editione1.0.0
Updated October 9, 2023Firstly, as mentioned above, this is not something to mess around with. Talk to your lawyer and let them help you navigate this process. It is their job to help you stay safe.
important Some tips on how you respond to a cybersecurity warranty request:
Like any other claim, promise, or decree in contract law, your responses to warranty checks should be in writing. If you do verbally discuss something, ensure that you also document and share a written statement (and that the two statements match).
Answer only the specific questions asked as part of the warranty. Remember, they don’t want to know everything about everything, they are asking very specific questions. If you are not clear about what they are asking, clarify before responding.
Tell the truth but keep it short and sweet. There is no need for qualifying or justifying statements when responding to warranty questions. You either meet the promise or you don’t. Your lawyer will help you answer in a way that is specific and accurate.
Remember that risks you escalate during financial due diligence have to be managed and accepted by the buyer. Ensure that before you raise a risk, you are explicitly clear about the severity, impact, likelihood, and scope of the issue. Your investor or buyer may be taking on director’s liability for your organization so they will inherit (and have to resolve) any risks they know about. Keep it focused and use the skills we learned in How to Handle Common Security Events to help you communicate.