A cybersecurity due diligence checklist for sellers covers security policies, certifications and audit reports, penetration test results, incident history, vulnerability management, access control, vendor risk and privacy compliance. In a secure data room, share attestations and summaries first, release detailed findings view-only to named security advisors, and never upload credentials or full network diagrams.
Cybersecurity has moved from a box-ticking appendix to a workstream that can change price, structure and the warranty package. Buyers want to know whether the target has been breached, whether it could be, and what it will cost to bring security up to their standard. The documents that answer those questions are also a map for an attacker, which makes this the one workstream where how you share is itself part of the review.
Best overall: Read the Papermark review
Papermark is best for sellers sharing security reports and test findings with named advisors, with view-only access, dynamic watermarking and audit logs, on a platform that holds SOC 2 Type II and ISO 27001 certification. The Data Rooms plan is $99/month on annual billing.
What cybersecurity due diligence covers for a seller
The buyer's security advisors look at governance, technical controls and history. Governance means who owns security, what policies exist and whether they are followed. Technical controls cover identity and access, encryption, logging, backups, endpoint protection and vulnerability management. History means incidents, breaches, regulator contact and the results of past audits and tests.
Privacy sits alongside security. If the business processes personal data, buyers will ask how it is mapped, on what basis it is processed, how it moves across borders and whether any incident required notification. For a software or data business, the privacy and security review can be as important as the financial one.
There is also a less obvious test. The buyer's team will notice how you share security material. A seller who emails penetration test reports as attachments signals weak controls. A seller who releases them view-only to named advisors, with watermarking and an audit log, demonstrates the discipline the buyer is trying to assess.
Cybersecurity due diligence checklist: governance, policies and certifications
Start with the documents that describe your security program at a high level. These can usually go to every shortlisted bidder and answer many first-round questions without exposing technical detail.
- Security organization: who is responsible, reporting lines and any outsourced security services
- Information security policy set: access control, acceptable use, incident response, business continuity, data classification
- Current third-party attestations and certifications, such as SOC 2 reports or ISO 27001 certificates, with scope statements
- Bridge letters covering any gap between the last audit period and today
- Risk register or most recent security risk assessment, at summary level
- Security awareness training program and completion records
- Cyber insurance policy, coverage limits and claims history
- Board or management reporting on security over the review period
Cybersecurity due diligence checklist: testing, incidents and operations
These documents show how the program works in practice. They are more sensitive, because they describe weaknesses as well as strengths, and most should be released in stages.
- Executive summaries of recent penetration tests, with remediation status for each finding
- Full penetration test reports, for staged release to named security advisors
- Vulnerability management process and current open findings by severity
- Incident register and post-incident reviews for the review period
- Records of any breach notifications to regulators, customers or individuals
- Asset inventory and a high-level architecture diagram without IP addresses or credentials
- Identity and access management approach: single sign-on, multi-factor authentication, privileged access
- Backup and disaster recovery plans and the results of recent recovery tests
- Third-party and vendor risk management process, with a list of critical vendors
Privacy and data protection documents buyers request
- Data map or records of processing activities: what personal data, where it lives and why
- Privacy notices for customers, users and employees
- Data processing agreements with customers and with sub-processors
- Data protection impact assessments for higher-risk processing
- Cross-border transfer mechanisms where personal data leaves its home jurisdiction
- Data subject request handling process and volumes
- Correspondence with data protection authorities, if any
Secure data room structure for cybersecurity folders
Give security material its own top-level section with its own permission group, so the buyer's security advisors can be added without seeing commercial or HR folders, and so the commercial deal team does not see vulnerability detail it does not need.
Papermark supports this with granular folder and file permissions, NDA gating, dynamic watermarking, view-only access with downloads off, and audit logs of every view. The platform itself holds SOC 2 Type II and ISO 27001 certification and offers EU hosting, which buyers' security teams often ask about when they see where their own review is taking place.
| Folder | Documents | Who sees it | Controls |
|---|---|---|---|
| 7.1 Governance and policies | Policy set, security organization, training records | Shortlisted bidders | View-only, watermark |
| 7.2 Attestations | SOC 2 reports, ISO 27001 certificates, bridge letters | Shortlisted bidders under NDA | View-only, watermark, no download |
| 7.3 Testing summaries | Pen test executive summaries, remediation tracker | Shortlisted bidders' security advisors | View-only, watermark |
| 7.4 Detailed findings | Full pen test reports, open vulnerabilities | Preferred bidder's named security advisors | Staged release, view-only, no download |
| 7.5 Incidents | Incident register, post-incident reviews, notifications | Preferred bidder's counsel and security advisors | Staged release, view-only, no download |
| 7.6 Privacy | Data map, privacy notices, DPAs, DPIAs | Shortlisted bidders | Watermark, audit log review |
Security documents that need the tightest controls
The rule of thumb is simple: the more a document would help an attacker, the later and narrower its release. Detailed test reports, open vulnerabilities and incident root-cause analyses all fall into that category, especially when findings are not yet fully fixed.
