1. Define the purchase-price question
Translate the investment case into testable cyber claims, loss pathways and decision thresholds.
The cyber diligence team should reconcile investment case, transaction perimeter, risk appetite, forecasts and financing. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber diligence mandate.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
2. Map the digital perimeter
Identify entities, networks, clouds, applications, data, operational technology, products and third parties.
The cyber diligence team should reconcile architecture, asset inventories, contracts, discovery scans and interviews. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a transaction cyber map.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
3. Establish evidence integrity
Preserve sources, dates, versions, scope, custody and limitations for every material conclusion.
The cyber diligence team should reconcile native exports, logs, repositories, attestations, workpapers and approvals. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is an evidence-control register.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
4. Classify critical assets
Rank systems, data, identities, operations and services by revenue, safety, legal and continuity impact.
The cyber diligence team should reconcile business impact analyses, service maps, contracts, data inventories and operations. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a critical-asset schedule.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
5. Assess governance
Test board oversight, management ownership, risk appetite, policies, funding and independent challenge.
The cyber diligence team should reconcile charters, minutes, policies, budgets, risk registers and reporting. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber-governance assessment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
6. Reconcile the control framework
Map target practices to an appropriate framework and distinguish design from operating effectiveness.
The cyber diligence team should reconcile control matrices, configurations, samples, tests and exceptions. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a control-effectiveness profile.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
7. Test identity and privileged access
Review joiners, movers, leavers, administrators, service accounts, MFA, secrets and segregation.
The cyber diligence team should reconcile directories, access reviews, vaults, logs, samples and penetration tests. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is an identity-risk assessment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
8. Test vulnerability management
Measure discovery, prioritisation, patching, exceptions, exposure and validation across assets.
The cyber diligence team should reconcile scanners, tickets, inventories, threat intelligence, SLAs and retests. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a vulnerability-ageing analysis.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
Table 1. Cyber evidence architecture
| Layer | Primary evidence | Decision use |
|---|---|---|
| assets | inventory and ownership | perimeter |
| controls | configuration and tests | effectiveness |
| incidents | forensics and notices | legacy loss |
| commercial | contracts and revenue | value exposure |
Illustrative programme design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require company-specific evidence.
9. Test cloud security
Assess account structure, configuration, logging, encryption, network controls, resilience and ownership.
The cyber diligence team should reconcile cloud posture exports, architecture, keys, logs, backups and tests. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cloud-control report.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
10. Test application security
Review secure development, code review, dependencies, secrets, testing and release gates.
The cyber diligence team should reconcile repositories, pipelines, SBOMs, scans, defects, releases and exceptions. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is an application-security dossier.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
11. Test product security
Assess security by design, customer-facing attack surface, update mechanisms and vulnerability disclosure.
The cyber diligence team should reconcile product architecture, threat models, tests, advisories, telemetry and customer terms. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a product-security assessment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
12. Test data protection
Trace sensitive data, lawful use, minimisation, access, retention, deletion, transfer and breach exposure.
The cyber diligence team should reconcile data maps, records of processing, DPIAs, contracts, logs and request evidence. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a data-protection risk map.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
13. Test infrastructure resilience
Assess segmentation, hardening, capacity, redundancy, backup, recovery and single points of failure.
The cyber diligence team should reconcile network diagrams, configurations, backups, recovery tests and incident records. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a resilience-control report.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
14. Test operational technology
Map safety-critical, industrial and building systems, remote access, segmentation and recovery constraints.
The cyber diligence team should reconcile OT inventories, diagrams, vendor access, configurations, tests and safety analysis. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is an OT cyber assessment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
15. Assess third-party risk
Measure inherited exposure from clouds, software, managed services, suppliers and critical subcontractors.
The cyber diligence team should reconcile vendor register, contracts, assessments, incidents, dependencies and exit plans. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a third-party concentration map.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
16. Reconstruct incident history
Identify known and suspected events, root causes, persistence, disclosure, claims and remediation.
The cyber diligence team should reconcile incident registers, forensic reports, notices, insurance files, tickets and legal advice. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber incident chronology.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
Table 2. Incident-loss stack
| Loss layer | Evidence | Model output |
|---|---|---|
| response | forensic and legal cost | cash need |
| interruption | downtime and recovery | lost contribution |
| claims | contracts and notices | tail exposure |
| insurance | policy and consent | recoverability |
Illustrative programme design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require company-specific evidence.
17. Search for undisclosed compromise
Use threat-led testing and forensic indicators to test whether the environment remains breached.
The cyber diligence team should reconcile endpoint, identity, network and cloud telemetry, threat hunting and forensic analysis. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a compromise assessment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
18. Test detection capability
Evaluate coverage, telemetry quality, use cases, alert fidelity, staffing and escalation.
The cyber diligence team should reconcile SIEM data, rules, alerts, cases, coverage maps and response metrics. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a detection-effectiveness report.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
19. Test incident response
Assess authority, playbooks, communications, forensics, containment, eradication and lessons learned.
