Know the cyber risk you are buying, selling, or bringing onto your network before it becomes yours. Independent audits by CISA-certified auditors, scoped to the deal.
Cyber risk changes shape as a deal moves from letter of intent to integration. Here is what each side should look at, and when.
| Your side | 1Letter of Intent | 2Diligence | 3Signing | 4Closing | 5Integration |
|---|---|---|---|---|---|
| If you are buying | Scope the assessment and agree access to the target’s systems. | An IT security audit and risk assessment of the target, plus the vendors that come with it. | Bring the cost of fixing gaps into the deal discussion. | Plan day-one changes to accounts, credentials, and remote access. | A network security audit before the two networks are connected. |
| If you are selling or raising investment | Before the letter: find and fix what a buyer’s diligence would find. | Answer buyer questions with an independent audit report and an Auditor Opinion Letter. | Show progress against the remediation plan. | Hand security documentation to the buyer’s integration team. | Buyer leads from here |
When you acquire a company, you acquire its security gaps, its past incidents, and its compliance obligations along with its assets. When you are the one being acquired or raising investment, buyers and investors now ask hard security questions, and weak answers can affect the deal. In either case, an independent assessment turns an unknown into something you can price, plan for, and fix.
We are independent auditors with no stake in the deal. For buyers, we assess the environment you are taking on, with the target’s cooperation. For sellers and companies raising investment, we help you find and fix issues before diligence begins. After closing, we assess the combined environment before the networks are fully connected.
Which services you need depends on your side of the deal and how far along it is. Buyers usually start with the IT security audit; sellers start before the letter of intent.
A full review of servers, cloud services, Microsoft 365, endpoints, identity, and IT general controls, benchmarked against CIS and NIST standards. It shows the security of the environment you are buying or bringing in, before it becomes part of yours.
IT security auditTurns findings into a prioritized list of risks and the controls needed to address them, so the cost of fixing gaps can be part of the deal discussion and the integration plan.
Risk assessmentThe vendors that come with a business hold its data too. We evaluate their safeguards, evidence, and contract language so inherited vendor risk is visible before closing.
Third-party risk managementBefore connecting two networks, know what you are connecting. We review firewalls, segmentation, remote access, and VPN so integration does not open a path from one environment into the other.
Network security auditA vCISO prepares you for investor and acquirer due diligence, supports board and audit committee sessions, and guides security planning through the transition, on a fractional basis.
vCISO advisoryA buyer evaluating a target, a company preparing for sale, and a business integrating after closing need very different work. We do not sell a fixed package. We start with your role in the transaction and your timeline, assess what is actually in scope, and deliver findings you can use in the decision.
We focus on the systems, data, and obligations that matter to the deal, and scale the work to your diligence timeline.
Findings translated into business risk and remediation cost, with technical detail available for the teams who need it.
We sell no products and take no position on the transaction, so findings are stated plainly for whichever side engaged us.
Cybersecurity has become a standard part of due diligence. Inherited breaches, unpatched systems, and compliance gaps can change the value of a deal or the cost of integration, and they are far cheaper to find before closing than after. Our role is to give buyers, sellers, and investors an independent, evidence-based view of security risk and a realistic plan to address it. Our IT security audit is where most assessments start.
What we assess depends on where the deal stands. For buyers, most of the work falls in diligence: an IT security audit and risk assessment of the target, with the target’s cooperation, and a review of the vendors that come with it. For sellers, the best time is before a letter of intent, while there is still room to fix what we find. After closing, a network security audit comes before the two environments are connected. Each report turns findings into business risk and remediation cost, and an Auditor Opinion Letter can document the result for investors. Our support continues for three months after delivery.
Most organizations begin with one engagement and build from there. Find the situation closest to yours:
Not sure? A free consultation will help you decide.
Altius IT has performed independent security audits for over 30 years. We have no stake in the transaction and no products to sell, so our findings are independent, and as CISA-certified auditors we are authorized to issue formal audit opinions. We tailor every engagement to your side of the deal, your timeline, and the systems in scope.
As early in the process as access allows. Findings before signing can shape price and terms; findings after signing can only shape the integration plan. If you are the seller, assessing yourself before diligence begins gives you time to fix issues on your own terms.
Yes, with the target’s cooperation and access. The scope is agreed in advance and usually focuses on the systems, data, and obligations most relevant to the deal. Where access is limited, we assess what is available and document what could not be verified.
Before the networks are fully connected, a network security audit and an IT security audit of the combined environment show where integration could open new paths for attackers. Our vCISO service can then help guide security planning through the transition.
Every engagement is customized. Explore other common needs, or see what we recommend for your industry.
