THE SHORT ANSWER
Cybersecurity diligence should identify critical systems, data, providers and access rights, then obtain a qualified assessment with explicit scope and limitations. Record actual findings, remediation costs, accountable people and closing conditions. Agree lawful controlled disclosure and authorized technical work. A clean scan, certificate or insurance policy does not independently establish complete security, transferable data rights or freedom from undiscovered incidents.
Define the operation and protected evidence scope
List critical applications, devices, data, providers, outsourced support and administrative responsibilities. Record actual owner/customer/vendor boundaries, business dependencies, retention obligations and proposed operator. Have counsel and qualified technical professionals agree what evidence may be shared, with whom, for what purpose and at which stage. Start with approved summaries and restrict detailed data to the agreed lawful need.
FTC guidance addresses necessary information access and secure handling throughout its lifecycle.
(FTC: Start with Security business guidance)Use this as general security context, not a completed privacy-law determination. Agree protected delivery, access logging, retention and closure of review access. A data-room invitation or shared password is separate from permission to test systems, copy every record or transfer customer accounts.
Obtain a qualified assessment with stated limitations
Agree the assessor, systems, period, methods, evidence requirements and exclusions in writing. Responsible owners, customers and providers must authorize technical work within their actual boundaries. Ask qualified professionals to evaluate actual administration/access controls, update records, incidents, recovery tests, supplier dependencies and outstanding findings. Do not infer that an absent incident report proves no historical incident.
CISA’s May 2022 MSP advisory discusses customer/provider responsibilities, privileged access, backup/recovery and incident planning.
(CISA: MSP and customer security responsibilities (2022 advisory))Use this historical provider guidance for scoped questions when an MSP is involved. It is not a current threat forecast or a complete checklist for every company. Review actual assessment/certification scope, dates, exceptions and operational changes; an unexplained SOC/ISO label or clean scan does not settle every technical or contractual risk.
Translate findings into an accountable decision register
Keep actual evidence separate from assumptions, unavailable records and unresolved questions. Ask the qualified assessor to explain material findings in the company’s operating context, with limitations. Obtain actual remediation estimates and verify whether work is temporary, continuing or dependent on a third party.
| Decision-register field | What to record | Who verifies |
|---|---|---|
| Evidence and scope | Actual record, date, systems, assessor and exclusions | Qualified technical lead |
| Finding and consequence | Supported issue, uncertainty and affected operation | Assessor and responsible management |
| Required action and cost | Quoted work, continuing costs and funding | Technical provider and accountant |
| Responsibility and timing | Named accountable party and agreed stage | Parties and counsel |
| Acceptance evidence | Documented completion, test scope and remaining exceptions | Qualified assessor and parties |
A cost estimate is separate from completed remediation. Review financing, insurance coverage/exclusions, contract disclosures and possible notification duties with responsible professionals. No universal security discount, insurance recovery or liability protection is substantiated here.
Agree closing controls and continuing recovery responsibilities
SBA sale guidance discusses identifying transaction assets and liabilities.
(SBA: closing or selling a business)Record actual platform/data rights, customer/provider consents, incident obligations, remediation costs and seller/buyer duties in the proposed transaction with counsel. Decide which verified conditions must be met before closing and which work continues afterward, with responsible people, funding, reporting and acceptance evidence. Keep negotiated price separate from operating investment and remaining duties.
Plan authorized account/control changes and continuing access with qualified technical parties. Confirm accepted operational access, provider support, recovery responsibilities and remaining exceptions; close temporary review access under the agreed plan. Use the permanent coverage worksheet and the funded delivery guide to connect systems responsibilities to real people and cash. A closing date is separate from complete technical acceptance or a guarantee that no future incident occurs.
Owner questions
What should cybersecurity diligence produce?
A scoped evidence and findings register, qualified limitations, supported remediation costs, accountable duties and documented closing/operating acceptance conditions.
Does a clean scan or certificate prove complete security?
Review its actual systems, period, methods, exclusions and changes; it does not independently establish every risk or data-transfer right.
Can the buyer test customer systems using supplied passwords?
Obtain actual written authorization and lawful scope from responsible owners, customers and providers before technical work.
Sources and review scope
Source review completed . The sources below support the identified concepts or rules; they do not validate hypothetical amounts or a valuation of your business.
- FTC: Start with Security business guidance
General security practices illustrated through FTC settlement allegations, not findings about this business, a certification, or a complete privacy-law assessment.
- CISA: MSP and customer security responsibilities (2022 advisory)
May 11, 2022 advisory actually read October 10, 2026 through browser tab8, complete operative AX57–346. Used for brief historical guidance on defined provider/customer security duties, privileged access, backups/recovery and contractual transparency. Linked technical resources not reviewed. No current threat-rate, private-company finding, universal certification mandate, valuation premium or complete security/legal clearance inferred.
- SBA: closing or selling a business
Valuation approaches, sale agreements, assets and ownership transfer.
Confirm tax, legal, accounting and lending applications with the relevant professionals. Historical market observations describe the stated period and reported sample.
This is educational material. Industry figures and program rules can change; check the original sources and your advisors before applying them to a transaction. Calculator scenarios are not appraisals, lending decisions, or offers.
Our content and calculator methodology →