Cyber Due Diligence and Building Security after an Acquisition or Carve-out

A Cyber Due Diligence is the assessment of a target company's information security before an acquisition or investment, as a workstream of its own alongside financial, legal and tax due diligence. It shows which security risks affect the purchase price and the integration. We assess the target against ISO 27001, BSI IT-Grundschutz or your own framework and classify each finding as a deal-blocker, an immediate post-closing measure or a medium-term need. The result is a report for your investment committee.

Cybersecurity risks are often only superficially covered in a standard IT due diligence. A dedicated cyber due diligence systematically evaluates the target's security posture, uncovers compliance gaps, and identifies risks that affect transaction value. The result is a qualified, independent opinion that feeds directly into your investment decision.

Depending on the target company and industry, assessments are conducted per ISO 27001/27002, BSI IT-Grundschutz, DIN SPEC 27076, or NIST CSF. We can also assess against your own investment framework. The methodology is jointly defined during scoping.

The report contains an overall assessment of the cyber risk situation, all identified findings with M&A-specific prioritization (deal-blockers, immediate post-closing measures, medium-term needs), an estimate of required investment, and concrete recommendations. Visually presented with traffic light systems and spider charts.

Missing or outdated security policies, inadequate access controls, dependencies on single IT service providers, missing contingency plans, license transfer risks at change of ownership, compliance gaps with NIS-2 or GDPR, and untested backups. The auditor's experience is critical to properly contextualizing these risks for M&A.

Yes. For investors and corporate groups with high transaction frequency, we offer a standardized process that delivers reproducible results across the entire portfolio. This makes assessments of different targets directly comparable.

Our vCISO on a fixed-term basis or an Interim CISO takes over implementation of the prioritised measures. They stabilise the acquired company's information security and steer the information security part of post-merger integration until the role is filled internally or handed over to your group function.

As long as nobody there is named, the gap sits within your scope. We fill the CISO role in the acquired company as a vCISO on a fixed-term basis or as Interim CISO and bring it up to your requirements. The mandate is time-limited and ends with an end state agreed in advance: the role is filled internally or handed over to your group function.

Its own ISMS, with its own policies, incident process and evidence. When the Transitional Service Agreement expires, the parent's services stop, and that date is fixed in the contract. We fill the CISO role and derive the ISMS from the documents that already exist, such as the parent's contracts, network plans and process descriptions, so that it is in place and evidenced by the cut-off date.