Cyber diligence in LMM M&A: what buyers actually want
TJ Moruzzi
Published At Mon Oct 19 2026
IT and cyber is the single most underprepared workstream in LMM data rooms. Sellers prepare audited financials, customer contracts, and legal records well. They show up for IT diligence with a one-page network diagram and an outdated antivirus license.
Modern PE buyers expect more. The post-2023 wave of cyber incidents in PE-backed portfolio companies pushed firms to standardize cyber diligence. Sellers who can't meet the standard get marked down at LOI or held up in diligence.
This post covers what modern PE buyers actually ask for, the SOC 2 vs vCISO trade-off, the 5 page security overview as interim solution, and when SOC 2 actually pays off.
What modern PE buyers ask for
Top of the list for most PE diligence teams in 2026:
- Security policies and incident response plan. Information security policy, acceptable use policy, access control policy, incident response playbook. PE buyers want documented policies, not informal practices.
- Penetration test results. Third-party pen test from the past 12 months. Findings, remediation status, current posture.
- Employee security training records. Security awareness training, phishing simulation results, completion rates by employee.
- Vendor risk assessment. List of critical vendors, security review status for each, contractual security commitments.
- Backup and disaster recovery. BCP/DR plan, RPO/RTO targets, test results from last 12 months.
- Access control evidence. MFA enabled by service, access provisioning/deprovisioning process, periodic access reviews.
- Data classification and handling. What data is sensitive, where it lives, who has access, encryption at rest and in transit.
- Logging and monitoring. SIEM coverage, alert response, log retention policies.
- Insurance. Cyber liability insurance, coverage limits, exclusions.
- Breach history. Disclosed breaches in the past 5 years, response, lessons learned.
A seller who can answer all 10 with documented evidence wins. A seller who can't gets discounted, held up, or both.
SOC 2 vs vCISO statement
Two paths to credibility:
SOC 2 Type 2. Formal third-party audit. Demonstrates controls operate effectively over a defined period. Costs $30-60K in fees plus 6-12 months of lead time. Required for SaaS businesses serving enterprise customers; often expected for tech-enabled services.
vCISO statement. A virtual CISO firm reviews the company's security posture, produces a formal letter describing controls and gaps. Costs $5-15K and takes 2-6 weeks. Suitable for businesses without enterprise SaaS customers but where buyers want third-party validation.
The trade-off:
- SOC 2: more credible, takes longer, costs more
- vCISO statement: less formal but useful, faster, cheaper
The right choice depends on what buyers expect for the deal type. SaaS businesses typically need SOC 2. Industrial businesses, healthcare facilities (HIPAA-adjacent), and financial services firms typically need formal audits. Mid-market services and distribution businesses usually do well with a vCISO statement plus strong policies.
The 5 page security overview as interim solution
Sellers who don't have SOC 2 and won't get it in time should produce a 5 page security overview before going to market. Contents:
Page 1: Security policy summary. Title, version, scope, key controls.
Page 2: Network and infrastructure. Architecture diagram, encryption posture, MFA coverage.
Page 3: Access control and identity. User provisioning, deprovisioning, MFA, periodic reviews.
Page 4: Vendor and data risk. Critical vendors, data classification, backup/DR, incident response.
Page 5: Compliance and certifications. Current posture (e.g., "preparing for SOC 2 Type 1"), insurance, breach history.
This 5 page document gives buyers enough to evaluate at IOI. It doesn't replace SOC 2 for sectors where SOC 2 is required, but it covers the gap for everyone else.
The LockRoom security overview at /sales/security-overview.md follows this structure as an example.
When to actually invest in SOC 2
SOC 2 pays off when:
- Customer base is enterprise SaaS. Customers ask for SOC 2 in vendor evaluation. Lacking SOC 2 caps the customer pipeline.
- Buyer pool includes SaaS-focused PE. Firms like Vista, Thoma Bravo, KKR's tech practice expect SOC 2 from acquisitions. Lacking it limits buyer pool.
- Deal size is $30M+. Below $30M, the cost of SOC 2 is hard to amortize against the M&A timeline. Above $30M, SOC 2 can affect the multiple by 0.5-1.0x.
