What cyber security evidence do investors ask a small company for?
Mostly proof that the basics run and that someone owns them. Typical investor checklists ask who is responsible for security, whether you have written policies, how you control access (including multi-factor authentication), how you back up and restore data, whether you have had incidents and how you handled them, where customer data is stored and under which contracts, and whether you monitor for intrusions. Early-stage investors rarely expect certifications, but they do expect honest answers that match your documents. Prepare a short pack: a named owner, the policies, an incident register, your data processing agreements and a one-page description of monitoring. NetSenX can supply part of it: an alert history, an audit log of decisions and, from the Starter plan, PDF reports; customer data stays in the EU.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Is network monitoring expected in investor due diligence?
- Can a 30-person company show investors it monitors for intrusions?
- How should we answer a customer who asks whether we have had a security incident?
- Is it better to disclose past security incidents to customers?
- What records do we need to answer questions about past incidents?