Cyber Security in Swiss M&A transactions: Identifying, assessing and addressing digital risks
Articles
Legal
Data / Technology / IP
Regulatory Compliance
Transactions / M&A
Cyber risks can have a significant impact on a company's value. Here's what matters when addressing cyber security in M&A transactions.
Dr. Martin Eckert
Legal Partner
Nicolas Wittlinger
Legal Associate
In M&A transactions, the focus is increasingly shifting beyond financial, tax and traditional legal issues to include digital risks as part of the due diligence process (Digital Legal Due Diligence[1]). In particular, for data-driven businesses and companies with digital business models, cyber security, information security and cyber resilience can be critical value drivers. Robust cyber security due diligence has become market standard in Switzerland. Identified weaknesses can have a direct impact on both the valuation of a target company and the contractual terms of a transaction.
1. Why is cyber security becoming more important in M&A transactions?
Cyber security is no longer solely an IT issue. Cyber attacks, data breaches, system outages and regulatory violations can affect enterprise value, put customer relationships at risk and result in significant costs. At the same time, cyber resilience is increasingly becoming a factor of trust and competitive advantage. Companies must not only protect their systems adequately, but also demonstrate to customers, investors and business partners that they can systematically identify, manage and mitigate cyber risks.
At the same time, cyber security regulation continues to expand. Across Europe and increasingly in Switzerland, cyber security is evolving from a technical matter into a compliance and governance issue. In addition to data protection laws such as the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), regulatory frameworks such as the Cyber Resilience Act (CRA), the Network and Information Security Directive (NIS2), the Digital Operational Resilience Act (DORA) and various national cyber security requirements are becoming increasingly important.
For Swiss companies, EU cyber security regulations may have a direct impact on access to the European market. The Cyber Resilience Act (CRA), for example, introduces extensive cyber security requirements for products with digital elements marketed in the European Union (Cyber Resilience Act). Likewise, Switzerland's Informationssicherheitsgesetz (Swiss Information Security Act) reflects the broader trend towards stronger regulation of information security and cyber security (Swiss Federal Act on Data Protection und Update regarding Swiss Federal Act on Data Protection).
For this reason, a cyber security due diligence typically requires close cooperation between M&A, technology, privacy, compliance and regulatory specialists.
2. Which cyber risks are most relevant in M&A transactions?
Cyber risks are not always immediately visible during a standard due diligence. Some risks can be identified through contracts, policies, audit reports, compliance documentation or management interviews. Others become apparent only through a dedicated cyber security assessment or a more in-depth cyber security due diligence.
Key risk areas typically include the following:
Cyber incidents and security breaches Cyber attacks that have already taken place, data breaches or compromised systems (ransomware) can have significant financial, regulatory and operational consequences.
Compliance gaps Breaches of data protection, information security or other regulatory requirements can lead to remediation costs, regulatory proceedings and liability exposure.
Third party and supply chain risks Security deficiencies or service disruptions affecting third parties like cloud providers, software suppliers or other critical service providers can directly impact the target company's risk profile. This is particularly relevant where contractual risk allocation is not properly mirrored along the supply chain.
Contractual risks Security guarantees, Service Level Agreements (SLAs), reporting obligations, audit rights and liability provisions towards customers and suppliers can have financial consequences in the event of a cyber incident.
Artificial Intelligence (AI) The use of AI systems, particularly unauthorised applications (shadow AI), may create data protection, compliance, confidentiality and intellectual property risks. As a result, AI governance is becoming an increasingly important component of cyber security due diligence.
Depending on the business model and sector, different risks may become more significant. The primary aim of a cyber security due diligence is not to identify individual technical vulnerabilities, but to develop a comprehensive understanding of a company's overall cyber risk profile.
3. Security maturity level and cyber resilience as a due diligence focus
A cyber security due diligence does not primarily focus on whether cyber incidents have already occurred. Rather, it evaluates how cyber security, information security and risk management are organised within the company (security maturity level; certification level) and whether the company is capable of responding effectively to cyber incidents and maintaining business operations during disruptions (cyber resilience; contingency plans).
The assessment of security maturity levels and cyber resilience typically focuses on the following questions.
Is cyber security embedded at management level? Security maturity starts with governance and risk management. Key considerations include whether responsibilities are clearly defined, whether executive management and the board of directors actively address cyber security issues and whether cyber risks are integrated into the company's Internal Control System (ICS) and broader risk management framework.
Are appropriate security measures in place? Areas typically reviewed include internal security policies, Information Security Management Systems (ISMS), data backup concepts and Identity & Access Management (IAM) such as multi-factor authentication.
Certifications such as ISO 27001 may provide additional indicators of organisational maturity.
How does the company deal with incidents? Another key area concerns a company’s cyber resilience. Relevant questions include whether the company has established incident response and crisis management procedures, adequate contingency and business recovery plans, documented incident reporting processes and cyber insurance policies in place.
How resilient are critical processes and systems? Operational resilience focuses on business-critical systems and processes. Which systems are essential for business operations? To what extent does the company depend on third-party providers? How quickly can essential services be restored after a disruption? Which certifications are in place? Are any industry-standard certifications missing?