- Sector has specific compliance requirements. Healthcare (HIPAA), financial services (NYDFS Cybersecurity), defense (CMMC) require formal certifications. SOC 2 is often complementary.
SOC 2 doesn't pay off when:
- Deal is sub-$15M
- Buyer pool is generalist PE or strategic acquirers
- Customer base doesn't ask for it
- Time to deal is less than 12 months (SOC 2 Type 2 needs at least 6 months of evidence)
The cost-benefit decision is usually clear once the seller has identified the buyer pool. Bankers should help the seller think this through 12-18 months before going to market.
Penetration test results
Pen test results are the single most-requested document in cyber diligence after policies. The bar:
- Test conducted in past 12 months
- By a recognized third-party firm (not internal IT)
- Comprehensive scope (not just web app)
- Remediation status documented for each finding
Sellers without recent pen test results have two options: get one quickly (4-8 weeks, $10-25K) or accept the discount. Most LMM sellers can run a pen test before going to market with no detrimental impact.
Common cyber diligence mistakes
Mistake 1: One page network diagram, nothing else. Insufficient. Modern buyers expect the full set.
Mistake 2: Out of date pen test (3+ years). Buyers discount this entirely. Run a fresh test before going to market.
Mistake 3: No documented incident response plan. Sellers say "we'd respond by calling our IT lead." Buyers want a documented playbook.
Mistake 4: Vendor list without security review. Critical vendors (cloud hosting, payroll, HRIS) need contractual security commitments. A seller without these signals weak vendor risk management.
Mistake 5: Burying breach history. Disclosed breaches lose less trust than discovered breaches. Disclose in the data room with response narrative.
Mistake 6: Letting cyber be the IT team's responsibility, not management's. PE buyers want management ownership of cyber, not IT-only ownership.
Breach disclosure
If the seller has had a security incident in the past 5 years, disclose. The disclosure should include:
- What happened (high level, no sensitive technical detail)
- Containment and response
- Customer or data impact
- Lessons learned and remediation
- Any regulatory or contractual notifications
Buyers find breaches in diligence. Disclosed breaches with strong response narratives demonstrate maturity. Hidden breaches found in diligence break trust.
Bottom line
Modern PE cyber diligence asks for 10 categories of evidence: policies, pen test, training records, vendor risk, BCP/DR, access controls, data classification, logging, insurance, breach history. Sellers who prepare get clean diligence; sellers who don't get marked down or held up.
SOC 2 is required for SaaS, financial services, healthcare. vCISO statement plus a 5 page security overview is sufficient for most LMM businesses outside those sectors.
Pen test in the past 12 months is non-negotiable for any deal above $20M. Disclosed breach with strong response narrative beats hidden breach found in diligence.
FAQ
Do I need SOC 2 for an LMM exit? SaaS businesses, fintech, healthcare-related: yes. Mid-market services, distribution, industrial: usually no. The right answer is buyer-pool dependent.
What's a vCISO statement? Letter from a virtual CISO firm describing your security controls and posture. Less formal than SOC 2, faster and cheaper to produce. Suitable when SOC 2 isn't required.
When should I run a penetration test before sale? 6-12 months before going to market. Run, remediate findings, document remediation. By the time the buyer asks, the test is current and findings are addressed.
What's the security policy package buyers expect? Information security policy, acceptable use, access control, incident response, change management, data classification, vendor risk. 7-8 documents, 3-10 pages each.
How does cyber posture affect the multiple? Strong cyber preparation can preserve 0.5-1.0x multiple. Weak preparation can cost 0.5-1.0x. The deltas are most pronounced for SaaS and tech-enabled services.
Should I disclose past security incidents? Yes. Hidden incidents found in diligence break trust. Disclosed incidents with strong response narratives demonstrate maturity.
What's the 5 page security overview? Interim solution for sellers without SOC 2. One page each on: policy summary, infrastructure, access control, vendor/data risk, compliance/insurance/breach history. Bridge document for IOI.
Who runs cyber diligence on the buyer side? PE-backed portfolio companies typically have a cyber lead at the firm or use third-party providers (Coalfire, Schellman, Drata, Vanta partners). The provider produces a memo for the deal team.
