Cyber & Security: The Area That Catches Almost Everyone Out

Of all nine areas, this is the one I'd flag as one of the hardest, because in my experience, it's the one sellers, and their advisers, are least prepared for.

Cyber and security due diligence covers data protection compliance, security policy, incident history, access controls, backup and disaster recovery arrangements, and cyber insurance. None of it is exotic. All of it is specialist enough that most accountants and solicitors simply aren't equipped to guide a business through it.

Having previously run a managed services business, this was the one area where I could see clearly how much of a gap exists industry-wide, including among MSPs themselves, despite security being what they sell for a living.

Most MSPs have never formally tested an incident response plan, documented their own access controls, or produced anything resembling a coherent internal security policy, not through negligence, simply because nobody's ever asked them to, until a buyer does.

The genuine size of this work depends on where you're starting from, but the direction of travel is always the same: get the policies written, the access controls tidied up, and a basic incident response plan in place, well before anyone asks. It's specialist work, but it's not open-ended work. There's a finite, knowable list of what a buyer wants to see.

If this has you wondering how ready your own business is, the free readiness assessment will show you where to look first, in about three minutes.