Despite these limitations, the acquirer needs to gather as much intel as possible, and the below is necessary to obtain:

The identity of all the target's key privacy and security players, including the CIO, the CPO, the IT directors, data privacy officers, and any other personnel identified in the Privacy and Cybersecurity Breach Response Protocol(s).
The target's privacy and security protocols, response plans, and actual practices.
The results of a complete forensic analysis of the target's computer and network systems.
Any previous privacy and security findings and recommendations, regardless of the source.
The terms of all third-party agreements involving the transfer, storage, and data security of personal information or other sensitive or confidential information such as trade secrets and financial information.
All publicly available information, including information on the dark web that indicates prior cybersecurity breaches.
A detailed analysis of legacy systems that may be acquired in the transaction and whether there is a need or ability for continued access.
A comprehensive legal analysis of relevant privacy and security issues.

Although perfect knowledge is not obtainable, knowing what constitutes complete knowledge can help an acquiring company evaluate the value of the information that it can gather and guide its post-acquisition practices. In other words, it can help it play the hand it is dealt. Moreover, efforts to identify prior cybersecurity breaches and potential vulnerabilities must continue post-acquisition. Therefore, the acquirer must develop a post-acquisition integration plan that focuses on privacy and security issues that, at a minimum, includes:

Engaging a forensic audit team to identify, collect, and review system log files from the target company and to complete data mapping efforts.
Continued retention, if practical, of key individuals responsible for cybersecurity from the target company.
A systematic and deliberate approach to systems integration that considers not only how but why systems should be integrated.
The continued engagement of counsel to advise on integration and privacy and security risks and obligations.

Card counting and hedging bets

Perhaps the best way to enhance the odds for a lower-risk acquisition is to retain an independent monitor and counsel to conduct a complete assessment and forensic analysis of the target's computer systems and networks as well as its privacy and security programs and prepare a report of findings and recommendations (if any). This approach offers many advantages. It obviates any risk that the target may later be accused of misrepresentations or concealment. It assures the acquiring party that it is not being dealt low-value cards when there is a lot of money on the table. Having such an independent assessment even before any negotiations occur will also facilitate the sale of a company that plans to put either itself or a division on the market. Indeed, a good report may enhance the ultimate sales price.

Special Reports /

Cybersecurity & due diligence: Avoiding liability for someone else's mistakes

Related Stories

Recommended For You