The need for Digital Due Diligence; How to prevent a pig in a poke

In mergers and acquisitions, buyers impose stricter conditions on entrepreneurs seeking to sell their companies, including conditions regarding data and privacy (Conijn & Smit, 2023). At the same time, regulatory bodies such as the US Securities and Exchange Commission (SEC) are responding to the escalating cyber threats by expanding their rules about cybersecurity risk management. This article will explain what digital due diligence entails, why it is essential, which eight principles you can follow regarding data security, and how to avoid buying a pig in a poke company.

The role of cybersecurity in mergers, acquisitions and business operations

The heightened scrutiny of cybersecurity underscores the critical need for careful digital due diligence on digital assets and comprehensive risk assessments. In mergers and acquisitions, even a single misstep can have profound consequences, leading to substantial financial losses and reputational damage.

Fortunately, more and more due diligence is also performed for the technological departments of a company. This is not surprising, as technology proves an ever-larger factor in company processes and value driver (Amir et al). Moreover, notorious examples such as the acquisitions of DigiNotar by Vasco, Verizon by Yahoo and Marriott International by Starwood Hotels and Resorts Worldwide have shown the impactful consequences of insufficient digital due diligence.

In the Yahoo incident, attackers successfully executed a spear-phishing attack, targeting a Yahoo employee. Through their credentials, the attackers got access to backed-up data. This example shows the importance of the principle of least privilege, as overprivileged user rights significantly simplify the task for cybercriminals to get into and, through “system hopping” explore the entire network since there was no network segmentation. Breaches like the one experienced by Yahoo can have far-reaching consequences. Combined with another breach experienced by Yahoo, this led to a 350 million-dollar reduction in the deal with Verizon (Athavaley & Shepardson, 2017).

Arguably, all business processes are, to a varying extent, dependent on technology and digital processes. Business and private life seamlessly integrate, and so does the data, including Intellectual property or confidential data valued as goodwill in any acquisition process. This data can sit everywhere, including in-home devices or smartphone storage like iCloud. In this context, digital due diligence is not merely a best practice but an absolute necessity.

Core principles to prevent you from buying a pig in a poke

In our digital world, various reasons exist to perform a digital due diligence assessment. At its core, digital due diligence aims to unearth potential security risks, serving as the foundation for various essential considerations, such as the firm's valuation and identifying the value drivers. This includes intellectual property, software technology, automation capabilities, subscriptions, unique market proposition, and potential threats to these value drivers.

Organisations can substantially enhance their operational efficiency in the long run by identifying security risks before the acquisition. This insight is valuable, as identifying critical security vulnerabilities can potentially stall or, in extreme cases, halt an acquisition entirely or influence the agreed acquisition sum. Consequently, being aware of these risks before the acquisition allows the buyer to request the seller to improve their security measures. Proper digital due diligence significantly contributes to the seamless integration of the acquired entity into the seller’s corporate environment, enhancing business continuity, avoiding hacks and minimising disruptions, or the so-called ‘pig in the poke’.

So thorough due diligence on technology, process, and human capabilities is instrumental in building trust and maintaining a good reputation. An acquisition involves assets, operations, and large quantities of customer and employee data. By identifying potential security risks and regulatory violations beforehand, reputation damage can be prevented. This also includes the evaluation of vendor relationships, as these third-party connections can often be a weak link in the supply chain.

Since company value drivers (value-creating assets) are more shifted towards the software technology in use, assessing the “Secure Software by Design” principles or the use of good practices such as a Software Bill of Materials (SBOM) is needed. The software should be diligently checked to avoid buying technology dept or an inferior software technology stack. Furthermore, digital due diligence not only encompasses technological aspects but also includes evaluating the company’s cyber security culture and the awareness level among its employees. This proves true in the Marriott International case, in which attackers likely gained unauthorised access to the Starwood guest reservation database via a phishing email (Fruhlinger, 2020). The breach had started in 2014, two years before Marriot acquired Starwood, but was not discovered until after the acquisition was completed.

Also, digital due diligence is pivotal in safeguarding intellectual property (IP). Particularly in acquisitions around acquiring specific technologies, the value of these core assets is of great importance. A notable cautionary tale is the case of DigiNotar, where the company’s main assets, its certificates, were illicitly replicated, eventually leading the company to go bankrupt and the acquiring party Vasco, left empty-handed with a “Pig in a Poke”. Comprehensive digital due diligence efforts are crucial in establishing that the IP is legally and technically protected and still holds substantial value. Awareness and deep knowledge of the technological and security status of the company, the leading suppliers and the exact identification of the value-driving assets to be acquired can significantly improve the transition period.

How to conduct Digital Due Diligence (DDD) yourself

The selling and buying parties can contribute to smoothening and accelerating the acquisition process. The selling company could show their security status based on any framework (e.g. CIS8, ISO27001, ISO27701 etc) in the form of periodic statements that they are in control of their digital security, risk, privacy and audits via a structured way of control testing. And adequately following up on audit findings. This is a good practice in general, not just before an acquisition. These so-called in-control statements can be generated with technology such as Anove, based on 100+ international frameworks. This technology was developed to ensure companies with flawless strategic, tactical and operational processes. It visualises at all times the risks, security gaps and required actions.

The buying party can assess the in-control statements to conduct digital due diligence. Such a process can be done collaboratively with several stakeholders at the table. Group Support System Technology such as Meetingwizard.nl can support this process of assessing, rating and deciding. The first step in this process is establishing the exact goal behind the acquisition. Do you want to increase your market share, eliminate the competition or even acquire a specific technology? The next step is determining what systems, software, data and other technological assets you need to achieve your objectives. Register all these highly valuable assets and their owners requires knowledge and expertise—something which is taught at Antwerp Management Schools executive master in IT.

After that, it is time to assess the risks to which these assets are vulnerable. The final step is to evaluate the controls implemented in the organisation based on a framework like Payment Card Industry Data Security Standard (PCI DSS), ISO27001 or NIST Cybersecurity Framework (CSF) or NIST 800-53 or other families.

1. Corporate policies and technical procedures are in place, implemented and maintained (via testing procedures)
2. An external security vulnerability assessment is performed in last 12 months
3. Strong user account and access management (also for high privilege system users) is in place
4. Asset identification and classification is performed
5. Software security by Design practices are in place
6. Segmentation of assets is performed and maintained
7. Audit findings are known and tracked for resolution via a structured process
8. Important third parties are known, assessed and periodically evaluated on risk and security