What security evidence does a buyer ask for in due diligence?
Usually a short pack of documents and records. It typically includes your security policies, a list of incidents in recent years and how each was handled, the results of penetration tests or audits, any certifications you hold, your cyber insurance, your data processing agreements and a description of how you monitor for intrusions. A buyer prices what you cannot document, through a lower price, an escrow or an indemnity clause, so records count for more than assurances. Start collecting before a sale is on the table: an incident register, the decision taken on each serious alert, and the date monitoring began. NetSenX keeps an alert history and an audit log of your team's decisions on every plan, with PDF reports from the Starter plan; how far back the history goes depends on the plan.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.