All tabletop exercises
M&A·Intermediate·Executive audience
Due diligence finds the target was breached
The prompt — read this to the room
Your company is six weeks from signing an agreement to buy a 300-person payments start-up. During security due diligence your team finds credentials for the target's production cloud account for sale on a criminal marketplace, dated four months ago. The founders say they had 'a minor incident' that was handled and that no notifications were needed. Their logs only go back 30 days. The deal team wants a recommendation this week: walk away, reprice, add protections in the agreement, or demand an independent investigation first.
Total duration
2 h
People to involve
6
Best fit
Finance, Saas
Who to involve
Most important first.
- CISO / Head of security
- CEO / Managing director
- CFO / Finance
- Legal counsel
- Board member
- Privacy officer / DPO
What it tests
- Turn a security finding into a deal recommendation the deal team and board can act on
- Decide what further evidence is needed and how to get it without breaching the confidentiality agreement
- Translate technical risk into deal terms: price, indemnity, escrow, conditions, representations
- Assess whether the target missed notification duties that the buyer would inherit
Outline of activities
- 1The finding and how sure the team is about it
- 2The target responds: interviews, documents and gaps
- 3What could have happened in the 90 days nobody can see
- 4Options for the deal and what each one costs
- 5The recommendation to the board
- 6Debrief: building security into the diligence checklist
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…