Data Security M&A Checklist: What Buyers Miss and Sellers Should Fix First
Data security M&A diligence means checking how a company protects its data before you buy it, keeping deal documents safe while you negotiate, and securing the combined systems after closing. Buyers look for past breaches, weak controls, unpatched systems, and privacy obligations they'd inherit. Sellers who fix those gaps first protect their price.
When you buy a company, you buy its hackers too. Not on purpose. Nobody lists "unknown intruder, been here since 2014" on the asset schedule. But if an attacker is already inside the target's network on closing day, congratulations, they now work for you. The good news is that most of this is findable before you sign, if someone actually looks.
TL;DR: Treat data security M&A work as part of the price, not a box on the legal checklist. Review breach history, controls, and old systems before the deal. Lock down the data room during it. Don't connect the networks until you've checked the target is clean. And if you're selling, fix the obvious gaps now, because the buyer's IT team will find them.
Why Data Security M&A Diligence Changes the Price
Two well-known deals show what's at stake.
Verizon and Yahoo. After Yahoo disclosed major data breaches, the two companies renegotiated. Their joint February 2017 announcement, filed with the SEC, said: "Under the amended terms, Verizon and Yahoo have agreed to reduce the price Verizon will pay to acquire Yahoo's operating business by $350 million." They also agreed to "share certain legal and regulatory liabilities arising from certain data breaches incurred by Yahoo."
Marriott and Starwood. According to Cybersecurity Dive's coverage of the UK regulator's fine, the "cyberattack was an intrusion made in 2014, on a server owned by Starwood Hotels," and "the compromised server was inherited by Marriott in its 2016 acquisition of Starwood." Marriott later determined "at least 339 million guest records were impacted," and the UK fine landed at £18.4 million.
Read that Marriott timeline again. The intrusion came with the company. One deal cut the price. The other inherited the problem. Due diligence is how you end up in the first story.
The Legal Side: What You Inherit
Your lawyers will handle this part, but a business owner should know the categories:
Industry privacy laws. HIPAA for health data, GLBA for financial data, and state privacy and breach laws all travel with the data.
Privacy policies. What the target promised its customers about their data is a binding commitment. You can't always use the data differently just because you own it now.
Breach notification obligations. If a breach happened before closing but is discovered after, the notification duty and cost may fall on you.
Contracts. Customer contracts may require specific security controls, audits, or notice of ownership changes.
Representations and warranties. The purchase agreement should include specific data security and privacy reps, with remedies if they turn out to be wrong.
The Data Security M&A Due Diligence Checklist
Here's what an IT security review of a target should cover. For a small or mid-sized deal, most of this can be done in two to four weeks with good access.
Breach and incident history
Any known breaches, ransomware events, or security incidents in the past five years
Whether notifications were required and sent
Cyber insurance claims and current coverage
Policies and governance
Written information security program, incident response plan, and acceptable use policy
Who is responsible for security, internally or through an MSP
Recent risk assessments, audits, or penetration tests, and what was found
Access and identity
Is MFA enforced for email, remote access, and admin accounts?
How many admin accounts exist, and who holds them?
Are former employees still active?
Systems and patching
Inventory of servers, devices, and software, with versions
Anything past end-of-life
Patch status and how it's tracked
Data and backups
Where sensitive data lives, and how much of it there is
Encryption at rest and in transit
Backup design, offsite or immutable copies, and the date of the last successful restore test
Vendors and third parties
Which vendors have access to systems or data
Contracts, BAAs, and security terms with those vendors
Check Whether Someone Is Already Inside
Paperwork tells you how a company says it runs. A compromise assessment tells you what's actually happening.
Before closing, or at least before connecting networks, consider having the target's environment checked for signs of active compromise: unusual admin accounts, suspicious sign-ins, persistence on servers, odd outbound traffic, and endpoint alerts nobody investigated. If the target already runs endpoint detection and response, review its alert history. If it doesn't, deploying it temporarily is often worth the cost. Marriott's lesson is that an attacker can sit quietly for years.
