You closed the deal. The financial models looked solid. But three months post-acquisition, the portfolio company’s tech team admits they cannot patch a critical vulnerability without risking a core system outage. The real cost of inadequate cyber diligence is not just a potential breach. It is the drag on growth, the erosion of trust, and the constant chaos of managing surprises.
This is not a failure of talent. It is an operating system failure. Smart people are trapped in a system where ownership is fuzzy, decisions are ambiguous, and proof is a fire drill. They keep paying for tools, but the mess stays. The good news is you can restore control. It starts by asking the right questions, not about tools, but about operational reality.
This article provides the essential cybersecurity diligence questions for a PE portfolio company, designed to translate messy technical details into clean decisions for board leaders and operators. Each question will help you diagnose the real problem, make a clear decision, and take a simple next step this week. The goal is to equip you to make defensible decisions, establish predictable execution, and protect your investment from costly surprises.
1. Who owns cybersecurity decisions?
This is the most critical question because it cuts directly to accountability. A vague answer is the single greatest predictor of operational chaos and hidden risk. If leadership cannot name one person who owns security decisions, budgets, and outcomes, you have found the source of recurring problems. The issue is not a missing tool, it is a missing owner with real authority.
For a private equity firm, this question reveals whether the portfolio company can execute a security roadmap or if it is stuck in indecision. A clear governance structure, where a single owner has delegated authority, is proof of operational maturity. A tangled one signals that every security initiative will stall.
Evidence to Request and Red Flags
Go beyond the org chart. To get the real story, ask for specific proof and watch for these indicators:
- Decision Log: Ask, "Walk me through the last three significant security decisions made." Who made the call? Who funded it? Was it documented? If no one can answer clearly, decisions are happening ad hoc.
- Meeting Cadence and Minutes: Request charters for any security committee. Who attends? Are non-technical executives present? If these meetings don’t exist or are purely technical, security is not integrated with business strategy.
- Budget Authority: Does the security leader have a dedicated budget, or must they ask other departments for funding on a project-by-project basis? The latter is a major red flag for a lack of autonomy. A well-governed organization will have a clear process for this, often tied to a technology due diligence framework.
An ambiguous governance model creates friction and risk. For example, if the security team lacks veto power on new vendors, the company will inevitably onboard risky software. An unclear governance structure often leads to poor data handling practices. A critical component of effective security governance is a clear and enforced approach to data governance, preventing issues like permission sprawl. For many organizations, this starts with establishing a solid SharePoint data governance plan to control access to sensitive information. Without clear ownership, your first move post-close will be fixing the governance structure, because no security program can succeed without it.
2. Is your incident response plan tested and ready?
The existence of an incident response (IR) plan on paper means nothing. A plan that has never been tested is not a plan, it is a liability. This question exposes the difference between having a document and having a capability. A chaotic response to a security incident destroys enterprise value, erodes customer trust, and invites regulatory fines. The real question is not "do you have a plan," but "can you execute it under pressure?"
A well-rehearsed IR plan signals operational resilience and mature risk management. It proves the organization can coordinate technical containment, legal counsel, and executive communication when minutes matter. Consider this real-world scenario: a healthcare company with a quarterly tested plan contained a ransomware attack in 90 minutes. A financial services firm with an untested plan, despite having a document, descended into chaos because no one knew who owned the decision to disconnect systems, leading to a wider blast radius and weeks of recovery.
Evidence to Request and Red Flags
Do not accept a simple "yes" as an answer. To validate the company's real-world readiness, you must inspect the proof.
- The Plan Itself: Request the full incident response plan. A summary is not enough. Verify that it includes specific playbooks for scenarios like ransomware, data exfiltration, or a supply chain compromise.
- Test Reports and Remediation: Ask for the after-action reports from the last two tabletop exercises. What were the findings? Who owned the remediation items, and is there proof they were completed? No test reports is a major red flag.
- Third-Party Retainers: Confirm if the company has pre-contracted support for digital forensics, legal counsel, and crisis communications. Scrambling to find these partners during an active incident is a recipe for failure.