- Release full penetration test reports only after a preferred bidder is chosen, and only to named security advisors
- Fix or mitigate high-severity findings before the process, and show remediation evidence next to each finding
- Share incident details with counsel involved, since some incident analyses may have been prepared under legal privilege
- Keep architecture diagrams at a level that explains design without revealing addresses or configurations
- Turn downloads off, keep watermarking on, and check the audit log for unexpected views after each round
Hypothetical scenario: Meridian Claims prepares for a security review
Meridian Claims is a hypothetical claims management software company that processes policyholder data for insurers. A private equity buyer is in exclusivity and has brought in a specialist security firm for diligence.
Meridian's CTO had expected questions about its SOC 2 report. What she had not planned for was the buyer's request for the full results of the last two penetration tests. The most recent test had found a high-severity issue in an older reporting module, and remediation was still in progress.
Rather than delaying or summarizing it away, Meridian's team completed the fix, commissioned a retest and placed the original report, the remediation ticket and the retest letter together in the detailed findings folder. That folder opened only to four named people at the buyer's security firm, view-only with downloads off.
Meridian also had one past incident: a misdirected email that exposed a small amount of personal data and required notification to a regulator. Its counsel prepared a factual summary of the incident, the notification and the follow-up actions, and placed it in the incidents folder for the buyer's counsel and security advisors only.
The security firm's report noted the open finding as resolved and the incident as handled. The buyer still asked for a specific indemnity on pre-closing incidents, but the clear record kept it narrow and time-limited.
What buyers ask in cybersecurity follow-up requests
Security follow-ups often arrive as a questionnaire from the buyer's advisors, plus interview requests with the person responsible for security. Answer in writing where possible and upload the answers to the room, so the record is complete.
- Remediation evidence and retest results for open findings
- Coverage of multi-factor authentication across staff, administrators and customers
- How customer data is segregated and encrypted at rest and in transit
- Logging and monitoring coverage, and how long logs are kept
- Results of the last disaster recovery test and recovery time objectives
- Security terms in key customer contracts, including breach notification duties
- Any incidents since the last report, up to signing
Common mistakes in the cybersecurity due diligence data room
- Emailing penetration test reports instead of sharing them inside the room
- Uploading network diagrams with IP addresses, or configuration files with credentials
- Releasing full test reports to every bidder in the first round
- Hiding or downplaying past incidents that later surface in the buyer's own research
- Sharing an expired SOC 2 report with no bridge letter
- Allowing downloads on vulnerability and incident files
- Giving the commercial deal team access to security detail it does not need
More on due diligence checklists
Part of the Best virtual data room for due diligence cluster.
- Financial Due Diligence Checklist: What Sellers Put in the Secure Data Room10 min read
- Legal Due Diligence Checklist: Building and Permissioning the Secure Data Room10 min read
- HR Due Diligence Checklist: Employee Records in a Secure Data Room10 min read
- IP Due Diligence Checklist: Protecting Patents, Code and Tech Files in a Secure Data Room10 min read
- Commercial Due Diligence Checklist: Customer and Pricing Data in a Secure Data Room10 min read
- Due Diligence Request List: How Sellers Answer It From a Secure Data Room10 min read
Next steps
Best virtual data room for due diligence
The hub guide to choosing a secure data room for a diligence process.
Due diligence data room checklist
The master checklist that ties every diligence workstream together.
IP due diligence checklist
The technology and IP review that runs alongside security diligence.
Why audit trails matter in a secure data room
How the audit log records who opened sensitive security files.
Data room watermarking and download controls
View-only and watermark settings for test reports and incident files.
FAQ
What is included in a cybersecurity due diligence checklist?
Security governance and policies, certifications and audit reports, penetration test results and remediation, vulnerability management, incident history, access control, backup and recovery, vendor risk management and privacy compliance documents.
Should I share full penetration test reports with buyers?
Share executive summaries and remediation status with shortlisted bidders, and release full reports only to the preferred bidder's named security advisors, view-only with downloads off. Fix high-severity findings before the process where you can.
Do I have to disclose past security incidents?
Buyers will ask, and the purchase agreement will usually include warranties about incidents. Disclosing them clearly with a factual summary and the follow-up actions is far better than having them found later. Your counsel should guide what is disclosed and how.
What should never go in a data room during security diligence?
Passwords, keys, tokens, configuration files, detailed network diagrams with addresses and source code. None of these are needed for diligence, and each would be dangerous if leaked.
How does privacy fit into cybersecurity due diligence?
Privacy and security are usually reviewed together. Buyers want to see a data map, privacy notices, processing agreements, impact assessments and any regulator correspondence, alongside the security documents.
Does the security of the data room itself matter?
Yes. The buyer's security team will notice how you share security documents. Using a data room with SOC 2 Type II and ISO 27001 certification, view-only access, watermarking and audit logs shows that the business handles sensitive information with care.
Who should prepare the cybersecurity section?
The CTO or head of security, working with privacy counsel and the seller's deal advisor. Counsel should review incident materials before they are uploaded.