Post-Close Compromise Assessment Plan
Assume the company you just bought is already compromised, and prove otherwise before you connect it: scope, telemetry, hunt hypotheses, tooling, network-connection criteria and reporting in one plan.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- 33 plan items across scoping, telemetry, hunt hypotheses, tooling, network-connection criteria and reporting.
- Hunt hypotheses cover persistence, credential theft, lateral movement, exfiltration, dormant implants and backdoor accounts, rogue cloud identities, OAuth app grants and mailbox rules.
- A "Finding" on a material hypothesis is flagged red and blocks the network-connection gate until it is remediated and verified.
- A findings log tracks each issue from open to verified closed, ready for the integration office and counsel.
Frequently asked questions
What is a compromise assessment in M&A?
A time-boxed, assume-breach investigation of an acquired environment that looks for evidence of current or past attacker activity — implants, stolen credentials, backdoor accounts, data theft — before that environment is trusted or connected to the acquirer's network.
How long should the look-back window be?
As long as the available logs allow, ideally six to twelve months. Many targets retain identity and cloud logs for only 30–90 days; record that limit, because "no evidence of compromise" only holds for the window you could actually see.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.