Sign-to-Close Breach Scenario
The deal is signed, closing is weeks away, and the target finds an intruder. Make ten scored decisions — evidence, escalation, forensics, notification clocks, disclosure, delay, indemnity and the Day-1 connection — and export the debrief.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice. Subscribers customise it with their own details and generate the document for their own work.
What this template gives you
- Ten decisions a security lead faces when a target is breached between signing and closing, each scored 0–10 with specific feedback.
- Covers evidence preservation, who to tell, forensics engagement, regulatory notification clocks, formal disclosure, whether to delay close, price and indemnity, pre-close remediation, the Day-1 network decision and communications.
- Replace the sample company names with your own so the rehearsal and debrief reflect your deal.
- Ends with a score band — from "Deal protected" to "Deal in jeopardy" — and a debrief you can export to share with counsel and the deal team.
Frequently asked questions
What happens if a target is breached between signing and closing?
It depends on the purchase agreement: interim covenants, notice obligations, warranties brought down at closing and any closing conditions. Practically, the target runs its own response while the acquirer secures visibility through counsel, assesses the impact and negotiates protections such as a specific indemnity or escrow. This scenario rehearses those decisions; it is not legal advice.
Should we delay closing after a breach is discovered?
That is a commercial and legal decision for the deal team and counsel. Security's job is to give them an honest picture of what is known, what is not, when it will be known and the worst case — and to make sure the networks are not connected until the environment is shown to be clean.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
The page and sample are public. Customising the template with your own details and exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan. Your work is saved in your own browser.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.