cyber-diligence-governance

Cyber Diligence & Governance

When to Use

Scope and run M&A or investment cyber diligence on a target or portfolio company
Plan vendor and third-party security assessments (onboarding, renewal, concentration)
Review security questionnaires (SIG, CAIQ, custom) and map answers to evidence
Perform control maturity and gap analysis for diligence or governance (not full audit)
Assess integration and transition risk (identity, data, tooling, contracts, talent)
Prepare investment committee, deal team, or board cyber briefs with red flags and asks
Design ongoing security governance cadence (committee packs, exception reviews, metrics)
Coordinate diligence workstreams with legal, IT, HR, and product without owning closing

Execute authorized penetration tests or exploit validation → penetration-tester, web-pentester, network-pentester
Classify AI use cases, model cards, or AI vendor data terms → ai-risk-governance
Maintain enterprise risk registers, FAIR scoring, or risk appetite without deal/vendor lens → security-risk-analyst
Stand up GRC programs, framework scope, or audit walkthrough prep → compliance-specialist
Automate SOC 2/ISO evidence collection → compliance-engineer
Negotiate contract redlines, DPAs, or liability terms → commercial-counsel
Run closing matrix, signatures, funds flow, or data room logistics → transaction-manager
Deploy IAM, SIEM, EDR, or remediate findings → information-security-engineer
Define CISO program strategy, risk appetite, or board operating model → chief-information-security-officer
Lead active incidents or SOC triage → incident-responder, soc-analyst
Operate standing TPRM intake, scoring, and continuous vendor monitoring → vendor-cyber-risk-analyst

Need	Skill
AI use-case tiers, model governance, AI vendor review	`ai-risk-governance`
Risk registers, inherent/residual scoring, treatment	`security-risk-analyst`
GRC program, audit prep, questionnaire response library	`compliance-specialist`
Contract, DPA, indemnity, and commercial terms	`commercial-counsel`
Deal timeline, diligence coordination, closing	`transaction-manager`
Control implementation and remediation engineering	`information-security-engineer`
Executive security strategy and board operating model	`chief-information-security-officer`
Pentest findings as diligence input	`penetration-tester`
Enterprise security program and IR policy	`cybersecurity`
Standing vendor TPRM operations and monitoring	`vendor-cyber-risk-analyst`

Define diligence or governance boundaries, stakeholders, timeline, and deliverables.

See references/cyber_diligence_governance_scope.md.

Request lists, evidence review, finding severity, deal protections, and integration themes.

See references/ma_and_investment_diligence.md.

Tier vendors, depth of review, concentration, and renewal triggers.

See references/vendor_and_tprm_assessments.md.

Consistent answers, evidence pointers, stale-response controls, and SME routing.

See references/questionnaire_and_evidence_review.md.

Committee rhythms, IC/board packs, metrics, and exception governance.

See references/governance_cadence_and_reporting.md.

Severity rubric, deal terms, integration backlog, and acceptance criteria.

See references/red_flags_and_remediation.md.

Diligence scope memo — objectives, in/out of scope, timeline, roles
Request list and tracker — ID, owner, status, evidence received
Findings register — severity, evidence, recommendation, owner, target date
IC or board brief — executive summary, top risks, asks, integration implications
Vendor assessment summary — tier, gaps, conditions, renewal date
Integration security backlog — Day 1 / 30 / 90 with dependencies
Governance pack outline — agenda, metrics, exceptions, decisions needed

Evidence over assertions — require artifacts; flag questionnaire-only claims
Materiality and deal context — prioritize what affects valuation, liability, or integration
Separate roles — diligence analysis ≠ legal advice ≠ control implementation
Time-boxed depth — match review intensity to tier, deal stage, and access granted
Explicit handoffs — route legal terms, AI programs, and engineering fixes to peer skills

Boundaries and RACI → references/cyber_diligence_governance_scope.md
Target or investment diligence → references/ma_and_investment_diligence.md
Vendor tiers and TPRM → references/vendor_and_tprm_assessments.md
SIG/CAIQ and evidence → references/questionnaire_and_evidence_review.md
Committees and board rhythm → references/governance_cadence_and_reporting.md
Severity and remediation → references/red_flags_and_remediation.md