

Be aware that the company may be on a criminal's radar screen. The reasoning behind this is to determine if any significant gaps need to be remediated before proceeding.ĭon't present the company as a soft target.

The second step is to ensure existing cybersecurity tools and processes are working and up to date before announcing the M&A. SEE: Incident response policy (TechRepublic Premium) Having a checklist of who to call and what resources those responsible for cybersecurity will need to clean up the mess will help them get through the process faster and with less impact than if they need to spend the first 24-72 hours figuring out what needs to be done. It could damage the company brand, customer relationships and put the business in a poor competitive situation when trying to merge a business or execute on a new ownership arrangement, so there is a reluctance to share the company's "dirty laundry." What steps can businesses being acquired take to mitigate cyber threats?Ĭrowley: The first step, if it is not already in place, is to have an incident response plan. Why aren't more companies aware of the increased likelihood of a cyberattack during an M&A?Ĭrowley: It's embarrassing to report this type of cybercrime. In the case of ransomware, they will obtain access to sensitive files, encrypt them-so applications and business processes stop working-and demand a ransom payment from the company to regain access to the files. If it's an intellectual property attack, they may steal product designs, pricing information or other sensitive business information and leave without anyone knowing there was a breach. Once they have found credentials to access systems, they can move around the networks and applications to determine where the most sensitive data is. A phishing attack via email is a pretty common and effective approach. The cybercriminal could use a variety of methods to get into the network.

Cybersecurity is one of the last things on upper management's radar during a merger or acquisition, but it should be one of the first considerations.