Keep the Deal Itself Secure
The transaction creates its own risks:
Use a proper virtual data room with per-user access, watermarking, download controls, and audit logs. Not a shared folder with a link anyone can forward.
Expect deal-related phishing. Attackers watch for announced deals and send fake wire instructions. Verify every payment change by phone, using a number you already had.
Limit who knows. Deal teams should be small, with MFA on every account involved.
Don't Connect the Networks on Day One
The fastest way to spread a hidden problem is to plug the target straight into your network the day the deal closes.
Integrate in stages instead:
Keep networks separate at first, with controlled access between them.
Bring the target's devices up to your security baseline: MFA, endpoint protection, patching, encryption.
Reset privileged credentials and remove accounts you don't recognize.
Migrate users and data in waves, after each group passes your checks.
Retire the target's old systems once data is moved and retained as required.
Slower than flipping a switch. Much faster than recovering from ransomware that came bundled with the purchase.
The Old Servers You're About to Own
There's a pattern that shows up in almost every small-business acquisition. The target is running a Windows Server, or a core business app, that's past its end-of-life date. It works fine. It's been working fine for years. It also hasn't received a security patch since support ended, and it won't ever again.
End-of-life systems don't fail the day support ends. They keep running, quietly collecting unpatched holes, until one of them gets used. In diligence, list every system past its end-of-life date and price the replacement into the deal. Planned upgrades are cheap. Emergency ones are not.
Find Out Who Holds the Keys
Here's my one strong opinion. A company should always own and have direct access to its own domains, admin accounts, and backups. In M&A, that turns into a very practical question: who actually controls the target's systems?
Small companies often rely on an outside IT provider who registered the domain, holds the only global admin account, and runs backups under its own account. If that provider is unhappy about losing the client after the sale, you could close the deal and still not control the email. Make "full admin credentials and ownership of domains, tenants, and backup accounts transferred to the company" a closing condition, not a post-closing favor.
If You're Selling: Fix These Before the Buyer Looks
Sellers have more control here than they think. Six months before going to market:
Turn on MFA everywhere and document it
Replace end-of-life systems, or at least have a dated plan
Get admin accounts, domains, and backups into the company's name
Run a cybersecurity risk assessment and fix the top findings
Test a backup restore and keep the evidence
Write down your security program, even if it's short
A clean IT review won't raise your price by itself. A messy one will absolutely lower it, or add escrow and holdbacks you didn't plan on.
When You Don't Need Us for This
Honestly, not every deal needs an outside IT review.
You're buying a tiny business with a few laptops and cloud email. A checklist review with your lawyer, plus a reset of every password and MFA on day one, may be enough.
Your company has a security team with M&A experience. Let them run it.
Where outside help pays off: targets with on-site servers, regulated data, an outsourced IT provider holding the keys, or a deal timeline that doesn't leave your team room to dig. That's where IT consulting and a virtual CISO can give you a clear picture fast.
Straight Answers About Data Security in M&A
What is cybersecurity due diligence in M&A?
It's a review of a target company's security controls, breach history, systems, data, and vendors before a deal closes, so the buyer understands the risk it's inheriting and can reflect it in price and terms.
Why is data security important in M&A?
Because the buyer inherits the target's data, obligations, and any undiscovered breaches. Verizon reduced its Yahoo price by $350 million after Yahoo's breaches, and Marriott inherited an intrusion that began in Starwood's systems before the acquisition.
When should data security due diligence start?
As early as possible, ideally alongside financial and legal diligence. Waiting until after signing leaves fewer options to adjust price or terms.
Who is responsible for a breach discovered after closing?
It depends on the purchase agreement. Specific data security representations, indemnities, escrows, and insurance determine who pays. Talk to your M&A attorney.
Should we integrate IT systems immediately after closing?
No. Connect networks in stages, after the target's systems meet your security baseline and have been checked for signs of compromise.
Still Stuck? Give Us a Call
If you're buying or selling a business and want a straight read on the data security side of the deal, give us a call at 410-703-3857 or send us a note. We support companies across Maryland, Virginia, and Washington DC.
We can't help you negotiate the price. We can make sure nobody else is quietly attending the closing.
Comments