Cyber Due Diligence for Mergers and Acquisitions India

Why Cyber DD Matters in M&A

The Yahoo-Verizon transaction (2017) is the canonical precedent. Verizon agreed to buy Yahoo's core internet business in 2016 for USD 4.83 billion. During exclusivity, Yahoo disclosed two massive prior breaches (3 billion accounts in one, 500 million in another). Verizon negotiated the price down by USD 350 million and required indemnity for certain ongoing liabilities. The transaction closed but the precedent set the M&A cyber DD baseline industry-wide.

Indian M&A activity has grown materially since 2020. PE, VC and strategic transactions across SaaS, fintech, healthcare, manufacturing and consumer all increasingly include cyber DD as a workstream. The cost of cyber DD is small relative to a typical deal; the cost of missing material cyber liability is large.

What Cyber DD Covers

• VAPT history: recent pentest reports, findings, remediation status, re-test outcomes
• Incident history: past cyber incidents, response, lessons learned, residual liability
• Data inventory: what personal data, payment data, IP, regulated data is held, where it sits, who can access
• Third-party access: vendor register, vendor cyber assurance, integration dependencies, supply chain exposure
• Compliance posture: ISO 27001, SOC 2, PCI DSS, HIPAA, DPDP, RBI/SEBI/IRDAI compliance status and certificates
• IR readiness: IR plan, tabletop history, retainer, recent exercise outcomes
• Cyber insurance: policy coverage, claims history, renewal status
• Regulatory exposure: open investigations, recent inspections, pending fines, sector-specific risk
• Technology debt: legacy systems with material cyber risk, deprecation roadmap
• Team and capability: CISO function, security headcount, programme maturity

Timing in the Deal Process

Buy-side cyber DD typically runs during exclusivity, after term sheet and before signing. 2 to 6 weeks depending on target complexity. The output feeds the negotiation: price adjustment, representation and warranty, indemnity, escrow, post-close obligations.

Vendor due diligence (VDD) by the seller is conducted ahead of marketing the asset. The seller's cyber team or external consultant produces a comprehensive DD pack that addresses anticipated buyer concerns. VDD reduces surprises during buyer DD and supports a cleaner process.

Post-signing pre-closing cyber updates address material changes between signing and closing. A breach during this window can trigger material adverse change clauses.

Post-close integration includes integration-specific cyber DD on connecting the two organisations' networks, systems and identities.

Red Flags That Affect Valuation

Undisclosed breaches: the Yahoo precedent. Any breach should be disclosed during DD. Discovery after close triggers indemnity claims and rep and warranty breach.

Material compliance gaps: missing certifications customer contracts require, regulator-mandated controls not in place, DPDP / GDPR exposure for personal data handled.

Regulatory enforcement risk: open investigations, recent inspections with adverse findings, pending fines.

Technical debt: out-of-support systems holding sensitive data, fundamental architectural issues that materially affect post-close integration cost.

Vendor concentration risk: critical dependency on a single vendor with poor cyber posture.

Talent risk: CISO recently departed, security team understaffed, key person dependency.

Insurance gaps: cyber insurance not in place, recent policy reduction, exclusions affecting in-scope risk.

Post-Merger Integration Security

Connecting two organisations' networks, identities, applications and data multiplies the threat surface. Day-one integration cyber plan addresses the immediate risks; multi-year integration roadmap addresses structural alignment.

Day-one risks: open trust between the two networks before either has audited the other, identity federation introducing access paths that bypass either organisation's existing controls, immediate data flows that may not respect DPDP / GDPR cross-border restrictions, shared vendor relationships that need consolidation.

Recommended day-one approach: keep the networks separated until cyber DD findings are remediated, federate identity carefully with strict role mapping, conduct accelerated VAPT of the acquired entity's perimeter, integrate IR teams from day one (one IR plan, one incident channel), align cyber insurance to the combined entity within 30 days.

DPDP Implications for M&A

DPDP Act 2023 has direct implications for M&A involving personal data. The acquirer inherits the personal data the target processed and the obligations attached to it. Issues to address: lawful basis on which the target collected data, whether that basis remains valid post-acquisition (consent given to the original entity may not automatically extend), data subject rights workflows, breach response obligations carried forward, vendor agreements covering personal data.

For cross-border transactions involving Indian targets, additional considerations: where personal data will sit post-close (India versus outside), Significant Data Fiduciary designation possibly triggered at combined scale, DPO appointment, independent audit obligations.

Vendor due diligence and acquirer DD should specifically address DPDP-attached liabilities. Codesecure delivers DPDP-focused DD as part of broader cyber DD engagements.

Cyber DD Report Structure

A cyber DD report serves multiple audiences in the deal process: the buyer's deal team, deal counsel, financial advisors, and (for material findings) the buyer's board. Structure:

Executive summary (1 to 2 pages, deal-team readable, deal-impact statements).

Scope and methodology.

Cyber risk profile: high-level posture assessment.

Detailed findings by domain (VAPT, incidents, data inventory, third party, compliance, IR, insurance, regulatory, technology, team).

Deal-impact summary: which findings affect price, which trigger reps and warranties, which require post-close action, which are accepted.

Integration considerations: cyber risks of integration, recommended day-one plan.

Appendices: evidence, control inventory, list of certificates reviewed, redacted excerpts from sampled documentation.

Codesecure delivers cyber DD with this structure for Indian buy-side and sell-side engagements.