A failed incident response directly impacts valuation. The cost of a breach is not just remediation, it includes business interruption and reputational damage. A key part of what incident response planning is involves pre-approved communication protocols for customers, regulators, and the board. Without this, legal and PR teams will be paralyzed by indecision at the worst possible moment. Post-close, you will not be optimizing a plan, you will be building one from scratch while hoping you do not have to use it.
3. What is your time to fix critical vulnerabilities?
This question moves beyond policy to pure execution. It assesses how effectively a company finds and fixes software flaws before attackers exploit them. A slow or inconsistent patch management process is a direct indicator of elevated breach risk and poor operational discipline. The Mean Time to Remediate (MTTR), a metric that measures the time from detection to fix, reveals a company’s true security posture, not just its intentions.
For a private equity firm, a low and consistent MTTR for critical vulnerabilities demonstrates maturity. A tech company with a 21-day MTTR for critical flaws has far stronger operational controls than a competitor with a 120-day MTTR. A long remediation timeline is a business risk that signals systemic issues like resource constraints, change management friction, or a lack of accountability.
Evidence to Request and Red Flags
Look for hard data, not just process documents. A mature program generates clear evidence of its performance.
- Trend Reports: Ask for a rolling 12-month dashboard of MTTR, broken down by severity (critical, high, medium, low). Is the trend improving or degrading? Good looks like MTTR for criticals under 30 days.
- Vulnerability Scan Coverage: Inquire about the scope and frequency of vulnerability scanning. Does it cover all assets, including cloud infrastructure, on-premises servers, and applications? Gaps in coverage create dangerous blind spots.
- Remediation Records: Select the last 10 critical vulnerabilities identified and ask for the full remediation timeline. Verify that MTTR is measured from detection to final fix in production.
- Exception Process: Identify which systems are excluded from standard patching timelines. For legacy systems that cannot be patched quickly, ask what compensating controls like network segmentation are in place to mitigate the risk.
A high MTTR is a direct risk to your investment. It leaves the company exposed to exploits that can lead to data breaches and business interruption. Fixing a broken vulnerability management program post-close requires significant time and resources. Understanding the true state of patch management discipline during diligence is one of the most important cybersecurity diligence questions for a PE portfolio company because it directly impacts the company’s resilience.
4. Is your asset and data inventory complete and current?
If you cannot see an asset, you cannot secure it. This question exposes whether a company's security program is built on a solid foundation or on guesswork. A "no" or "mostly" answer is a direct admission of unmanaged risk. Without a complete and current asset inventory, security efforts like patching, access control, and monitoring are fundamentally flawed. You are only protecting what you know about, while attackers target what you have forgotten.
For a PE firm, an inaccurate inventory is a significant financial liability hiding in plain sight. During diligence, one mid-market SaaS company discovered 47 cloud accounts, 16 of which were unknown to IT and held sensitive customer data. This is not just sloppy bookkeeping, it is a direct path to a data breach. An incomplete inventory proves that operational discipline is weak.
Evidence to Request and Red Flags
A simple list of servers is not enough. You need to verify the process and the output to uncover the real state of asset management.
- Inventory and Discovery Data: Request the asset inventory or Configuration Management Database (CMDB). Cross-reference it with cloud bills and procurement records. Discrepancies are a major red flag.
- Maintenance Process: Ask how the inventory is maintained. If the answer is "manual updates to a spreadsheet," it is outdated. Look for automated discovery tools.
- Data Classification: Check if the inventory includes data classification tags. Does the company know which systems hold PII, financial data, or intellectual property? If not, they cannot apply risk-based controls.
- Shadow IT Identification: Inquire about their process for finding unauthorized systems and applications. This is a common failure point that creates compliance gaps.
An incomplete inventory makes post-acquisition integration dangerous and expensive. A healthcare provider found three abandoned, unpatched database servers with patient data during a pre-acquisition audit. One was internet-exposed. A complete asset inventory is a non-negotiable prerequisite for calculating your true attack surface. Your first 90 days post-close will be spent on discovery and cleanup, a costly distraction that could have been identified and priced into the deal.
