Sell-Side Cyber Exit Readiness Kit

Sponsors spend twelve months preparing a company's financials for a process and none preparing its security. Then a buyer's cyber diligence finds an incident nobody disclosed, an identity estate nobody cleaned up, or an MSP contract with no exit — and the finding lands as a price adjustment or an escrow ask at exactly the moment leverage is gone.

This is MNA-01's method run in reverse, six to eighteen months early, by the side that still has time to fix things.

The pre-mortem is the sponsor conversation on one screen. Score the company on the buyer's eight domains as it is today, then score it as it will be at launch after a funded programme. The sheet computes the acquisition-debt score both ways, the posture a buyer would take, the cost-to-cure they would price, and the escrow they would ask for — then sets the escrow avoided against the programme cost.

In the worked example a $475,000 programme moves the target from PRICE & PROTECT with a $712,000 escrow ask to PROCEED. That ratio is the whole argument for funding readiness, and it is the number an operating partner needs before they will approve anything.

02 Data-Room Index & Readiness Tracker (XLSX) — the 41 artifacts a buyer's diligence request list asks for, reorganised as the seller's folder structure, with have / current / clean-story flags, a readiness score and a launch-readiness verdict. Built so the cyber conversation closes in week one instead of running the whole confirmatory period.

03 Remediation-Before-Process Programme (XLSX) — 14 pre-loaded tasks in three phases: the walk-on items that must simply be gone, the items a buyer would price, and the proof that the rest is real. With budget, the evidence each task produces, and a check that the whole thing fits your launch window.

04 Disclosure Schedule Builder (DOCX) — the decision that actually matters, per finding: fix it, disclose it, or price it. Then schedule language patterns written in the structure of MNA-01's eight buyer representations, so the two kits literally answer each other — what a buyer asks you to represent, and what you are prepared to say. Plus a consistency check, because inconsistent disclosure is its own finding.

05 Management Presentation — Cyber Section (PPTX) — three slides: the numbers a buyer will test, the readiness programme before and after, and what a buyer inherits. Doubles as the source for the CIM paragraph.

06 Buyer Q&A Anticipation Bank (DOCX) — 18 questions a buyer's cyber team asks, each with an answer pattern (a number, a date, a folder) and the trap. This file exists because of a specific failure mode: the IT lead answering "what happens if he left tomorrow?" honestly and unrehearsed is how an otherwise clean process acquires a finding. Rehearsed is not the same as coached — the answers are true, they are just prepared.

07 Practitioner Guide (PDF) — why sellers self-diligence, how MNA-02 differs from MNA-01, the pre-mortem, fix versus disclose versus price, the programme, the data room, schedules, the presentation and Q&A, an 18/12/6-month timeline, roll-up specifics, insurance and RWI, running it as a sponsor-wide programme, and the failure patterns.

Who buys it. Sponsors and owners preparing an exit, and the fractional CISOs they engage to run the readiness programme — which is a defined twelve-month scope with a funded budget and a board-visible outcome, so it is a better-shaped engagement than most.

The worked example is invented: Harbor Point Capital preparing Northstar Roofing Group, both fictional, as is every other entity named in the kit.

Pairs with MNA-01 — the buyer's side of the same method, and the portfolio dashboard for running pre-mortems across a whole portfolio. The Both Sides of the Deal bundle is the pair.

Deal preparation, not legal advice. Counsel drafts the schedules.