|
We have worked with numerous unicorn companies with the coveted $1B+ valuation on a rocket ship trajectory toward a big exit. For these companies, inevitably cybersecurity enters into the conversation during the due diligence stage. Here are the four (4) cybersecurity topics late-stage start-ups need to consider:
𝗘𝗻𝘁𝗲𝗿𝗽𝗿𝗶𝘀𝗲 𝗥𝗶𝘀𝗸 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁:
The focus shifts from security/compliance to ERM. Late-stage start-ups benefit by getting serious about governance, risk management, and the ability to communicate it to the board and potential acquisition partners. We generally use compliance initiatives like ISO 27001 or SOC 2 as the impetus for our clients to develop and mature their ERM programs.
𝗦𝗮𝗿𝗯𝗮𝗻𝗲𝘀 𝗢𝘅𝗹𝗲𝘆 (SOX) 𝗥𝗲𝗮𝗱𝗶𝗻𝗲𝘀𝘀:
Pre-IPO startups start prioritizing projects to get their financial controls in order. They need to prove they can survive a financial audit. This includes cybersecurity and IT General Controls (ITGCs) that will be assessed as part of SOX compliance. Failure to mature here could cost millions in a valuation or push off IPO timelines. Late-stage tech startups generally have the benefit of having experienced external audits, such as with SOC 2, and those experiences serve as a head start on SOX IT controls.
𝗩𝗮𝗹𝘂𝗮𝘁𝗶𝗼𝗻:
Valuations directly impact the wallet of business owners, employees, and everyone whose wealth is tied to a successful exit outcome. Missteps could cost millions. Valuations are part art, part science. Revenue, market size, growth rate, churn, liabilities, and a hundred other things are considered. Cybersecurity posture is something that can be a strength or could cost start-ups a percentage point. There are also potential claw-backs if a breach happens post-sale. Getting cybersecurity right, and right-sized is an important investment for ownership.
𝗕𝗲𝗶𝗻𝗴 𝗣𝘂𝗿𝗰𝗵𝗮𝘀𝗲𝗱 𝘃𝘀 𝗚𝗼𝗶𝗻𝗴 𝗣𝘂𝗯𝗹𝗶𝗰:
There are some core cybersecurity standards that you are going to do no matter what. However, your cybersecurity focus areas are going to be different based on if you plan to be acquired versus plans to go public. For example, are we preparing for potential buyers and their diligence team? Is a PE firm taking over? Or are we preparing for a SOX audit with one of the big 4 accounting firms? These factors inform strategy.
Conclusion
Every start-up ready to exit needs to know four (4) main factors when it comes to cybersecurity including enterprise risk management, Sarbanes Oxley readiness, valuation, and being purchased versus going public.
