Five security questions that come up in due diligence

I’ve sat in due diligence rooms and watched stakeholders realise, in real time, that they don’t have answers to basic security questions. Not because they were careless. Because nobody told them the questions were coming.

Here’s what actually gets asked:

1. Who has access to production? “Everyone” is fine early on, but access needs to be logged, limited and auditable. Start access logging early. It costs nothing and proves everything.
2. What happens to your data if a vendor disappears? They want to know where customer data lives and who touches it. Map your critical data flows: one page, one day.
3. Have you had a security incident? The right answer isn’t “no”. It’s “yes, here’s what happened and what we changed”. Maturity beats perfection every time.
4. What’s your offboarding process? This one ends deals fast: former employees and contractors still active in systems nobody reviewed. Automate offboarding from day one.
5. Who owns security? Not necessarily a CISO or a team. One named person accountable for security decisions. That’s all they want.

None of this needs a big budget. All of it needs intention. The organisations that survive scrutiny made a handful of small decisions early that looked like overhead at the time.