Due Diligence & Risk Management

We establish the real cyber and compliance risk in a transaction, a vendor or your own organization, and state its business consequence.

Get Started

Who this is for

Deal timelines are short and security findings can change a price, a structure or a decision to proceed. The work is built for buyers who need answers inside those limits.

  • A private equity or corporate development team evaluating an acquisition or investment and needing to understand cyber exposure before signing.
  • A company preparing for sale that wants to find and fix security and compliance issues before a buyer does.
  • A CISO or risk officer who must run a formal, defensible risk assessment of the organization.
  • A procurement or security team responsible for assessing and monitoring the vendors that touch company data.
  • A board or audit committee asking for independent assurance of the company's cyber risk position.

What's included

The scope varies by situation. Buy-side diligence, sell-side preparation, enterprise risk assessment and vendor risk each draw on a different mix of the following.

  • Security posture review

    We evaluate governance, identity and access, network and cloud security, endpoint protection, logging and monitoring, and incident response against the target's size and sector.

  • Compliance and regulatory review

    We test the target's stated obligations, such as HIPAA, PCI DSS, SOC 2 or privacy law, against evidence that it meets them.

  • Incident and breach history

    We examine past incidents, notifications, regulator correspondence and open litigation for exposure that may transfer to you.

  • Technical sampling

    We run targeted external exposure checks and review architecture and configuration samples to confirm what management has told you.

  • Enterprise risk assessment

    We identify assets, threats and vulnerabilities, rate likelihood and impact, and build a risk register that leadership can act on.

  • Third-party risk program

    We design vendor tiering, due diligence questionnaires, review criteria and ongoing monitoring tied to the data each vendor touches.

  • Vendor assurance review

    We read vendors' independent audit reports and certifications and identify what they do and do not cover.

  • Integration and remediation planning

    We estimate the cost, effort and sequence of closing each material gap after close.

How an engagement works

Transaction diligence runs on the deal clock. Program-level risk work runs longer.

  1. Scoping and information request

    We agree objectives, thresholds for material findings and the target's data room or document set, then issue a tailored request list.

    1 to 3 days for deals, about 1 week otherwise

  2. Document and evidence review

    We review policies, audit reports, architecture documents, vendor lists, incident records and contracts, and flag gaps and contradictions.

    Typically 1 to 2 weeks

  3. Interviews and technical validation

    We interview security, IT and compliance leaders and sample technical controls to test what the documents claim.

    Typically 1 to 2 weeks

  4. Risk rating and analysis

    We rate each finding by likelihood and business impact, separate deal-relevant issues from routine hygiene, and estimate remediation cost.

    About 1 week

  5. Reporting and briefing

    We deliver an executive summary and detailed report, then brief your deal team, board or risk committee and answer questions.

    About 1 week

Typical transaction diligence runs 2 to 4 weeks. An enterprise risk assessment typically runs 4 to 8 weeks, and a third-party risk program build typically runs 6 to 12 weeks.

What you receive

Reports are written for the people who must decide, not only for the people who must fix.

  • An executive summary with an overall risk rating and the findings most likely to affect price, structure or timing.
  • A detailed findings report with evidence, risk ratings and recommended actions.
  • A risk register covering threats, likelihood, impact and recommended treatment.
  • A remediation and integration cost estimate with sequencing.
  • For vendor work, a tiering model, assessment questionnaires and a review calendar.
  • A scoped list of questions and conditions to raise with the seller, vendor or management, such as indemnities, escrow, or remediation commitments before close.
  • A readout session with your leadership team.

Frameworks and standards

We anchor every rating to a published method, so the result can be explained to a board, an investment committee or a regulator.

  • NIST CSF 2.0

    The six functions, including Govern, give a consistent structure for rating a security program.

  • NIST SP 800-30

    Guidance for conducting risk assessments, which shapes our likelihood and impact analysis.

  • NIST SP 800-161

    Guidance on cybersecurity supply chain risk management, used in third-party program design.

  • ISO/IEC 27001 and ISO/IEC 27005

    The management system certification and the companion guidance on information security risk management.

  • SOC 2 attestation reports

    Independent CPA firm reports that we read for scope, exceptions and complementary user entity controls.

  • Sector and privacy rules

    HIPAA, PCI DSS v4.0.1, GDPR and CCPA as amended by CPRA, applied where the target or vendor handles regulated data.

Why Velero

Diligence is only useful if the reader trusts the conclusions and can act on them quickly. Our method is designed around both.

  • Built for decisions

    We separate findings that change a deal or a vendor decision from routine hygiene, so your team is not buried in a long list.

  • Independent and senior-led

    We have no stake in the transaction or the vendor, and experienced practitioners lead the review and write the conclusions.

  • Plain-English reporting, with remediation support

    Findings are stated in business terms with cost and effort attached, and we can help plan and carry out the fixes after close or after the assessment.

FAQCommon questions

How early in a deal should cyber diligence start?

Start as soon as a target is under serious consideration, ideally before exclusivity. Early findings strengthen your position on price and terms. Late findings often leave you with fewer options than you would have had.

Can you assess a target without access to its systems?

Yes, to a point. Document review, interviews and external exposure checks need no system access. Deeper technical validation requires the target's consent, and we scope the depth to what the deal allows.

Do you help sellers prepare for diligence?

Yes. A sell-side review applies the same method a buyer would, so you can fix or document issues before they reach a data room.

What is the difference between a risk assessment and a compliance audit?

A risk assessment rates threats to your business by likelihood and impact. A compliance audit tests whether you meet a specific framework's requirements. They overlap, but a risk assessment can reveal exposure that no framework requires you to check.

How do you decide which vendors to review in depth?

We tier vendors by the sensitivity of the data they handle, their access to your systems and the business impact of an outage. Top-tier vendors receive full assurance review. Lower tiers receive lighter, periodic checks.

Related servicesExplore related services

Let's talkReady to secure your business?

Tell us what you're working toward and we'll get back to you within one business day.

Schedule a call