Cyber diligence has become standard in any sale where the business holds customer data or depends on systems. A buyer is not looking for perfection; they are looking for whether you know what you hold, who can reach it, and what has already happened.
Get quotes to sell my business
The cybersecurity due diligence checklist: the questions
What personal or sensitive data does the business hold and where does it live. Who has administrative access and how is it granted and removed. Is multi factor authentication in use. Are backups tested. Is there any security policy at all. Have there been incidents, and what changed afterwards. Any regulatory or contractual security obligations from customers.
What a past incident means
Less than sellers fear, if it was handled and documented. A disclosed incident with a written account of what happened and what changed reads as a business that learned. A discovered one, or a denial contradicted by evidence, is far worse and can end the deal outright. Disclose early with the remediation attached.
Preparing the file
An inventory of systems and data, an access list, evidence of a tested restore, whatever policies exist, and any customer security questionnaires you have completed. If nothing exists, writing a short honest description of current practice is better than silence, and putting multi factor authentication in place before you market is cheap and visible.
Questions people ask about cybersecurity due diligence
Do small businesses face cyber due diligence?
Increasingly, particularly where customers are larger companies with their own supply chain security requirements.
Will insurance cover a past incident?
That is a question for your policy and your broker, and the answer is a diligence item because the buyer inherits the position.
Is a certification required?
Rarely required, sometimes valuable where customers ask for one. Its absence is not fatal; not knowing what you hold is.