| name | cyber-diligence-governance |
| description | Guides cyber due diligence and governance—M&A/investment diligence, vendor and third-party
assessments, questionnaire and evidence review, control maturity and gaps, integration risk, IC/board
cyber briefs, and governance cadence.
Use for target or vendor security diligence, SIG/CAIQ review, deal or procurement committee packs,
post-close integration planning, or IC/board cyber briefs—not pentest (penetration-tester,
web-pentester, network-pentester), AI governance only (ai-risk-governance), risk register without
diligence (security-risk-analyst), GRC audit prep (compliance-specialist), contract redlines
(commercial-counsel), closing logistics (transaction-manager), control deploy
(information-security-engineer), CISO strategy (chief-information-security-officer), or TPRM ops
(vendor-cyber-risk-analyst). Draft only; counsel and deal leads approve binding positions.
|
Cyber Diligence & Governance
When to Use
- Scope and run M&A or investment cyber diligence on a target or portfolio company
- Plan vendor and third-party security assessments (onboarding, renewal, concentration)
- Review security questionnaires (SIG, CAIQ, custom) and map answers to evidence
- Perform control maturity and gap analysis for diligence or governance (not full audit)
- Assess integration and transition risk (identity, data, tooling, contracts, talent)
- Prepare investment committee, deal team, or board cyber briefs with red flags and asks
- Design ongoing security governance cadence (committee packs, exception reviews, metrics)
- Coordinate diligence workstreams with legal, IT, HR, and product without owning closing
When NOT to Use
- Execute authorized penetration tests or exploit validation →
penetration-tester, web-pentester, network-pentester
- Classify AI use cases, model cards, or AI vendor data terms →
ai-risk-governance
- Maintain enterprise risk registers, FAIR scoring, or risk appetite without deal/vendor lens →
security-risk-analyst
- Stand up GRC programs, framework scope, or audit walkthrough prep →
compliance-specialist
- Automate SOC 2/ISO evidence collection →
compliance-engineer
- Negotiate contract redlines, DPAs, or liability terms →
commercial-counsel
- Run closing matrix, signatures, funds flow, or data room logistics →
transaction-manager
- Deploy IAM, SIEM, EDR, or remediate findings →
information-security-engineer
- Define CISO program strategy, risk appetite, or board operating model →
chief-information-security-officer
- Lead active incidents or SOC triage →
incident-responder, soc-analyst
- Operate standing TPRM intake, scoring, and continuous vendor monitoring →
vendor-cyber-risk-analyst
Related skills
| Need | Skill |
|---|
| AI use-case tiers, model governance, AI vendor review | ai-risk-governance |
| Risk registers, inherent/residual scoring, treatment | security-risk-analyst |
| GRC program, audit prep, questionnaire response library | compliance-specialist |
| Contract, DPA, indemnity, and commercial terms | commercial-counsel |
| Deal timeline, diligence coordination, closing | transaction-manager |
| Control implementation and remediation engineering | information-security-engineer |
| Executive security strategy and board operating model | chief-information-security-officer |
| Pentest findings as diligence input | penetration-tester |
| Enterprise security program and IR policy | cybersecurity |
| Standing vendor TPRM operations and monitoring | vendor-cyber-risk-analyst |
Core Workflows
1. Scope and charter
Define diligence or governance boundaries, stakeholders, timeline, and deliverables.
See references/cyber_diligence_governance_scope.md.
2. M&A and investment diligence
Request lists, evidence review, finding severity, deal protections, and integration themes.
See references/ma_and_investment_diligence.md.
3. Vendor and TPRM assessments
Tier vendors, depth of review, concentration, and renewal triggers.
See references/vendor_and_tprm_assessments.md.
4. Questionnaire and evidence review
Consistent answers, evidence pointers, stale-response controls, and SME routing.
See references/questionnaire_and_evidence_review.md.
5. Governance cadence and reporting
Committee rhythms, IC/board packs, metrics, and exception governance.
See references/governance_cadence_and_reporting.md.
6. Red flags and remediation
Severity rubric, deal terms, integration backlog, and acceptance criteria.
See references/red_flags_and_remediation.md.
Outputs
- Diligence scope memo — objectives, in/out of scope, timeline, roles
- Request list and tracker — ID, owner, status, evidence received
- Findings register — severity, evidence, recommendation, owner, target date
- IC or board brief — executive summary, top risks, asks, integration implications
- Vendor assessment summary — tier, gaps, conditions, renewal date
- Integration security backlog — Day 1 / 30 / 90 with dependencies
- Governance pack outline — agenda, metrics, exceptions, decisions needed
Principles
- Evidence over assertions — require artifacts; flag questionnaire-only claims
- Materiality and deal context — prioritize what affects valuation, liability, or integration
- Separate roles — diligence analysis ≠ legal advice ≠ control implementation
- Time-boxed depth — match review intensity to tier, deal stage, and access granted
- Explicit handoffs — route legal terms, AI programs, and engineering fixes to peer skills
When to load references
- Boundaries and RACI →
references/cyber_diligence_governance_scope.md
- Target or investment diligence →
references/ma_and_investment_diligence.md
- Vendor tiers and TPRM →
references/vendor_and_tprm_assessments.md
- SIG/CAIQ and evidence →
references/questionnaire_and_evidence_review.md
- Committees and board rhythm →
references/governance_cadence_and_reporting.md
- Severity and remediation →
references/red_flags_and_remediation.md