Are there any regulatory or contractual risks? The assessment goes beyond technical and organisational measures. It also examines compliance with regulatory requirements and contractual obligations relating to cyber security, information security and data protection.
Depending on the business model, particular attention may be given to security guarantees, audit rights, reporting obligations, Service Level Agreements (SLAs) and outsourcing arrangements. Especially critical are contractual coverage gaps where obligations assumed towards customers are not adequately backed by corresponding contractual commitments and liability provisions from suppliers or service providers.
Does the company have sufficient control over its IT providers and supply chain? Additional risks may arise from IT providers and the broader supply chain. Are there robust contractual warranties and commitments from IT service providers and suppliers? Or would the target company have limited legal recourse in the event of a cyber incident affecting those providers or suppliers?
4. Cyber security due diligence in Switzerland: Valuation and contractual risk allocation
The findings of a cyber security due diligence rarely remain without consequences. Identified risks, together with insights relating to security maturity and cyber resilience, are regularly reflected in the valuation of the target company and in transaction negotiations.
Impact on valuation Where significant weaknesses are identified, additional investments and remediation efforts may be required. Security vulnerabilities often need to be addressed, legacy systems modernised and regulatory requirements implemented.
Integration costs must also be considered. Following closing, the target's security standards often need to be adjusted to the buyer’s requirements. Different security standards, legacy technology environments and insufficient processes can significantly increase post-merger integration costs particularly where industry-standard certifications need to be obtained after closing.
Contractual risk allocation The findings of the cyber security due diligence should be reflected in the contractual terms. The specific terms depend on the target company's business model, the identified risks and the overall level of security maturity and cyber resilience. The key objective is an appropriate allocation of risk. Not every cyber risk justifies a specific contractual provision. The decisive factor is whether the risk is concrete, material and relevant to the transaction.
Cyber security due diligence findings are reflected in a Share Purchase Agreement (SPA) through the following mechanisms:
Representations and Warranties Representations and warranties may cover compliance with regulatory requirements, data protection, information security, certifications, material IT systems, the absence or disclosure of known cyber incidents and, where relevant, the use and governance of artificial intelligence.
The exact wording is often the subject of negotiations. Sellers frequently insist on knowledge qualifiers, materiality thresholds and time limitations
Indemnities Specific indemnities may be agreed for cyber risks identified during the due diligence process or disclosed cyber incidents.
Covenants The parties may agree on obligations requiring certain actions before or after signing or closing. Examples include remediation of identified vulnerabilities, implementation of additional security controls or complying with regulatory requirements such as the Cyber Resilience Act (CRA). Such obligations can be critical in practice. For example, if a target company is unable to comply with the CRA requirements for connected products by the applicable deadline of 11 December 2027, it may face substantial operational and commercial risks, including restrictions on access to the EU internal market.
5. Cyber security as an aspect of post-merger integration
Cyber security due diligence is not only about identifying risks before signing or closing. It also provides valuable insights for the integration phase following completion of the transaction.
Identified vulnerabilities must be remediated. Security standards should be harmonised. Contracts may require adjustment. Access rights, multi-factor authentication, backup strategies and incident response processes should be aligned across the organisation. Regulatory requirements and existing compliance risks also remain relevant after closing.
Cyber resilience should therefore not be viewed solely as a due diligence topic. It is equally an important aspect of successful post-merger integration. Companies that address cyber security early in the transaction process are generally better positioned to manage integration risks, control integration costs and avoid unexpected issues.
6. How Can MME support your cyber security due diligence?
Cyber security due diligence requires the integration of multiple specialist perspectives and areas of expertise. This is where MME's proven interdisciplinary approach creates value.
MME's M&A team can assess cyber risks within the context of a transaction and evaluate their impact on valuation, contractual terms and risk allocation. At the same time, clients benefit from the expertise of MME's dedicated cyber risk response team (Cyber Risk Desk) in the areas of data protection, technology, cyber compliance, regulatory requirements and cyber resilience (Cyber Risk Readiness Assessment).
In practice, a dedicated cyber security workstream has proven effective. Depending on the transaction and risk assessment, the scope and depth of cyber security due diligence can be tailored to the circumstances of the target company. The process typically begins by determining the relevance of cyber security for the target business. Based on this assessment, the parties define the scope and depth of the review. Specific information requests can then be addressed to the target company, relevant documentation can be analysed and the findings can be incorporated into the contractual terms.
Where deeper technical reviews are required, MME combines the expertise of specialised technical partners with extensive experience gained from assisting clients in cyber incident response matters (Cyber Incident Response Retainer). The key objective is to ensure that technical findings do not remain isolated from the transaction process but are translated into legal and commercial recommendations that support informed decision-making throughout the transaction lifecycle.
[1]For further discussion on the acquisition of companies in the digital economy, see: Eckert Martin, Umgang mit Transaktionsrisiken (2.Teil), EXPERT Focus, 2027/3, S. 163 ff.; Umgang mit Transaktionsrisiken (Teil 1-3).
