Pre-Acquisition Cyber Due Diligence Checklist: What to Verify Before You Close the Deal

Updated October 02, 2026

TL;DR: A pre-acquisition cyber due diligence checklist should cover seven areas: breach history, external attack surface, identity and access, endpoint and email controls, data and backup practices, compliance and insurance, and third-party risk. Each item needs a specific artifact to request, not a verbal assurance, plus a deal-impact rating showing whether a gap is a closing condition, a price adjustment, or a post-close fix. Three hard stops, on breach history, insurance, and endpoint coverage, tell a deal team exactly when to escalate before signing.

When Verizon bought Yahoo, disclosed data breaches cut $350 million off the purchase price, a documented example of how a cyber finding can change deal terms before close, per due diligence research. Fewer than 1 in 10 buyers run a deep cyber review on a target beforehand, per that same due diligence research.

A pre-acquisition cyber due diligence checklist gives a PE deal team a 7-section, artifact-by-artifact request list to run before close, each item rated deal-killer, valuation adjustment, or post-close fix. TechProComp runs this exact checklist through its Texas cyber security services practice. See the PE portfolio cybersecurity services guide for the wider vendor view.

Why Pre-Close Cyber Findings Move the Deal

A cyber finding surfaced before close sorts into one of three outcomes: it kills the deal, lowers the valuation, or becomes a post-close fix the integration team absorbs later. Undiscovered vulnerabilities destroy value after close too, through costly remediation, regulatory exposure, and integration friction, per Petersen Landis’s M&A guide. TechProComp’s post-acquisition breach rate data explains why deal teams increasingly treat a cyber finding as a closing condition, not a footnote.

TechProComp’s private equity IT services team works this hand-off directly with PE deal teams and portfolio leadership.

The 3-Tier Deal-Impact Rating System

Every checklist item below carries one of three ratings: deal-killer, valuation adjustment, or post-close fix. A deal-killer is a finding severe enough to justify walking away or re-trading price immediately, like an undisclosed material breach. A valuation adjustment is a documented gap, like partial MFA coverage, priced into the offer.

A post-close fix is a real but survivable gap, like a stale asset inventory, assigned to the 90-day integration plan. TechProComp’s accelerated cyber due diligence engagement is built to score all 7 sections against these three tiers inside a standard deal timeline.

Section 1: Breach History & Disclosed Incidents (3-Year Lookback)

Section 1 asks a target company to disclose every breach, ransomware event, and business email compromise (BEC) attempt from the trailing 36 months, not just what regulators required them to report. A 24-to-36-month incident history review is standard practice in M&A cyber due diligence, per BlackCloak’s deal-team checklist, and SmartRoom’s guidance extends the review window to 3 to 5 years. A reader who needs the underlying term defined first can start with cyber due diligence definition.

What to Request

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
Breach disclosure log, 3-year lookback	Written incident log covering the trailing 36 months	Deal-killer if undisclosed	Deal-team legal
Business email compromise (BEC) history	BEC incident reports and any funds recovered	Valuation adjustment	Deal-team legal
Ransomware event history	Incident reports, including any ransom paid	Deal-killer if undisclosed	Deal-team legal
Regulatory disclosure history	State breach-notification filings	Valuation adjustment	Deal-team legal
Named incident records	Resolution status for each closed incident	Post-close fix if resolved	Deal-team legal

Why This Section Is a Hard Gate

An undisclosed material breach discovered after close is the clearest deal-killer-tier finding on this checklist. It directly feeds Hard Stop 1 later in this article: no undisclosed material breach in the trailing 36 months.

TechProComp had a clear roadmap, addressed issues quickly, and completed tasks within the given timeline. – Theo Crawford on Clutch

That is the same standard a deal team should expect from Section 1’s disclosure log.

Section 2: External Attack Surface

External attack surface means everything about a target’s network that is visible from the public internet: exposed ports, forgotten admin panels, expired certificates, and leaked credentials sitting on breach-data marketplaces. For a non-technical deal-team reader, the rule is simple: ask for the scan tool’s output, not a vendor’s verbal assurance that the network is fine. BlackCloak’s checklist puts it directly: request proof, not promises, since a dashboard or report carries more signal than a verbal claim.

What to Scan For

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
Open ports exposed to the internet	External scan report with port list	Valuation adjustment	Cyber DD vendor
Exposed admin panels	Scan output showing publicly reachable panels	Deal-killer if unpatched	Cyber DD vendor
Expired or misconfigured TLS certificates	Certificate inventory with expiration dates	Post-close fix	Cyber DD vendor
Leaked credentials on breach-data marketplaces	Dark-web monitoring report	Valuation adjustment	Cyber DD vendor
Unsanctioned third-party SaaS exposure	Shadow-IT/SaaS discovery report	Post-close fix	Cyber DD vendor

Reading the Scan Output

Ask the cyber DD vendor for the scan tool’s raw output or a summary report, not a verbal claim that the network was reviewed. CrossCountry Consulting’s guidance lists network and endpoint controls as a named line item buyers must inventory with the tools and vendors named, not described in general terms. A report that names the scanning tool and the scan date is verifiable. A sentence that says the network was reviewed is not.

