CyberDue Diligence
Understand the cyber risk in a merger or acquisition before the deal is done. CyberQ Group assesses the target organisation’s assets, vulnerabilities, threats, policies and people, then brings everything together in one clear report with actionable remediation strategies.
Make informed decisions aboutthe business you’re acquiring.
What is Cyber Due Diligence?
A structured assessment of a target organisation’s cyber security during a merger or acquisition. We start by understanding the objectives of the deal, both companies and the assets at risk, then examine the target in depth to give you an overarching view of its cyber security posture, compliance and associated risks.
Why cyber due diligencematters.
Vulnerabilities, past incidents, policy gaps and human error in a target organisation can all jeopardise the success of a merger or acquisition.
Cyber Due Diligence exposes the areas that need immediate attention and translates technical and legal assessments into actionable business intelligence, so you can navigate the deal securely and confidently.
Seven phases,one clear picture.
01
Initial assessment & scoping
We meet your team to understand the deal’s objectives, then agree the scope, project plan and initial risk profile.
02
Inventory assessment
We catalogue the target’s hardware, software, data and intellectual property, and map the risk attached to each asset.
03
Vulnerability assessment
We scan networks, applications and systems for weaknesses attackers could exploit, ranked by severity.
04
Threat analysis
We look for signs of past or ongoing incidents, breaches and compromises to reveal real-world risk.
05
Policy & procedure review
We review security policies, procedures and compliance against best practice and regulations such as GDPR.
06
Human factors
We assess cyber security awareness among employees and third-party vendors, and how well training works.
07
Final report & recommendations
We bring every finding together in one report, with a risk matrix and a remediation plan tailored to you.
What youreceive.
Scope & project plan
A defined scope, project plan, initial risk profile and stakeholder map to set up the engagement.
Asset inventory & risk map
A full catalogue of hardware, software, data and IP, with a risk profile and access control matrix.
Vulnerability & threat reports
Vulnerabilities ranked in a severity matrix, plus an incident timeline and threat landscape overview.
Gap analysis & compliance status
Where policies fall short of best practice or regulatory requirements, and how to close the gaps.
Awareness & third-party risk
How aware staff and vendors are, how well training works and the risk third parties pose, with an action plan.
Final report & remediation plan
A comprehensive report, risk matrix and remediation roadmap with estimated costs, timelines and action checklists.
Every phase also includes an executive summary written for the C-suite.
What it means foryour deal.
Make well-informed decisions about the acquisition.
Negotiate better deal terms based on real findings.
Plan a secure and compliant integration after the deal.
What we’ll needfrom you.
Access to key people, from C-level executives and department heads to IT, security, legal and compliance staff
Business objectives for the merger or acquisition
Existing asset lists, network maps and organisational charts
Access to systems and networks for scanning and data collection
Previous audits, assessments, scan reports and incident logs
Security policies, procedures and compliance documentation
Lists of employees and third-party vendors with system access
How longdoes it take?
Every phase follows the same rhythm: preparation, data gathering, analysis, a review with your team, then finalisation.
Timelines are agreed during scoping and depend on the size and complexity of the organisation and the availability of your resources. Review points in each phase let you add context and give feedback before anything is finalised.
WhyCyberQ Group?
CyberQ Group was founded by experienced industry experts who understand the cyber challenge and what organisations need for enhanced cyber security.
Our core team brings over 100 years of combined industry and domain-specific experience, and we take a collaborative approach to working with every organisation on its cyber security requirements.
Related case study
How we workwith clients.
IT consulting and managed services
A full red team exercise that tested people, technology and leadership in one engagement.
What the work covered: Spear phishing simulation, penetration testing and a C-suite crisis simulation
The challenge
An award-winning IT consulting and managed services provider wanted to find and fix cyber risks before an attacker did. It needed testing that went beyond a standard vulnerability scan or penetration test and covered human factors as well as technical weaknesses.
The approach
CyberQ ran a multi-part red team exercise: targeted spear phishing simulations to test staff awareness, penetration testing to find technical vulnerabilities, and a C-suite cyber simulation to test how leadership would respond in a crisis.
The result
Findings were prioritised for remediation, the incident response plan was updated with lessons from the tabletop exercise, and the leadership team came away better able to make decisions during a cyber crisis.
3
attack angles tested in one exercise: people, technology and leadership
C-suite
crisis simulation alongside the technical testing
1
updated incident response plan, built on the exercise
AskQ Service Finder
Not sure where to start? AskQ.
Tell us what you want to achieve and we’ll match you to the right services in under a minute.
Get started
Talk to us aboutCyber Due Diligence.
Get in touch today to find out how we can keep your business secure.
Download service sheet
Emergency response
Under attack right now? Don’t fill in a form.
Call our incident responders and we’ll help you contain it and recover.
0800 0614 715
Send us a message
Tell us a little about your organisation and what you need. Fields marked * are required.