M&A cyber due diligence checklist (with AI)
Twelve areas a buyer, private equity sponsor or acquiring bank should check before signing, and what to do with what you find.
What belongs on an M&A cybersecurity due diligence checklist?
Twelve areas: identity and access, infrastructure and cloud, endpoints and email, backups and recovery, external attack surface, incident and breach history, cyber insurance, regulated data, AI inventory and dependence, AI data rights, AI claims versus reality, and a Day 1 / 100-day plan. Prime Tech Associates runs this as a one-week red-flag assessment or two-to-three-week full diligence, at a fixed fee scoped after an NDA call.
- Identity & access. MFA coverage, privileged and shared accounts, joiner/mover/leaver process, third-party and vendor access.
- Infrastructure & cloud. Asset inventory, unsupported systems, cloud configuration, network segmentation.
- Endpoints & email. EDR coverage, patch cadence, email authentication and phishing controls.
- Backups & recovery. Immutable or offline backups, restore testing evidence, recovery time for critical systems.
- External attack surface. Exposed services, leaked credentials, expired certificates, look-alike domains.
- Incident & breach history. Past incidents, notifications, ransom payments, open investigations, litigation.
- Cyber insurance. Current policy, claims history, exclusions, and whether controls attested on the application are real.
- Regulated data. HIPAA, financial-services, CMMC/NIST SP 800-171 and privacy obligations that follow the business.
- AI inventory & dependence. Which products and processes rely on AI, and on which vendors and models.
- AI data rights. Whether customer or patient data trained models, and under what contract terms.
- AI claims vs. reality. Whether the AI in the pitch deck is in the product and works as described.
- Day 1 & 100 days. Connectivity decisions, credential resets, TSA implications and the first-100-day security plan.
Turning findings into deal terms
Every finding should carry a remediation cost, time and deal impact, so the deal team can decide whether it belongs in price, reps and warranties, escrow, a closing condition or the 100-day plan.
Related: What a one-week red-flag assessment answers · Ten findings that should delay integration · Full M&A technology & cyber advisory.
Frequently asked questions
What should an M&A cybersecurity due diligence checklist cover?
Identity and MFA, privileged access, endpoints, email security, backups and recovery, external attack surface, incident and breach history, cyber insurance, regulated data (HIPAA, financial, CMMC), third-party access, and, increasingly, AI use, AI vendors and data rights.
How long does M&A cyber due diligence take?
Prime Tech Associates offers a red-flag assessment of about one week and full cyber and AI diligence of two to three weeks, scaled to complexity and data-room access.
How much does M&A cyber due diligence cost?
Prime Tech Associates quotes a fixed fee after an NDA call, based on the target’s size, complexity and the deal timeline.
What does AI due diligence add to cyber due diligence?
It checks which products and processes depend on AI and which AI vendors and models, whether customer or patient data was used to train models and under what terms, whether the AI described in the deck works as described, and AI governance maturity against NIST AI RMF and ISO/IEC 42001.
What deliverables should the deal team expect?
A red-flag summary for the investment committee, scored findings with remediation cost, time and deal impact, items to address in reps, warranties, escrow or price, and a Day 1 security and AI baseline with 100-day priorities.
Where to go next
AI Risk Assessment
Flat $5,000. Two to four weeks. Mapped to NIST AI RMF, ISO/IEC 42001, HIPAA and OWASP LLM Top 10.
Fractional AI Officer
Monthly retainer: $2,500, $4,500 or $7,500. 3-month minimum.
AI governance for banks & credit unions
AI inventory incl. vendor AI, third-party AI due diligence, board AI policy, examiner-ready evidence.
M&A cyber & AI due diligence
One-week red-flag or two-to-three-week full diligence. Fixed fee scoped after an NDA call.
Evaluating a target or already in exclusivity?
Start with a confidential call. We will sign an NDA, scope the work to your timeline and quote a fixed fee.