5. How do you manage and prove strong access controls?
This question directly assesses the perimeter of modern security: identity. Weak access controls are the root cause of most major breaches. If a company cannot prove who has access to what and that those identities are strongly authenticated, it is operating with a massive, unmanaged risk. Strong identity and access management (IAM) is the foundation of a defensible security program.
For a PE firm conducting cybersecurity diligence, the answers here reveal the company's real-world discipline. Widespread multi-factor authentication (MFA) adoption and clean access reviews are signs of an organization that translates policy into practice. In contrast, inconsistent MFA enforcement or stale user permissions are symptoms of an immature security posture where a single stolen password could lead to a catastrophic incident.
Evidence to Request and Red Flags
Look for concrete proof of controls, not just assertions. A well-run organization can produce this evidence quickly.
- MFA Enrollment Dashboard: Ask for the report from their identity provider (like Okta or Azure AD) showing MFA enrollment rates. The target should be over 90% for all users. Pay close attention to the exclusion list.
- Privileged Account Inventory: Request a list of all accounts with administrative privileges. Do admins use separate, dedicated admin accounts, or do they use their daily user accounts with elevated rights? The latter is a significant red flag.
- Access Review Records: Ask for the results of the last access review for a critical system. Who conducted it? Were any permissions revoked? If reviews are not happening at least semi-annually, you have found permission sprawl.
- Offboarding Process Checklist: How quickly is access revoked when an employee leaves? Ask for a ticket or checklist from a recent termination. The process should be immediate and verifiable.
6. How do you secure the software you build?
This is a critical cybersecurity diligence question for a PE portfolio company, especially any business that develops its own software. The answer reveals whether the company treats security as an integral part of its product development or as an afterthought. A weak response often points to a "move fast and break things" culture that accumulates massive security debt, where vulnerabilities are built directly into the revenue-generating product.
For a private equity firm, understanding the Secure Software Development Life Cycle (SDLC) is crucial for assessing product risk. A company that cannot demonstrate controls over its code, dependencies, and deployments is a ticking time bomb. A single vulnerability, like hardcoded credentials or a compromised open-source library, can lead to a catastrophic breach, immediate revenue loss, and irreparable brand damage.
Evidence to Request and Red Flags
You must verify that secure practices are actually followed, not just discussed. Request tangible proof and look for these warning signs:
- SDLC Process Documentation: Ask for a diagram of their development lifecycle. If it lacks clear security gates like static code analysis (SAST) or manual code review before production, assume vulnerabilities are being deployed regularly.
- Scan Results and Remediation Tickets: Request recent SAST scan reports. A huge backlog of unresolved high-risk vulnerabilities signals that security is not a priority. A good signal is a backlog aging report that shows critical items are fixed within 30-60 days.
- Dependency Management: Inquire how open-source components are tracked. Ask for a Software Bill of Materials (SBOM). If they cannot produce one, they have a blind spot regarding supply chain risk.
- Secrets Management: Ask directly, "Where are secrets like API keys and database credentials stored?" The only acceptable answer is a dedicated secrets vault. Finding secrets in code repositories is a severe and immediate risk.
An insecure SDLC directly impacts company valuation. A fintech platform with a flawed code review process could easily have a SQL injection vulnerability that goes undetected, putting customer financial data at risk. Fixing this costs time and money. Without strong controls, your first post-close priority will be halting development to address foundational security flaws, delaying product roadmaps and revenue growth.
7. How do you measure security behavior change?
A check-the-box annual training video is not a security program; it's compliance theater that creates a false sense of security. This question separates companies that treat their people as their greatest asset from those who see them as the weakest link. A strong answer demonstrates a sustained program focused on measurable behavior change, not just satisfying an audit requirement.
For a private equity firm, the answer reveals the portfolio company's true internal culture of security. A weak program means high susceptibility to phishing and social engineering. An organization that only provides generic annual training is accepting significant, unmanaged human risk. A mature one, like a healthcare provider that cut its phishing click rate from 15% to 2% in six months through targeted simulations, shows it can actively reduce its attack surface.
