Enterprises with vendor volume
Hundreds of suppliers, a small assessment team, and no way to tell which reviews matter most.
Home/Services/Third-Party Risk and M&A
Third-Party Risk and M&A
Judge the risk before you take it on
Much of an organization's cyber risk originates outside its own walls: in the vendors and platforms it depends on, and in the companies it acquires. We assess third parties, design the programs that manage them at scale, and provide cyber due diligence expressed in terms that inform valuation, representations and warranties, and integration planning.
Who it is for
Three situations this practice answers
Acquirers and investors
A transaction where the target's security posture is a valuation input and an integration cost.
Companies preparing to be acquired
A buyer's diligence team is coming, and the findings it will raise are still open.
What it solves
The problems clients bring to this practice
- Vendor assessments are the same length whether the vendor holds regulated data or sells office supplies.
- Assessment volume exceeds the capacity of the team doing it.
- A target's security posture is described in a management presentation and nowhere else.
- Identity consolidation and network connection risk are discovered after the networks are joined.
- A buyer raises findings that could have been closed months earlier.
- A portfolio has no comparable measure of security across its companies.
What you receive
Named deliverables, not a summary of findings
Every engagement in this practice produces artifacts somebody outside your organization can read and rely on.
- Vendor assessments scaled to criticality, covering controls, attestations, contracts, fourth parties, and monitoring.
- A third-party risk management program: vendor inventory, tiering, assessment methodology, onboarding and renewal workflow, contract requirements, and monitoring.
- Ongoing vendor reviews performed on your behalf to one consistent standard.
- Buy-side diligence on posture, compliance, signs of undiscovered compromise, product security, and remediation cost, framed for valuation.
- A sell-side readiness finding and a diligence package assembled so the security workstream closes quickly.
- A post-close integration plan covering identity consolidation, network connection risk, control harmonization, and compliance scope.
- Portfolio-wide assessment with comparable scoring across companies.
How an engagement works
The sequence, and what each step produces
Described as a sequence rather than a schedule. Duration depends on scope, and is agreed in the statement of work.
01
Tier
Sort third parties by the data and access each one holds, so effort follows exposure.
02
Assess
Examine controls, attestations, contracts, and fourth-party dependencies at the depth the tier calls for.
03
Decide
Express the finding as the commercial question in front of you: proceed, condition, price, or decline.
04
Monitor
Reassess on renewal and on change, rather than once at onboarding.
Services
7 services in this practice
Each has its own page setting out what it covers, who it is for, and what you receive.
- Third-Party Risk AssessmentVendor and service provider security assessments scaled to criticality, covering controls, attestations, contracts, fourth parties, and monitoring.Risk and maturity
- Third-Party Risk Management Program DesignBuild a TPRM program: vendor inventory, tiering, assessment methodology, onboarding and renewal workflow, contract requirements, and monitoring.Transactions
- Vendor Diligence OperationsOngoing vendor security reviews performed on your behalf, absorbing assessment volume while keeping a consistent standard of evaluation.Transactions
- Cyber Due Diligence for AcquisitionsBuy-side cyber due diligence on security posture, compliance, hidden compromise, product security, and remediation cost, framed for valuation.Transactions
- Sell-Side Readiness and Vendor Due DiligencePrepare for buyer security diligence: find and fix the issues that reduce valuation or delay close, and assemble a diligence package that moves fast.Transactions
- Post-Close Integration AssessmentPlan and manage security integration after close: identity consolidation, network connection risk, control harmonization, and compliance scope.Transactions
- Portfolio Company Security AssessmentStandardized cybersecurity assessments across a private equity or venture portfolio, with comparable scoring and portfolio-wide risk visibility.Transactions
Questions
Frequently asked questions
What does cybersecurity due diligence cover in an acquisition?
It evaluates the target's security program, control environment, regulatory compliance position, incident history and signs of undiscovered compromise, product security, data protection obligations, and technical debt, and estimates the remediation investment required after close.
What is a third-party risk management program?
A third-party risk management program is the structured process an organization uses to identify, assess, contract with, monitor, and offboard vendors according to the risk each relationship presents, so assessment effort is concentrated where the exposure is greatest.
Can you help us prepare to be acquired?
Yes. Sell-side readiness identifies and remediates the findings a buyer's diligence team is likely to raise, and assembles the documentation that lets the security workstream close quickly rather than delay the transaction.
Related
Practices most often engaged alongside
Cyber Risk and Maturity
Measure maturity against NIST CSF or CIS, quantify exposure in dollars, and know what to fix first.
View practiceRegulatory and Legal Compliance
Technical assessment behind privacy, healthcare, financial, and government obligations, often under counsel.
View practiceProduct and Application Security
Find what an attacker would find in your product, your APIs, and your cloud, before a customer's security review does.
View practiceStart with a confidential conversation
Thirty minutes on where your program stands against this standard, and what would have to be true for the answer to hold up.