on the transaction timeline.
Scope
A scope you can review
Your proposal defines the systems covered, deliverables, responsibilities, timeline, and fees. Work begins after the scope and required authorization are agreed. Any ongoing coverage or response commitments are specified in the service agreement.
- Systems covered
- Deliverables
- Responsibilities
- Timeline
- Fees
After the work
Useful next steps
The aim is to help your team understand the findings and decide what to address first. Remediation assistance and retesting can be discussed as part of the engagement.
Questions
Common questions
When should security due diligence happen in a deal?
Early enough that findings can shape valuation, deal terms or the integration plan. The review is fitted to the information available and the transaction timeline.
Can you assess a target without access to its systems?
Partly. Documentation and an outside-in view of internet-facing exposure can be reviewed without internal access; the summary states clearly what could and could not be checked.
Do you help after the deal closes?
Post-close work such as integration planning, penetration testing or hardening can be scoped separately.
Start a conversation
Your next step.Let’s make it clear.
Tell us about your environment and priorities. We’ll discuss the scope and outline the next steps.