Cybersecurity Compliance For M&A Deals And The Changing Regulatory Landscape With Steven Teppler

Sterlington’s work primarily revolves around private equity and family firms. With a strong litigation department, they also perform transactional work. Steven is involved in developing cybersecurity and assessing cyber risks for clients.

During their conversation, Steven and Marc discuss M&A transactions, the changing cyber regulatory landscape, and mitigating risks on the buy-side and sell-side of the market.

Steven explains that an M&A (merger and acquisition) is a transaction involving both purchase and sale. Both parties undertake a certain amount of due diligence in the purchase-sale environment; there are considerations on both sides with serious implications for liability. Therefore, risk evaluation pre and post-acquisition is necessary for private equity companies. The same principles apply regardless of the type of transaction (mergers, acquisitions, leveraged buyouts, management buyouts, trends offers).

Also, the regulatory landscape in cyber risk is changing fairly dramatically. For instance, now, if an M&A transaction involving a health care type of entity that handles personal health information encounters a lately discovered or latent HIPAA problem. In that case, it violates the Privacy Rule – there’s been a late discovered exfiltration. It could lead to escalations to several regulatory compliance departments.

There should be a baseline security level on the sell-side, so you’re not selling something that can put you into liability or potential liability on the buy-side. You also need protection on the buy-side to get certain representations and warranties from the seller; they ensure you have adequate insurance. You might also want to perform a cybersecurity risk assessment on the proposed acquisition to avoid warnings or trouble later.

Steven explains that cyber diligence should begin at the very outset, because just like any other managed service provider, depending upon the interplay between the private equity company and the portfolio company, there will be an interchange of managed service. Protecting that information is necessary. Any private equity company needs to ensure that its subsidiary or holding companies portfolio companies are equally protected, depending on the type of industry or service they provide.

To conclude, Steven advises avoiding cyber risks, starting with, do not call a number or tap on any unknown link – be conscious. Abide by cybersecurity tips at all times.

Highlights:

“In any purchase and sale environment, there is a certain amount of due diligence that has to be undertaken by the parties. And whether you are a buyer or seller acquisition or the acquired, there are considerations both on the sell-side as well as on the buy-side that can have very, very, very serious implications for liability.”

“Cybersecurity is part of a business. It’s part of your business functionality.”

“Having a protecting on the buy-side means that you get certain representations and warranties from the seller, they also make sure that you have the adequate insurance, and maybe you want to maybe not even take necessarily the word or the representations of the seller, but perhaps you’ll want a separate assessment and a separate cybersecurity assessment risk assessment done on the proposed acquisition.”

Time-Stamps:

[00:46] – Steven’s entrepreneurial journey

[02:27] – Cybersecurity interplay between M&A transactions

[06:47] – The changing regulatory landscape and its effect on M&A transactions

[12:17] – Get in touch with Steven

Connect with Steven:

 

LinkedIn: https://www.linkedin.com/in/steventeppler/