Inherited Breach Due-Diligence Checklist
Thirty due-diligence questions that surface past and ongoing breaches at an acquisition target: incident register, notification and regulator history, insurance claims, dark-web exposure, compromise assessment, IR maturity and litigation. Red flags are weighted, and the record ends with a risk rating and a suggested deal action.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Due-diligence questions to uncover past and ongoing breaches at an acquisition target: the incident register, notification and regulator history, cyber insurance claims, dark-web exposure, compromise assessment, IR plan maturity and open litigation. Mark each answer Clear, Some concern or Red flag. Material questions weigh triple, so a red flag on a notification gap or a dark-web access sale moves the rating more than a missing policy document. The record ends with an inherited-breach risk rating and a suggested deal action.
- Describe every incident that involved personal data, ransomware or extortion, payment fraud, or loss of a key system for more than 24 hours
- Provide the cyber insurance claims history: every claim or notice of circumstances, outcome and amounts paid
- Search leak sites, forums and paste sites for the target's domains, brand, data and executive names
- Ask whether an independent compromise assessment has been done in the last 12 months, and get the report
Your context
Incident history and register
Start with what the target already knows. A company with no recorded incidents is usually a company that is not looking, not one that has never been breached.
Provide the security incident register for the last 3–5 years: date, type, systems and data affected, severity, root cause and statusmaterial
Describe every incident that involved personal data, ransomware or extortion, payment fraud, or loss of a key system for more than 24 hoursmaterial
Confirm whether any incident, investigation or suspicious activity is open or unresolved todaymaterial
Share near misses and blocked attacks that triggered an internal escalation (for example a stopped payment fraud or a contained phishing compromise)
List supplier or SaaS breaches that affected the target's data or access in the last 3 years
Notification and regulator history
Past notifications tell you what the target judged reportable. Missing notifications are an inherited liability.
List every breach notification made to a regulator or supervisory authority, with dates and reference numbersGDPR Art. 33material
Provide copies of notifications sent to affected individuals and customers, and the decision record where the target chose not to notify
Disclose all correspondence with regulators about security or privacy: inquiries, audits, undertakings, fines or open investigationsmaterial
Confirm whether any customer contract notice obligations were triggered and met
Cyber insurance and claims
Provide the cyber insurance claims history: every claim or notice of circumstances, outcome and amounts paidmaterial
Share the latest insurance proposal form and the insurer's security questionnaire answers
Confirm what happens to the target's policy at change of control and whether run-off (tail) cover is available for pre-close events
Check exclusions and sub-limits that matter for this target (ransomware, war, infrastructure, prior known circumstances)
External exposure and dark-web signals
Outside-in checks you can run before you get any access, ideally through a provider under NDA.
Search leak sites, forums and paste sites for the target's domains, brand, data and executive namesmaterial
Check infostealer logs and breach corpuses for target employee credentials, especially for VPN, SSO and admin portals
Review the external attack surface: exposed remote access, unpatched edge devices, expired certificates, forgotten subdomains
Check whether target IP ranges or domains appear on blocklists or in threat-intelligence feeds as malicious infrastructure
Check email authentication (SPF, DKIM, DMARC) and recent spoofing or lookalike-domain reports
Compromise assessment and detection coverage
The question is not "have you been breached?" but "would you know?".
Ask whether an independent compromise assessment has been done in the last 12 months, and get the reportmaterial
Confirm EDR coverage across servers and endpoints, who watches the alerts and how fast they respond
Confirm what logs exist (identity, VPN, firewall, cloud, email) and how far back they go
List privileged accounts, service accounts and third-party remote access, with MFA status for each
Confirm backups are immutable or offline and that a full restore was tested in the last 12 months
Incident response plan maturity
Provide the incident response plan and playbooks, with the last review date and owner
Show evidence of a tabletop exercise or test in the last 12 months and the actions that came out of it
Confirm whether there is an IR retainer, external counsel and a crisis communications contact on call
Show how lessons from past incidents were closed (actions, owners, completion evidence)
Litigation, disputes and disclosures
Disclose open or threatened litigation, class actions or customer claims linked to security or privacy incidentsmaterial
Confirm whether any ransom or extortion payment was made or negotiated, and through whommaterial
Make sure the agreement includes specific warranties on incidents, notifications and compliance, and that known issues are covered by a specific indemnity or escrow
Disclosed incidents tracker
One row per incident the target disclosed or you discovered. Use it to compare the register, the notifications and the insurance claims.
What this template gives you
- Buying a company means buying its breaches, including the ones nobody has found yet.
- The checklist asks for evidence, not reassurance: the incident register, the notifications actually sent, the insurance claims file, an outside-in dark-web check and a compromise assessment.
- Material questions weigh triple. Two material red flags, or a possibly active incident in the tracker, rate the target High and suggest protection before close.
- Cross-check the three sources (register, notifications, insurance claims) in the tracker: incidents that appear in one but not the others are where inherited liability hides.
Frequently asked questions
How do you find out whether an acquisition target has been breached?
Ask for documents rather than answers: the incident register, regulator notifications and correspondence, the cyber insurance claims history and the latest compromise assessment. Then check from the outside: leak sites, access-broker forums and infostealer logs. Where the evidence is thin or contradictory, negotiate an independent compromise assessment before closing or immediately after.
What counts as a red flag in cyber due diligence?
An open or unexplained incident, an incident with no matching notification, insurance claims that are not in the incident register, credentials or network access offered for sale, shared admin accounts without MFA, and logs too short to show when an attacker arrived. Each one is a reason to verify and to seek specific contractual protection.
Does warranty-and-indemnity insurance cover a known breach?
Usually not. Matters disclosed or known before signing are typically excluded from W&I cover and general warranties. Known issues normally need a specific indemnity, escrow or holdback. Confirm the position with deal counsel.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.