The cyber diligence team should reconcile plans, exercises, incidents, call trees, retainers and remediation evidence. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is an incident-response assessment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
20. Test recovery capability
Verify immutable backups, restoration, alternate operations, recovery objectives and dependency order.
The cyber diligence team should reconcile backup configuration, restore tests, continuity plans, exercises and outages. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a recovery-readiness report.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
21. Assess regulatory exposure
Map notification, security, resilience, recordkeeping and sector obligations across jurisdictions.
The cyber diligence team should reconcile legal-entity map, regulatory inventory, filings, correspondence and legal analysis. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber obligations matrix.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
22. Assess litigation and claims
Identify threatened or actual customer, employee, shareholder, regulator and contractual exposure.
The cyber diligence team should reconcile claims register, notices, legal advice, settlements, correspondence and reserves. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber claims schedule.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
23. Assess insurance recoverability
Test policy scope, exclusions, sublimits, retentions, notice, consent and change-of-control effects.
The cyber diligence team should reconcile policies, applications, notices, broker advice, claims and endorsements. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is an insurance-recovery analysis.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
24. Quantify direct remediation
Cost priority fixes across identity, vulnerabilities, cloud, applications, data, monitoring and recovery.
The cyber diligence team should reconcile gap register, designs, estimates, vendor quotes, staffing and dependencies. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber remediation budget.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
Table 3. Remediation priorities
| Control | Failure signal | Immediate action |
|---|---|---|
| identity | orphaned privilege | contain access |
| exposure | critical open flaw | patch or isolate |
| detection | material blind spot | restore telemetry |
| recovery | failed restore | rebuild resilience |
Illustrative programme design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require company-specific evidence.
25. Quantify incident loss
Model response, restoration, interruption, notification, legal, regulatory, customer and insurance cash flows.
The cyber diligence team should reconcile incident history, contracts, operations, policies, scenarios and expert estimates. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber loss model.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
26. Quantify revenue exposure
Connect outages, trust loss, contractual rights, churn and sales delay to product and customer cohorts.
The cyber diligence team should reconcile contracts, revenue, cohorts, service dependencies, pipeline and scenarios. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber revenue-at-risk bridge.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
27. Quantify margin and capex impact
Translate security operating cost, technical debt, resilience investment and insurance into forecasts.
The cyber diligence team should reconcile budgets, headcount, vendor spend, remediation, capex and forecasts. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber forecast adjustment.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
28. Assess financing impact
Test covenant headroom, liquidity, insurance proceeds, disclosure and lender protections under downside.
The cyber diligence team should reconcile debt documents, cash model, scenarios, policies, disclosures and lender terms. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber debt-capacity stress test.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
29. Translate risk into valuation
Adjust cash flows, capital needs, terminal assumptions and risk for verified cyber findings.
The cyber diligence team should reconcile valuation model, loss scenarios, remediation, revenue exposure and market evidence. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber value bridge.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
30. Set materiality thresholds
Define decision rules for price, disclosure, condition, covenant, indemnity and escalation.
The cyber diligence team should reconcile risk appetite, valuation, law, financing, insurance and governing approvals. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber materiality matrix.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
31. Design price adjustments
Use remediation cost, expected loss, revenue risk and capital timing without double counting.
The cyber diligence team should reconcile valuation bridge, loss model, forecasts, synergies and transaction mechanics. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber price bridge.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
32. Design warranties
Convert verified facts and evidence limitations into precise security, incident, data and compliance statements.
The cyber diligence team should reconcile diligence record, disclosure letter, legal drafting and negotiation. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber warranty schedule.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
Table 4. Price and protection map
| Finding | Economic treatment | Document response |
|---|---|---|
| known fix | cost and timing | price or covenant |
| legacy incident | expected tail loss | indemnity and escrow |
| revenue risk | forecast adjustment | price mechanism |
| uncertain exposure | downside range | condition or holdback |
Illustrative programme design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require company-specific evidence.
33. Design indemnities and escrows
Allocate identified legacy events, investigations, claims and control failures through tailored recourse.
The cyber diligence team should reconcile risk register, loss model, legal drafting, insurance and credit analysis. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber recourse matrix.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
34. Design conditions and covenants
Require critical remediation, notifications, access controls, insurance or evidence before and after close.
The cyber diligence team should reconcile gap register, closing plan, legal documents, owners and validation tests. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber conditions schedule.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
35. Plan Day-One control
Protect privileged access, connectivity, data flows, monitoring, incident authority and communications.
The cyber diligence team should reconcile integration plan, access map, playbooks, TSA, approvals and testing. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a Day-One cyber control plan.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
36. Plan secure integration
Sequence identity, network, cloud, tooling, data and product integration against verified dependencies.
The cyber diligence team should reconcile target architecture, migration waves, controls, testing, budgets and rollback plans. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a secure integration roadmap.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
37. Build the one-hundred-day plan
Assign remediation, monitoring, governance, insurance, customer and board actions with milestones.