Evidence to Request and Red Flags
Look past the completion certificates. To understand if the training actually works, you need to see proof of behavioral outcomes.
- Training Cadence and Content: Is training a one-time event or a continuous program? A single annual session is a red flag. Is the content tailored to specific roles like finance and executives?
- Phishing Simulation Metrics: Request reports from phishing simulation campaigns. Look for the baseline click rate and the trend over time. A rate that does not decrease indicates the training is not effective.
- Incident Reporting Data: Find out how employees report suspicious emails. Ask for metrics on how many user-reported incidents are submitted per month. A low number might mean users do not know how or do not feel comfortable reporting them.
An untrained workforce is a direct threat to valuation. Every employee is a potential entry point for an attacker. Fixing a weak security culture is more difficult than replacing a tool. A company with a mature, metrics-driven program has already done the hard work of turning its employees into a security asset, directly reducing operational risk.
8. Can you detect and respond to suspicious activity in real time?
A company without visibility into its own network is flying blind. This question tests whether security is a real-time operation or a purely theoretical exercise. The absence of effective monitoring means an attacker can operate undetected for weeks, turning a minor intrusion into a catastrophic breach. Prevention eventually fails; detection and response are what determine the blast radius.
For a private equity firm, this question exposes the company's true incident readiness. An immature organization often has a security tool generating thousands of alerts that no one investigates, which creates a false sense of security while alert fatigue guarantees real threats are missed. Smart teams fall into this trap all the time.
Evidence to Request and Red Flags
Look past the vendor logos on their security stack. The only thing that matters is demonstrated capability.
- Key Metrics: Ask for the Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). If they cannot provide these numbers, they are not measuring what matters. Good looks like MTTD and MTTR measured in minutes or hours, not days.
- Alert Triage Process: Request a walkthrough of their alert handling procedure. A high alert volume with a small team is a red flag for burnout and missed incidents.
- Log Retention Policies: Check how long logs from critical systems are retained. A policy of less than 12 months is insufficient for forensic investigation.
- After-Hours Coverage: Ask, "Who responds to a critical alert at 2 AM on a Saturday?" If the answer is vague, they have no real 24/7 response capability.
Weak detection and response capabilities directly translate to higher financial risk. A company that cannot see an attack in progress cannot stop it. Post-close, your first move will be to establish and measure a baseline for MTTD and MTTR, because you cannot manage risk you cannot see.
9. How do you manage vendor and third-party risk?
Your company's security is only as strong as its weakest vendor. This is one of the most important cybersecurity diligence questions for a PE portfolio company because supply-chain risk is now a primary attack vector. A vague answer about "vetting vendors" signals a reactive, compliance-driven process that misses operational realities. The real risk is a systemic failure to manage the extended enterprise of SaaS tools and service providers that have access to your data.
For a private equity firm, a weak vendor management program is a direct threat to valuation. A breach originating from a third party can cause catastrophic reputational damage and halt operations. A mature program demonstrates that the company sees security as a shared responsibility, while a poor one suggests you will be inheriting unknown and unmanaged liabilities.
Evidence to Request and Red Flags
You must verify that their process is more than just a pre-signature questionnaire.
- Vendor Inventory and Tiering: Ask for a complete list of all third-party vendors with access to company data or systems. How are they categorized by criticality? If there is no inventory, the company is flying blind.
- Contractual Security Clauses: Request to see the security addendum in contracts for critical vendors. Look for explicit language covering incident notification timelines and right-to-audit.
- Completed Risk Assessments: Ask for the last three completed assessments for high-risk vendors. Are they just check-the-box exercises, or is there evidence of follow-up on identified gaps? A solid third-party vendor risk management framework is essential here.
An unmanaged vendor ecosystem is an open door for attackers. If vendor access is not tightly controlled and regularly reviewed, a single phished vendor credential can grant an attacker deep access into your network. Your first post-close action will be to freeze new vendor onboarding, build a complete inventory, and triage the existing relationships.
10. How do you protect sensitive data and ensure compliance?
This question moves past theoretical policies to the operational reality of how a company handles its most valuable asset: data. A disorganized approach to data protection is a direct indicator of future financial and reputational damage. If leadership cannot clearly articulate how they classify, protect, and govern sensitive data according to legal requirements, they are sitting on a time bomb of potential fines and lawsuits.
