This cybersecurity due diligence checklist helps deal teams separate a target’s visible exposure from controls that need authorized review. Each item carries an area and access tag. Before authorization, Meo Advisors uses passive public sources only; scans, login attempts and penetration testing require written authorization and an agreed scope.
In short
- Start with passive public evidence of endpoints, certificates and security headers.
- Keep internal checks and active testing on an access request list until written authorization is in place.
- Record evidence and an owner for each finding; missing evidence stays an open question.
The cybersecurity due diligence checklist.
Use this checklist to organize a target’s external exposure review and the questions that need authorized access. Each item shows its area and access requirement.
List the target’s public domains and internet-facing endpoints using DNS, certificate transparency, third-party internet-scan datasets and public pages. Keep the source and observation date.
Record certificate issues supported by passive public evidence. Keep the affected endpoint and evidence with the finding.
Record security headers seen on the target’s public pages at normal browsing rates. Keep the page and observation date.
Flag exposed admin logins or services found in passive sources for review. Do not attempt a login or test whether the service is exploitable.
Identify public sites that share a template, so an observed weakness can be traced to the template that repeats it.
Ask the target to confirm which exposed services are intended to be public and who owns the work to close an exposure.
Request evidence for internal endpoints and controls that the passive external review cannot assess. Keep unanswered questions separate from confirmed findings.
Agree the scope and written authorization before port scans, vulnerability scans, login attempts or penetration testing. Authorized testing runs only on request.
Confirm an owner for each hardening action and the evidence that will show the issue has been addressed.
Source: Meo Advisors checklist. As of October 2026.
The scope follows our cybersecurity due diligence review: public exposure first, then an explicit request for the evidence that needs access.
How to use the cybersecurity due diligence checklist.
Work through the passive checks first, then turn the remaining questions into an access request list. A checklist item is complete only when its supporting evidence is recorded.
- Agree the target’s domains, the review scope and the public sources before collecting evidence.
- For each observation, retain its source, affected endpoint or page, observation date and the question it answers.
- Separate a confirmed finding from an open question. Missing evidence is never scored as a failure.
- Rank findings and name an owner. Request authorization before doing any check that crosses the access line.
Authorized testing is penetration testing and any check inside the target’s systems; it needs authorized access and runs only on request.
Which cyber checks need written authorization?
Port scans, vulnerability scans, login attempts, penetration testing and checks inside the target’s systems need written authorization. Before authorization, the cybersecurity checklist is limited to passive public sources.
| Visible from outside | Needs authorized access |
|---|---|
| External exposure review | Penetration testing on request, with authorization |
| Internet-facing endpoints | |
| Certificates and security headers |
Before authorization we use passive public sources only: DNS, certificate transparency, third-party internet-scan datasets, and the target’s public pages at normal browsing rates. No port scans, vulnerability scans or login attempts without written authorization.
The outside view does not establish how effective the target’s internal controls are. List the record or authorized test needed to answer each internal question.
What are red flags in due diligence?
Cyber red flags are evidence of exposure that could change deal terms or the hardening work after close. An exposed admin login, a certificate issue or a weakness repeated by a shared template belongs in the prioritized risk register, with its evidence and an owner.
| Risk | Likelihood | Impact | Owner |
|---|---|---|---|
| Lead-form consent wording | High | High | Marketing lead |
| Exposed admin login | Medium | High | IT lead |
The register is illustrative. The likelihood and impact of a real finding depend on its evidence; a public observation alone does not prove an exploitable vulnerability.
Copy the checklist into your diligence workplan.
Select and copy the checklist text into your working document. Add space for the evidence, status, open question and owner beside each item, and keep the access tags with the text.
Use the IT due diligence checklist for the infrastructure and internal technology evidence. The private equity due diligence checklist places cyber findings beside the other diligence areas. For calls and texts, use the TCPA compliance checklist.
Meo Advisors Editorial writes and maintains this page. Its numbers are Meo Advisors’ own statements or cited external benchmarks, and every mock is labelled Illustrative. See the editorial policy and corrections process.