The cyber diligence team should reconcile gap register, owners, budget, dependencies, dates and reporting. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber value-protection plan.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
38. Define residual-risk acceptance
Record remaining exposure, compensating controls, time limits, authority and monitoring.
The cyber diligence team should reconcile risk register, remediation plan, tests, advice and approvals. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a residual-risk decision record.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
39. Monitor value protection
Track remediation, incidents, exposure, recovery, insurance and commercial outcomes after close.
The cyber diligence team should reconcile dashboards, tests, claims, customer metrics, budgets and board reporting. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cyber value-control system.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
40. Issue the transaction conclusion
State verified posture, loss exposure, forecast effects, price, protections and operating conditions.
The cyber diligence team should reconcile reconciled evidence, expert advice, transaction documents and approvals. Each conclusion records the accountable owner, source, scope, assessment date, evidence, economic consequence, control and unresolved exception. The immediate output is a cybersecurity transaction certificate.
Cyber resilience must be proved through native technical, operational and commercial evidence. Reviewers test governance, exposure, prevention, detection, response, recovery and downside against observed performance. The transaction perimeter, asset criticality, contractual rights, regulatory duties and applicable law control each conclusion.
Material gaps require an owner, containment, corrective action, validation test, budget, advice and decision date. Consequences flow through operations, customers, cash, financing, insurance, valuation, disclosure and transaction protection. Residual risk remains visible until evidence is reconciled, remedies are executable and authorised decision-makers approve the next gate.
Table 5. Transaction cyber certificate
| Dimension | Required conclusion | Evidence |
|---|---|---|
| posture | controls tested | native records and samples |
| loss | cash and tail modelled | incidents and scenarios |
| value | forecast risk adjusted | valuation bridge |
| control | remedies funded and governed | documents and operating plan |
Illustrative programme design; company-specific facts and authorised advice govern.
Values are illustrative readiness indices and require company-specific evidence.
References
- National Institute of Standards and Technology, Cybersecurity Framework 2.0, https://doi.org/10.6028/NIST.CSWP.29
- National Institute of Standards and Technology, CSF 2.0 Quick-Start Guides, https://www.nist.gov/cyberframework/quick-start-guides
- National Institute of Standards and Technology, Secure Software Development Framework, https://doi.org/10.6028/NIST.SP.800-218
- National Institute of Standards and Technology, Computer Security Incident Handling Guide, https://doi.org/10.6028/NIST.SP.800-61r2
- National Institute of Standards and Technology, Contingency Planning Guide for Federal Information Systems, https://doi.org/10.6028/NIST.SP.800-34r1
- National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations, https://doi.org/10.6028/NIST.SP.800-53r5
- Cybersecurity and Infrastructure Security Agency, Secure by Design, https://www.cisa.gov/securebydesign
- Cybersecurity and Infrastructure Security Agency, Cross-Sector Cybersecurity Performance Goals, https://www.cisa.gov/cross-sector-cybersecurity-performance-goals
- Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- US Securities and Exchange Commission, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, https://www.sec.gov/rule-release/33-11216
- US Securities and Exchange Commission, Commission Statement and Guidance on Public Company Cybersecurity Disclosures, https://www.sec.gov/rules/interp/2018/33-10459.pdf
- European Union, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity, https://eur-lex.europa.eu/eli/dir/2022/2555/oj
- European Union, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, https://eur-lex.europa.eu/eli/reg/2022/2554/oj
- European Union Agency for Cybersecurity, Threat Landscape, https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025
- United Kingdom National Cyber Security Centre, Cyber Assessment Framework, https://www.ncsc.gov.uk/collection/caf
- United Kingdom National Cyber Security Centre, 10 Steps to Cyber Security, https://www.ncsc.gov.uk/collection/10-steps
- United Kingdom Information Commissioner's Office, Personal data breaches, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/
- European Union, General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/oj
- International Organization for Standardization, ISO/IEC 27001 Information security management systems, https://www.iso.org/standard/27001
- International Organization for Standardization, ISO 22301 Business continuity management systems, https://www.iso.org/standard/75106.html
- Center for Internet Security, CIS Critical Security Controls Version 8, https://www.cisecurity.org/controls/v8
- MITRE, ATT&CK knowledge base, https://attack.mitre.org/
- FIRST, Common Vulnerability Scoring System Version 4.0, https://www.first.org/cvss/v4.0/
- IFRS Foundation, IAS 37 Provisions, Contingent Liabilities and Contingent Assets, https://www.ifrs.org/issued-standards/list-of-standards/ias-37-provisions-contingent-liabilities-and-contingent-assets/
- IFRS Foundation, IAS 36 Impairment of Assets, https://www.ifrs.org/issued-standards/list-of-standards/ias-36-impairment-of-assets/
- International Valuation Standards Council, IVS 200 Businesses and Business Interests, https://www.ivsc.org/standards/