For a private equity firm, a company’s ability to manage data risk is a proxy for its overall operational discipline. A strong privacy posture is no longer just a compliance task, it is a competitive advantage that accelerates enterprise sales and builds customer trust.
Evidence to Request and Red Flags
You must verify that data protection is an enforced, operational practice, not just a set of forgotten documents.
- Data Map: Request a map or inventory showing where sensitive data (e.g., PII, PHI, PCI) resides, who can access it, and its flow through systems. If they cannot produce this, they are flying blind.
- Encryption and Key Management: Verify encryption standards for data at rest and in transit. Ask how they manage encryption keys. Weak standards or chaotic key management are major indicators of an immature program.
- Compliance Artifacts: Ask for recent privacy impact assessments (PIAs) and evidence of compliance with regulations (e.g., GDPR, HIPAA, CCPA). Understanding how your portfolio companies protect sensitive data is paramount, particularly for industries governed by regulations like HIPAA. For more details, explore our guide on Mastering HIPAA Compliance IT Requirements.
- Data Loss Prevention (DLP) Logs: Review DLP rules and a log of recent incidents. A lack of rules or a high volume of uninvestigated alerts signals that policies are not being enforced.
Weak data protection creates unquantified liabilities that can destroy a deal's value post-close. A failure to comply with GDPR or CCPA can result in fines totaling millions of dollars. If data governance is weak, your first priority post-acquisition will be a costly and urgent data discovery and protection project. A strong program, on the other hand, de-risks the asset and provides a solid foundation for growth.
The Plan: From Questions to Control
The purpose of these cybersecurity diligence questions for a PE portfolio company is to create a clear plan. The gaps uncovered are not just red flags, they are your roadmap. They point directly to where the operating system of the business is broken. For the CEO or board leader, this is not about chasing perfect security. It is about establishing predictable execution and defensible oversight.
The problem in most portfolio companies is not a lack of smart people. It is the absence of clear ownership and a reliable operating rhythm to turn intentions into inspectable proof. This is the decision leaders must make: to trade chaos for a system that provides control.
Your 30-Day Move
Here is a practical, four-week plan to convert your diligence report from a document into a functioning management system. This plan establishes the core components of governance: a single owner, a defined outcome, visible progress, and a weekly cadence.
-
Week 1. Name the owner and define the outcome. Assign one individual accountable for cybersecurity risk. This cannot be a committee. Their first task is to define the outcome for the quarter: a one-page, board-ready dashboard that shows risk posture against the top five findings from diligence.
-
Week 2. Map the handoffs and define done. The owner works with the tech and operations teams to translate the top three diligence findings into concrete work. For each item, they define what ‘done’ looks like. For "poor access controls," done might be: "All admin accounts on critical systems require MFA, and a log of privileged access is reviewed weekly. Evidence is an auditor-ready access log."
-
Week 3. Remove one major blocker and ship one visible fix. The team must deliver one tangible improvement to build momentum. Pick something with a clear blast radius reduction, like enforcing MFA on one high-risk application or cleaning up all former employee accounts. This visible win proves the new operating model produces results, not just meetings.
-
Week 4. Start the weekly cadence and publish a one-page proof snapshot. The owner convenes the first weekly security operating meeting. This is a 30-minute meeting to review progress, identify the top blocker, and make one decision to remove it. The owner then publishes the first version of the one-page proof snapshot for leadership.
This simple rhythm turns abstract risk into a manageable backlog. It gives teams the clarity they need to stop firefighting and gives the board the inspectable proof they require. You are no longer just asking questions, you are building a system to answer them with evidence, week after week.
Diligence reveals problems, but it does not provide the operating system to fix them. CTO Input provides the fractional CTO, CIO, and CISO leadership to restore clear ownership and reliable execution across technology and security. We translate messy tech realities into clean decisions, giving you the inspectable proof your board requires.
Are you ready to trade surprises for a system? Book a clarity call.