Section 3: Identity & Access

Identity and access findings are the second most common source of valuation-adjustment-tier findings on this checklist, behind breach history. Verizon’s 2025 Data Breach Investigations Report found that credential abuse was the initial access vector in 22% of breaches, and that 88% of basic web application attacks involved stolen credentials, per DeepStrike’s analysis.

What to Request

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
MFA coverage percentage, privileged accounts	Coverage report by account tier	Deal-killer if below threshold	Cyber DD vendor
Full privileged-account inventory	Exported account list with roles	Valuation adjustment	Cyber DD vendor
Dormant account audit (90+ days unused)	Account activity report	Post-close fix	Cyber DD vendor
Shared-credential audit	Credential vault or password-manager report	Valuation adjustment	Cyber DD vendor
SSO posture and coverage	SSO configuration summary	Post-close fix	Cyber DD vendor

TechProComp has been instrumental in filling in as an outsourced network administrator, helping the client make their network more secure by finding and fixing important vulnerabilities. – Keith Kelley on Clutch

The MFA Coverage Threshold

Multi-factor authentication (MFA) requires a second verification step beyond a password, such as a one-time code or an approval push. MFA coverage below full privileged-account coverage is a specific, checkable gap on a report, not a subjective judgment call. CrossCountry Consulting lists MFA and password rotation as a named evidence category a buyer should request directly from the target, alongside role-based access control.

Section 4: Endpoint & Email

Endpoint and email controls are the two channels most ransomware and business email compromise incidents enter through, which is why this section pairs directly with Section 1’s incident history. TechProComp’s 12-layer security framework includes monitored endpoint detection and response (EDR) as one of its twelve layers, alongside cloud firewall and SIEM, giving a deal team a concrete reference point for what full coverage looks like.

What to Measure

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
EDR coverage percentage across endpoints	Endpoint management console export	Deal-killer if below 85%	Cyber DD vendor
Email filtering coverage percentage	Email security console report	Valuation adjustment	Cyber DD vendor
DMARC enforcement status	DNS record and enforcement policy	Valuation adjustment	Cyber DD vendor
Email-based incident history	Phishing and BEC attempt log with outcomes	Post-close fix	Cyber DD vendor

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving mail servers what to do with email that fails authentication checks, and enforcement status determines whether spoofed email actually gets blocked. A policy set to monitor-only blocks nothing. A policy set to reject is the enforcement level a deal team should look for on the DNS record itself.

Section 5: Data & Backup

A target’s backup posture determines how expensive a post-close ransomware event would be, which is why a working console is not an acceptable verification artifact on its own. Backup repositories are targeted in 96% of ransomware attacks and compromised 76% of the time, per CyberFortress’s ransomware research, citing Sophos’s State of Ransomware 2026 report, and organizations whose backups get compromised pay recovery costs roughly 8 times higher against a $1.7 million average total incident cost.

What to Verify

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
Data classification status	Data inventory with classification labels	Valuation adjustment	Cyber DD vendor
Backup test cadence and last test outcome	Restore-test log with dated results	Deal-killer if untested	Cyber DD vendor
Immutable or offline copy confirmation	Backup configuration diagram	Valuation adjustment	Cyber DD vendor
Documented RPO/RTO	Written recovery objectives	Post-close fix	Cyber DD vendor

A backup that has never been restore-tested is not a verified backup, per CyberFortress’s analysis. Despite 92% of organizations claiming to have backups, Kaseya’s research found that 31% fail to recover data when ransomware strikes, and 33% test infrequently or never at all.

Section 6: Compliance & Insurance

Compliance and insurance status are the two items a deal-team member can verify directly, without technical help, which is why this section splits between legal and the PortCo CFO. A cyber insurance policy’s retroactive date determines how far back coverage actually reaches, and reviewing a target’s claims history is one of the core steps in Marsh’s cyber insurance due diligence checklist, per Marsh’s cyber due diligence guidance.

What to Request

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
SOC 2 report status and date	Current SOC 2 report	Valuation adjustment	Deal-team legal
HIPAA posture, if handling healthcare data	HIPAA risk assessment documentation	Valuation adjustment	Deal-team legal
PCI status, if processing card payments	PCI attestation of compliance	Valuation adjustment	Deal-team legal
Cyber insurance attestation letter, dated within 12 months	Signed attestation letter from the carrier	Deal-killer if missing or stale	PortCo CFO

Cyber insurers increasingly require evidence of backup testing as a condition of coverage, per Kaseya’s analysis, which means a stale insurance attestation often signals a broader gap in Section 5’s backup verification too.

