A 100-day cybersecurity plan turns what cyber due diligence found into fixes after close. It runs in four stages: secure identity and backups in the first two weeks; confirm no attacker is already inside by day 30; roll out the firm's minimum security standard by day 60; and hand the deal team a measurable risk baseline by day 100. Doing this early protects value, because breaches and integration surprises hit EBITDA and exit multiples.
Why the first 100 days are high-risk
- Deal announcements attract phishing and wire-fraud attempts against finance teams.
- Founders' "temporary" admin accounts, shared passwords and unmanaged SaaS come with the company.
- Integration work opens new trust paths between the portfolio company, the fund and sister companies.
- Any breach that predates close is now the owner's problem. See our article on what M&A due diligence misses.
Days 0โ14: Stabilise
- Inventory privileged accounts; remove departed staff and unknown admins; enforce MFA on email, VPN, finance systems and cloud consoles.
- Verify backups exist, are isolated from the main network, and can actually be restored.
- Put out-of-band verification on all payment changes. Warn finance about deal-related fraud.
- Confirm who to call in an incident; add the company to the fund's IR retainer.
Days 15โ30: Confirm you're not inheriting an active breach
- Run a compromise assessment: endpoint telemetry, identity logs and email for signs of current or past intrusion.
- External attack-surface scan: exposed RDP, unpatched VPNs, forgotten subdomains.
- Document the findings with an owner and a date for each.
Days 31โ60: Apply the portfolio standard
Most funds define a minimum security baseline for every portfolio company. Ours includes:
- MFA everywhere; conditional access for administrators.
- EDR on all endpoints and servers, monitored 24/7 (MDR).
- Advanced email security and awareness training.
- Immutable or offline backups with tested restores.
- Patch SLAs by severity; vulnerability scanning.
- A written incident response plan.
Where integration is planned, sequence it here. Email and domain integration is usually the first visible step and the easiest to get wrong.
Days 61โ100: Baseline and report
- Score the company against the baseline and a framework such as CIS Controls IG1/IG2 or NIST CSF 2.0.
- Give the deal team a one-page risk summary: top 5 risks, the cost to fix, and the trend.
- Confirm cyber insurance meets the fund's standard and that the required controls are evidenced.
- Set the 12-month roadmap and decide on ownership: internal hire, vCISO or a managed provider.
Reporting cyber risk to the deal team
| Metric | Why it matters |
|---|---|
| % of users and admins with MFA | The single strongest predictor of account-takeover risk |
| % of endpoints with EDR reporting | Coverage gaps are where ransomware starts |
| Last successful backup restore test | Recovery capability, not backup existence |
| Critical vulnerabilities older than 30 days | Exposure trend |
| Open high-risk findings from diligence | Progress against the value-creation plan |
Integration risks to plan for
- Identity: trusts between directories, or shared admin accounts across companies, can let an intrusion at one company spread to another. Integrate identity deliberately, with least privilege.
- Email and domains: cut-overs create windows for phishing ("new IT system, please log in here"). Warn staff in advance and keep old domains protected with DMARC.
- Networks: site-to-site VPNs between portfolio companies and the fund widen the attack surface. Segment them and log them.
- Vendors: the acquired company's MSP may keep broad remote access. Review it and rotate credentials at close.
Questions for the operating partner to ask in week one
- Who has admin access to email, finance systems and the cloud, and is MFA enforced for all of them?
- When did we last restore from backup, and how long did it take?
- Is anyone watching security alerts tonight?
- What did diligence find, and who owns each finding?
- Who do we call if something happens this weekend?
If the answers are vague, the 100-day plan should start with identity, backups and monitoring before anything else.
Preparing for exit from day one
The buyer at exit will run their own cyber diligence. Keep the 100-day evidence (MFA coverage reports, restore tests, penetration test results, the risk register and remediation history) in one place, updated quarterly. A clean, documented security record shortens diligence and removes a common reason for price chips and escrow holdbacks.
Frequently Asked Questions
Who should own cybersecurity in a newly acquired portfolio company?
A named executive, often supported by a fund-level security lead or a vCISO, with clear reporting to the operating partner.
What should be fixed first after an acquisition?
Identity (MFA and privileged accounts), backups, and payment-fraud controls. These address the most common and most costly attacks.
Do PE firms need a portfolio-wide security standard?
Yes. A minimum baseline makes risk comparable across companies, simplifies insurance, and speeds up the next diligence at exit.
How long does post-acquisition email integration take?
It depends on size and platforms. Planning, identity alignment and cut-over are usually sequenced over several weeks to preserve day-one continuity.
Closing a deal this quarter? Defensible runs pre-LOI cyber diligence and the 100-day plan for PE firms and their portfolio companies. Scope a Pre-LOI Cyber Review.
