M&A Cyber Due Diligence Questionnaire
Put the right cyber questions to an acquisition target before you sign — incidents, privileged access, backups, regulatory exposure and more — score the answers, and generate a red-flag report the deal team can act on.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- 35 diligence questions across 14 areas: governance, past incidents, regulatory exposure, identity, vulnerabilities, cloud, AppSec, third parties, data, backups, team, insurance, source code and litigation.
- Each question says what good looks like and which evidence to request, so the answers are tested rather than taken on trust.
- "Not disclosed" counts against the score: an unanswered question on a material area is a red flag in its own right.
- The generated report lists every material red flag for the deal team and counsel to turn into remediation, price, indemnity or escrow.
Frequently asked questions
When should cyber due diligence happen in a deal?
Before signing, while price and terms can still move. Findings discovered after signing usually land in the integration budget rather than the purchase agreement. Start with an outside-in review at screening and run the full questionnaire in confirmatory diligence.
What counts as a cyber red flag in M&A?
Anything material that is unsafe, unknown or undisclosed: an incident the target did not report, uncontrolled privileged access, backups an attacker could encrypt, exploitable internet-facing systems, or questions the target will not answer. This template marks a "bad" answer on a material item as a red flag automatically.
Can I use the report in the purchase agreement?
Use it to brief counsel and your deal advisers, who decide how findings are reflected in warranties, disclosure schedules, indemnities and price. The report is a structured starting point, not legal or investment advice.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.