I had some network issues in my office. They showed up the same day and fix it. – Khotamsho I. on Yelp

Section 7: Third-Party & Supply Chain

Third-party risk is the section deal teams most often skip under time pressure, which is exactly why it belongs on a checklist instead of being left to memory. Verizon’s 2025 DBIR found that 30% of breaches involved a third party, up from 15% the prior year, per DeepStrike’s third-party research. That risk transfers with the acquisition whether or not the deal team asked about it.

What to Request

Checklist Item	Verification Artifact to Request	Deal-Impact Rating	Section Owner
Full vendor inventory	Exported vendor list with access levels	Valuation adjustment	Cyber DD vendor
SOC 2 letters for key vendors	Vendor compliance letters	Post-close fix	Cyber DD vendor
Supply-chain risk assessment	Documented risk assessment or equivalent	Post-close fix	Cyber DD vendor

Pre-Close Hard Stops: When to Escalate to the Deal Team

Three thresholds tell a deal team when to escalate before signing, drawn from the sections above:

1. No undisclosed material breach in the trailing 36 months (Section 1).
   
2. A cyber insurance attestation letter dated within 12 months (Section 6).
   
3. EDR coverage above 85% of endpoints (Section 4).
   

If any of the three fail, escalate to the deal team before close. TechProComp’s accelerated cyber due diligence engagement executes Sections 1 through 7 against a live target in 10 business days. Once a deal clears these hard stops, the next step is the 90-day post-acquisition integration plan.

Frequently Asked Questions

What should be on a cyber due diligence checklist?

A cyber due diligence checklist should cover seven areas: breach history and disclosed incidents, external attack surface, identity and access, endpoint and email controls, data and backup practices, compliance and insurance, and third-party and supply chain risk. Each item needs a specific verification artifact to request, such as a breach disclosure log or a cyber insurance attestation letter, plus a deal-impact rating showing whether a gap is a deal-killer, a valuation adjustment, or a post-close fix.

What documents do you need for cyber due diligence?

A cyber due diligence review needs a breach disclosure log covering the trailing 36 months, external attack surface scan output, a privileged-account inventory with MFA coverage percentage, EDR and email filtering coverage reports, backup test results with the most recent restore-test outcome, a SOC 2 report, a cyber insurance attestation letter dated within 12 months, and a full third-party vendor inventory. Request the underlying artifact itself, not a verbal summary.

What cyber issues can kill an M&A deal?

An undisclosed material breach discovered after signing is the clearest deal-killer on a cyber due diligence checklist, since it means the seller misrepresented the target’s security posture during negotiations. A cyber finding does not have to be that severe to move a deal, though. When Verizon acquired Yahoo, disclosed data breaches cut $350 million off the purchase price without killing the deal outright, which is why most findings sort into a valuation adjustment or a post-close fix instead.

How do you scope a cyber DD engagement?

Scope a cyber due diligence engagement around the same 7 sections a deal team uses to request evidence: breach history, external attack surface, identity and access, endpoint and email, data and backup, compliance and insurance, and third-party risk. Assign section ownership up front: deal-team legal on breach history and compliance, the cyber DD vendor on the technical sections, and the PortCo CFO on the insurance attestation, a split that Petersen Landis’s 9-phase model also uses for its technical and legal review phases.

What is the difference between IT DD and cyber DD?

IT due diligence asks whether the target’s technology works and fits with the buyer’s systems, covering infrastructure inventory, licensing, technical debt, and integration compatibility. Cyber due diligence asks a different question: has the technology already been compromised, and can it be, before the buyer owns it. That distinction, posture versus fit, means cyber due diligence anticipates risk across the whole network, supply chain, and third-party relationships instead of only cataloging what exists.

Key Terminology

Endpoint Detection and Response (EDR): EDR is software that monitors endpoint devices like laptops and servers for suspicious activity and can isolate a compromised device automatically. It goes beyond traditional antivirus by watching behavior, not just known malware signatures. TechProComp’s 12-layer security framework includes EDR as one of its twelve monitored layers.

DMARC: DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving mail servers what to do with email that fails sender authentication checks. Enforcement status, not just DMARC’s presence, determines whether spoofed email actually gets blocked.

SOC 2: SOC 2 is a third-party audit of a company’s security controls, covering areas like access management and data handling. It is a certification, not a self-assessment, which is why Section 6 asks for the report and its date, not a verbal claim of compliance.

MFA (Multi-Factor Authentication): MFA requires a second verification step beyond a password, such as a one-time code or an approval push. Coverage below full privileged-account coverage is a specific, checkable gap, which is why Section 3 asks for the exact percentage.

RPO/RTO: RPO (Recovery Point Objective) is how much data a company can afford to lose, measured in time since the last backup. RTO (Recovery Time Objective) is how long systems can stay down before the cost becomes unacceptable. Section 5 asks for both figures documented, not estimated.

Download the 7-Section Cyber DD Checklist (Word + PDF) and use it as the data-room request list for your next cyber due diligence engagement. If the target’s timeline is already compressed, request a copy and a same-day scoping call about running an accelerated cyber DD engagement against a live target inside a standard deal timeline.

---