.png)
What Is The MADSS?
The Mergers, Acquisitions & Divestitures Security Standards (MADSS) are the Secure Controls Framework (SCF) standards for cybersecurity and data protection due diligence in a merger, acquisition or divestiture. They set out what the buyer, the seller and the assessor each must do so that the target's security posture is assessed with one standardized approach.
They set performance standards for third-party internal control assessment services, which provide an assessment and an attestation but no certification. They are based on the SCF's Cybersecurity & Data Protection Assessment Standards (CDPAS), with added standards for deal work such as the virtual data room and the post-close integration plan.
Assessment vs. Audit
The MADSS focuses on third-party assessments, not internal or external audits. An assessment tests whether controls are implemented correctly, operating as intended and producing the desired outcome. An audit independently examines records and activities to ensure compliance with established controls, policy and operational procedures.
Who Is The MADSS For?
The MADSS is written for the whole assessment ecosystem: buyer, seller, assessor and external service providers. Most of its eight standards apply to one side.
Entity Being Acquired (EBA)
The seller, or target company. Standards 3 and 5 cover how it prepares, demonstrates readiness and governs its program.
Acquiring Entity (AE)
The buyer, acquirer or suitor. With the seller, it agrees the control set and defines the boundary, risk tolerance, maturity and materiality, and it prepares the post-close plan.
Third-Party Assessor (TPA)
The company or individual that performs the assessment, held by Standard 1 to ethical conduct, independence, competency and conflict of interest avoidance.
External Service Providers (ESPs)
Consultants and cloud, managed and managed security service providers. Controls they run for the seller can be inherited with a First-Party Declaration (1PD) or third-party attestation, a contract and a Responsible, Accountable, Supportive, Consulted and Informed (RASCI) matrix.
How Is The MADSS Organized?
The MADSS has eight standards, each broken into numbered sub-standards, followed by six appendices. Every sub-standard states the requirement, a justification for why it exists and guidance on how to meet it.
How Do Organizations Use The MADSS?
An assessment under the MADSS follows six phases.
Scope The Assessment
The buyer and seller agree the assessment boundary and one tailored control set, and the seller names the stakeholders. Each control is then checked for applicability, reciprocity and inheritance.
Set Risk Tolerance And Materiality
The buyer and seller agree a risk tolerance level, current and target maturity and a materiality threshold. Material risks, threats and incidents are also designated.
Prepare The Seller
The seller performs and documents at least one internal assessment, counts only controls that have been in operation long enough, and assigns an employee to govern the program. A virtual data room is set up to share due diligence documents securely.
Plan And Run The Assessment
The assessor puts a statement of work, an assessment plan and written authorization in place and issues an Evidence Request List. Each control is assessed against its assessment objectives and designated Satisfactory, Deficient, Alternative Control or Not Applicable.
Report Conformity And Costs
After a peer review, the assessor gives the assessment one of four designations: Strictly Conforms, Conforms, Significant Deficiency or Material Weakness. The Report on Conformity includes projected remediation costs, which either side can use in negotiating the deal.
Plan The First 180 Days
Before closing, the buyer prepares a Post-Close Integration Security Plan with milestones from Day 0 to Day 180, because cybersecurity risk often increases after close.
Assessment Rigor: Three Levels
The seller selects one of three levels of rigor: Standard (controls are implemented and free of obvious errors), Enhanced (also implemented correctly and operating as intended) and Comprehensive (also operating as intended on an ongoing and consistent basis, with support for continuous improvement).
The full requirements, justification and guidance for each standard are in the MADSS.
MA&D Considerations for Threat Identification & Risk Management
In Mergers, Acquisitions & Divestitures (MA&D), risk analysis decides whether a risk is acceptable or unacceptable. Three terms set the criteria:
Risk Appetite: The types and amount of risk, on a broad level, an organization is willing to accept in its pursuit of value. Set at the strategic level.
Risk Tolerance: The level of risk an entity is willing to assume to achieve a desired result. Rated Low, Moderate, High, Severe or Extreme and put into practice at the operational level.
Risk Threshold: Values used to establish concrete decision points and operational control limits to trigger management action and response escalation. Used at the tactical level.
Risks vs. Threats
A risk exists because a control is absent or deficient. A threat affects the ability of a control to exist or to operate properly.
A material control cannot be covered by a compensating control, and its failure could have a material impact. One deficient material control is enough for a Material Weakness designation. Appendix B lists examples.
Older Control Numbers
The control numbers in Appendix B are from before the SCF 2026.3 reorganization, which renumbered most controls. In the SCF workbook, these numbers are found in the Legacy SCF # column of the main tab, not the SCF # column. Where controls were merged, one cell can hold more than one legacy number.
Considerations to Improve Valuation & Reduce Risk
Appendix F lists issues that affect a deal's valuation, including these red flags and opportunities.
Opportunities to Improve Valuation
Demonstrated maturity in security governance and response
Clean incident history and documented controls
Active bug bounty or Vulnerability Disclosure Program (VDP)
Robust vulnerability management program
Automation and a metrics-driven security posture
Strong audit trails and documented compliance efforts
Red Flags That Can Hurt Valuation
Shadow Information Technology (IT) and ungoverned systems
Legacy systems with known vulnerabilities
Poor documentation of security processes
Inconsistent access controls or a lack of least privilege
Weak user awareness or no training programs
Lack of endpoint visibility or asset inventory
Unmanaged Redundant, Obsolete, Toxic or Trivial (ROTT) data
MADSS Works With CDPAS & SCR-CMM
The MADSS builds on two other free SCF publications.
CDPAS: Assessment Standards
The SCF's standards for third-party assessments. The MADSS is based on the CDPAS and draws significantly from its work.
SCR-CMM: Capability Maturity Model
Provides the six maturity levels, from Level 0 (Not Performed) to Level 5 (Continuously Improving), that Standard 3.9 uses for current and target maturity.
MADSS Standards: Complete Requirements
All 52 sub-standards are listed below. The requirement, justification and guidance for each are in the MADSS.
%20(white).png)