A business may have security policies, a recent audit an an ambitious roadmap. Dem deh a useful starting points. An investor still need fi undastan weh di evidence actually establish, which risks remain an weh di next owna may need fi do.

Define di decision before yuh request di evidence

A diligence exercise have a timetable an a purpose. Di kweschan is weda fi proceed, weh fi investigate further or weh fi prioritize afta completion? Di ansa determine which information is material.

Bigin wid di business activities an dependency dem weh underpin di investment. A narrowly scoped review shuda seh weh it can establish inna di time weh deh deh an weh remain outside it reach.

Examine di scope a existing assurance

Di existence a one report nuh explain it coverage. Which systems dem did examine? Which versions an environments? Di work was a documentary review or an active assessment? Dem important findings did verify as corrected?

Dem kweschan ya help establish how much confidence a decision-maker can place inna di evidence. Dem also prevent one carefully bounded assessment fram being interpreted as assurance bout di whole organization.

Look pan operational ownership

Security work depend pan people, permissions an processes. Ask who own critical systems, who can authorize change an weh happen wen a key person or supplier nuh deh deh.

An issue may be technically straightforward fi correct but operationally difficult because access, knowledge or authority is concentrated. Dat affect di practicality an sequencing a remediation afta a transaction.

Mek uncertainty visible

Access during diligence is often limited. Som kweschan wi no ansa, an som asershan wi rilai pan infamieshan we di target provaid. Dem limitations deh belong inna di decision material.

A clear assessment separate verified observations, management representations an open questions. Further testing or specialist review can den be targeted weh it is most likely fi change di decision.

Carry di findings into integration

Diligence is most useful wen its findings survive di transaction. Material exposures shuda translate into named actions, dependencies an a realistic sequence fi di integration period.

Cyber findings inform di wider transaction process. Legal, financial an contractual judgments remain wid di relevant advisers. Di Cabinet’s role is fi provide a clear security perspective weh dem decision-makers can use.

Di objective is a clearer investment decision an a more informed plan fi weh come next.

A perspective fram di Cabinet
The Cybersecurity Cabinet