What IT and data-security questions can a buyer ask before acquiring a small business?

A buyer can ask how the target business protects its own systems, and the Canadian Centre for Cyber Security’s baseline cyber security controls for small and medium organizations make a practical question list. The Centre says its guidance should not be considered comprehensive, and each control is worded as what organizations “should” do. Treat the answers as information about the business, not as a pass or fail. Questions about sharing data during the deal itself are covered in What cybersecurity and data privacy checks should I do before buying a business?

Backups and incident planning

The baseline says organizations should back up systems that contain essential business information and ensure that recovery mechanisms effectively and efficiently restore those systems from backups. It adds that backups should be stored encrypted, with access limited to people who need it for testing or restoring. It also says there should be a written incident response plan naming who handles incidents and whom to contact among external parties, stakeholders and regulators. Ask to see the plan, and ask when a restore was last tested.

Accounts, administrators and cloud access

The baseline says accounts should be removed when employees no longer need them, administrator privileges restricted to an as-required basis, and two-factor authentication used wherever possible, with any decision not to use it documented. For a buyer, these become practical questions. Who holds administrator and cloud-account credentials today? Have former staff been removed? How will control of those accounts pass to you at closing, and in what order?

Outside IT providers and updates

If the business uses an outside IT provider, note that the baseline says organizations should evaluate their comfort level with how those providers handle and access their sensitive information, so ask for the provider’s contract and what access it holds. On updates, the baseline says organizations should enable automatic patching for all software and hardware, or set up full vulnerability and patch management. Ask which approach the business uses.

What privacy law adds

The Personal Information Protection and Electronic Documents Act (PIPEDA) refers to safeguards in clause 4.7 of its Schedule 1. The Privacy Commissioner’s guidance says PIPEDA does not specify particular security safeguards. It says personal information should be protected in a way that is appropriate to how sensitive it is, and that safeguards should be reviewed regularly. Ask when the business last reviewed or tested its safeguards. PIPEDA is federal law. If the federal Cabinet (the Governor in Council) is satisfied that a substantially similar provincial law applies, PIPEDA lets it exempt an organization, activity or class from PIPEDA for personal information collected, used or disclosed within that province, so confirm which law governs this business.