The prevalence of data breaches and their growing financial impacts make cybersecurity an important factor for any business. But it’s especially important for companies involved in or planning for an acquisition, merger, or initial public offering (IPO).
The added element of COVID-19 has made cybersecurity due diligence even more imperative. In today’s world of aggressive cybercrime, organizations of all sizes need to get smart, structured, and started with cybersecurity due diligence before transaction talks begin. Doing so could help:
Strengthen the value of assets being bought or sold
Facilitate smoother negotiations
Keep regulatory threats from doing operational or reputational damage before the deal is done
Reduce related financial impacts
Learn how the due diligence process can help your company reduce risk, build a culture of security, and approach a transaction with confidence.
Effects of a data breach
Security incidents and data breaches can hurt an organization in many ways, including:
Loss of consumer or client trust, damaged public reputation, and decreased profits
Increased costs spent combatting the breach and reinforcing infrastructure
Purchase price reductions
Shareholder lawsuits
Increased legal fees, including settlements for those individuals whose personal data was compromised and attorney fees managing the fallout
Delays in a transaction’s completion
Liabilities for prior unknown breaches or breaches occurring during or after the transition
To help mitigate or prevent these costs, organizations need to proactively approach their transaction preparation process and ask important questions about their cybercontrols. These questions include:
What controls do we currently have in place, and are they the right kind of controls for the changing nature of the business?
What are our current compliance obligations? How might they change?
What opportunities for breaches or new threats are created by this transaction on a human, application, equipment and process level?
What tests or audits of the cybercontrols have been completed? What were the results?
Increased cyberattacks due to COVID-19
Since the outbreak of the COVID-19 pandemic, the number of data breaches has drastically increased. Attackers have focused their efforts on exploiting personnel working from home or targeted systems due to reduced IT and security personnel monitoring their systems.
These breaches and security incidents increase the cyber-risk profile of a potential merger and acquisition (M&A) target.
The figures below show the following cybercrime trends since COVID-19 began:
There was a 300% increase in the number of reported cybercrimes in 2020, according to the Federal Bureau of Investigation.
52% of all breaches in the United States were due to failures at the access control layer — this includes credential theft, brute force login attempts, and phishing — according to the 2020 Phishing and Fraud Report from F5.
Learn more about how to improve your cybersecurity strategy and steps you can take to protect your remote workforce.
Why cybersecurity is critical
Often what’s being sought during an acquisition is a company’s data. Companies don’t just buy companies, they buy value — and the assets valued in an acquisition are the same ones that make it attractive to a hacker.
Attractive assets for hackers
Source code. Code that houses the building blocks of any proprietary software.
Proprietary information and systems. Databases that include trade secrets, business strategies, product designs, and even operational procedures.
Personally identifiable information (PII). Data that could identify a specific individual and can be used on its own or with other information to identify, contact, or locate a particular person.
Protected health information (PHI). Information about health status, provision of healthcare, or healthcare payments that can be linked to a specific individual.
Customer lists. A data set that may contain PII, contact information, proprietary research, financial information, or competitive analysis. This data is usually intended for internal use only.
A cybersecurity-aware company knows where critical assets reside and how safely they’re protected. This is achieved through implementing and consistently monitoring:
Policies and procedures. Security and related practices, including network infrastructure design, network perimeter protections, antimalware strategy, system security controls, physical access controls, policies and procedures, and security management.
Data-protection mechanisms. Perimeter security devices, such as firewall and routers.
Security awareness program. In-depth, required, and recurring employee training around suspicious emails, malware, phishing, and privacy laws surrounding PII. ;
Robust incident-response plan. Identify roles for personnel and inform them of their responsibilities for reporting or responding to an incident. Ideally, a response plan helps contain and mitigate incidents quickly.
Increased business complexities
The complexity of today’s business operations makes it harder than ever to keep data secure. The availability of cloud technologies means critically important information may be stored offsite, while companies that outsource key functions may inadvertently give vendors access to data with inadequate security controls.
Additionally, the ease with which cloud services can be utilized lets anyone send sensitive information outside an organization without its IT department knowing. Learn more about how to protect your organization from the unique cyberthreats posed by COVID-19.
Three-phase approach to cybersecurity
In the COVID-19 environment, companies anticipating a due-diligence review — as either a buyer or a seller — have a lot to sort through. Here are three areas to focus on to bolster your cybersecurity plan.
1. Start early
Addressing cybersecurity exposure and risk prior to the due-diligence process gives companies a better chance to do the following:
Demonstrate accurate valuations
Facilitate smoother transactions
Achieve a successful deal outcome
Reviewing cyber-risks early also provides companies with a longer time to remediate vulnerabilities and mitigate risk.
An ongoing cybersecurity program — even when a deal isn’t on the table — may make a company more attractive once it’s ready to sell. It can indicate a commitment to security controls and data governance — two qualities highly valued by buyers.
2. Consider a cybersecurity due-diligence review
At a minimum, a cybersecurity due-diligence review will provide a thorough investigation of the following:
Security logs for any indication of a breach
Application and database access levels
Recent compliance audits
Third parties and vendors that have access to the systems and data
In addition, companies could benefit from looking closely at these key areas:
Privileged accounts
Asset tracking
Data governance
Security event monitoring and alerting
Incident-response abilities
Disaster- and business-continuity capabilities
Vendors’ contract language and cyberinsurance policies
Security awareness training
Learn more about key actions to take during due diligence and others steps to take to lay the groundwork for a smoother M&A transition during COVID-19.
3. Build a culture of security
A strong cybersecurity culture starts at the top of an organization — with the board of directors and executive management. According to European Union Agency for Network and Information Security’s Cybersecurity culture in organizations report, a cybersecurity culture is the “knowledge, beliefs, attitudes, norms, and values of people regarding cybersecurity and how these manifest in interacting with information technologies.”
What are strong examples of security culture?
When individuals know the risks, protocols, and required actions, awareness increases and technical controls become more effective. Companies can greatly benefit from building, maintaining, and testing a strong security-awareness training program.
It’s important for executive management to participate and promote awareness trainings. All employees, contractors, and vendors should also be involved to help verify cybersecurity is top of mind for everyone with access to systems and data.
