The following resources are being made available to all CEOs and board members within the search fund ecosystem. You are free to customize and share these resources with others.
We strongly recommend that all CEOs, boards, and related stakeholders take a more active, consistent approach to cybersecurity both now and going forward. Attacks are escalating in both frequency and severity, and many of these attacks can be prevented with basic security policies and procedures in place.
Six Steps to Basic Cybersecurity Readiness
Here are six steps you can take today to start your journey to Cybersecurity Readiness.
- Appoint a cybersecurity compliance leader. Typically a COO, CFO, or CTO is recommended, and it should not be the CEO. Note: You should have an internal leader even if you use a vendor to manage most of your cybersecurity day to day.
- Establish a known good baseline. Use the Quickstart Assessment to get started.
- Establish applicable policies and procedures. If you are in a regulated industry or are subject to compliance regimes such as HIPAA or PCI, a more comprehensive policy framework is required. We recommend using the templates provided by SANS if you do not have policies in place.
- Review, test and update your policies and procedures regularly (at least once per year, preferably quarterly) as well as any time there is a significant change to your network or infrastructure.
- Establish regular training programs for all team members, and communicate cybersecurity initiatives, issues and threats regularly with your team via monthly all-hands or your current methods for sharing company information. Companies have had success establishing a Slack or Teams channel dedicated to cyber threat information.
- Add cybersecurity to your board meeting agenda going forward and ensure that you and your board are aligned on the importance of preparing your company to address this ongoing threat.
Links to preferred vendors for endpoint protection solutions, training and other items can be found in the Quickstart Assessment.
Key Resources to Help You On Your Journey
- Recommended Partners
- Horn IT works with many search fund companies on cybersecurity and compliance projects and is a trusted partner of Pacific Lake. Contact Horn IT directly to schedule your free assessment
- Turnpoint Technology is a trusted partner of Trilogy Search Partners. You can read about Aaron Marks from Turnpoint here and schedule an initial conversation here.
- CoreTelligent is a trusted partner of Pacific Lake. CoreTelligent will conduct an initial assessment at no charge to help you plot the path forward. Contact Jason Rossi at [email protected]
- Cybersecurity insurance from Epic Brokers. Contact Jeff Roblin ([email protected]) for your free cybersecurity policy review or to discuss your policy needs.
- Monthly Cybersecurity Briefing – Each 3rd Wednesday of every month at 1 p.m. ET, we cover current threats, a topic from the NIST Cybersecurity Framework, and live Q&A. This briefing is open to anyone on your team who is interested in joining. Register by filling out this form. Previous briefings can be viewed here.
- CISA Alerts – Free alert newsletter provided by the US government.
- Cyber Insurance Top 10 List – a list of network security controls that cyber underwriters expect to see, created by Epic Insurance
- Cybersecurity Hygiene Checklist – use this checklist to track compliance with critical cybersecurity activities throughout the year
If you have any questions, comments or suggestions related to the resources provided here, please email us at [email protected]
Frequently Asked Questions
“Our company doesn’t really store any sensitive data that an attacker would care about. Are we still a target?”
- YES! Attackers will look not only to steal sensitive data but lock up critical machines and systems via a ransomware attack. All companies are susceptible to attack.
“I don’t have any idea if we’re in good shape or bad shape right now. How do I get started?”
- Download the Quickstart Assessment above and complete it with help from your team and/or IT provider.
- Request a free assessment from one of our recommended providers.
“I don’t have an internal IT staff. Are there providers you’d recommend that I work with?”
- See the Key Resources section above for our list of recommended providers.
“How much does it cost to get current and protect my company?”
- Overall annual budget for a typical search fund company is typically $40-60K per year, not including employee costs.
- Software companies will have additional costs related to code security scanning, application vulnerability testing, and application infrastructure monitoring.
“My board doesn’t want me to prioritize spending time or money on making sure we’re protected. How do I convince them it’s worth it?”
There is no greater near-term existential threat to your business than a cyber attack that you are not prepared for. It is not uncommon for businesses to be offline for a week or more, or to have to pay six-seven figure ransoms.
