Cybersecurity services firm due diligence

Due diligence is verification rather than judgement. In a security firm, some of the findings that matter most may not be in the financial statements. They can sit in a master service agreement’s liability clause, in an incident register thinner than it should be, or in a library of detection rules nobody can prove the firm owns. This page is a verification plan for that stage: which documents to request, which searches to run, what a bad finding looks like and what it means for the deal. It assumes the seller has agreed to share information under a confidentiality agreement.

Read the contracts for exposure, not only revenue

Request every client contract and read it twice: once for what the firm is paid, once for what the firm has promised. Mark the liability cap, any carve-outs from it, indemnities for data loss, service-level penalties, and the clauses on assignment and change of control. A cap that looks reasonable can be undone by a carve-out, for example for breach of confidentiality. Compare the contracts with the insurance schedule: where the policy responds to less than the contract promises, the difference falls on the firm’s own balance sheet. An assignment clause that needs client consent can turn a signed contract into a closing condition. The finding that matters is a pattern, such as the largest accounts all carrying the least favourable terms.

Check the firm’s own incident record

Ask for the register of breaches of security safeguards that PIPEDA requires the firm to keep for every breach involving personal information under its control, and for the reasoning behind any decision not to report one. The Privacy Commissioner’s guidance says records must contain information that lets the Office verify compliance with the reporting and notification requirements, including the assessment of real risk of significant harm, and that the law requires breach records to be kept for two years. An empty register deserves as much attention as a full one, since it can mean a clean year or no process, and the way to tell is to ask for ticket history, the last incident exercise and any client notifications. In Quebec, the Commission d’accès à l’information describes a register of confidentiality incidents and a duty to notify where there is a risk of serious injury, so a firm serving Quebec clients should be able to show both.

Look for claims that have not arrived yet

A client’s claim over past work can surface long after an engagement closes. Ontario’s Limitations Act, 2002 provides that, unless the Act says otherwise, a proceeding shall not be commenced after the second anniversary of the day the claim was discovered, and it adds a separate ultimate period of 15 years from the act or omission on which the claim is based (section 15, which has its own exceptions), so exposure for old work depends on when a client discovers a problem, within that outer limit. Other provinces have their own limitation statutes. Ask for a list of complaints, threatened claims, insurer notifications and disputed invoices, and for how the policy treats claims made after the sale for work done before it. A claim already notified to the insurer is on record with it. One that has been discussed but never notified may be a risk the buyer would otherwise carry.

Verify who owns the work and who does it

Detection rules, playbooks, scripts and report templates belong to the firm only if the firm owns them. Ask for the agreements under which employees and subcontractors created that material, and check that rights were assigned to the firm rather than left with the individual; the Canadian Intellectual Property Office describes an assignment of copyright as the transfer of some or all of the owner’s rights, which is why the paperwork matters. Then look at how workers are engaged. The CRA says all the facts of a working relationship, not only the parties’ intention, decide whether someone is an employee or self-employed, so a team of long-serving contractors working under the firm’s direction is a finding that may have payroll consequences. Finally, list the third-party tools, platforms and reseller agreements the service runs on, and confirm each can continue under new ownership.

Run the registry searches and test the firm’s own hygiene

Search for registered security interests in each province where the firm is registered or holds assets: Ontario’s Personal Property Security Registration system, British Columbia’s Personal Property Registry, or Quebec’s register of personal and movable real rights. A registration shows that a secured party claims an interest in the firm’s property, and which assets it covers decides what must be discharged at closing. Then hold the firm to the standards it recommends. The Canadian Centre for Cyber Security’s email guidance covers multi-factor authentication and domain-based message authentication, and a security firm that does not follow guidance of this kind is worth a question.

What a finding means for the deal

• Uninsured or under-insured liability from past engagements can be addressed through a price adjustment, a specific indemnity or a holdback.
• An undisclosed prior incident raises a second question, which is why it was not disclosed, because the answer may show how the firm treats bad news.
• Analyst resignations clustered around the sale may lead to retention payments or a closing condition on named people.
• Contracts that need client consent to assign can become closing conditions, and the price may move for clients who decline.
• Subcontractors who look like employees may leave a payroll exposure that the seller could be asked to resolve or indemnify.