Acquisition Facility Diligence
What is really running, before you sign.
Transactions
What you get
- A full as-is model of the facility in two weeks, from passive collection and the documents in the data room
- IEC 62443 risk assessment: the worst case first, then a detailed assessment against target security levels
- Findings ranked by what they change in the deal: price, conditions on the seller, and the cost of connecting the site to your network
Two weeks, eight stages
Collection is passive. The cyber digital twin is built from the documents in the data room and from what is observed on site, then assessed with the IEC 62443 risk process. The day ranges are the plan for a single facility.
- 01Before day 1
Document request and ingestion
P&IDs, network drawings, the asset register, the remote-access list and vendor and cloud contracts go into the twin. What is missing is listed.
- 02Day 1
Workshop 1
The deal questions, the system under consideration and interviews with the people who run the site.
- 03Days 2 to 3
As-is walk-through
An assisted walk-through of the site, with passive capture of network traffic.
- 04Days 3 to 5
The as-is twin
A full asset inventory, zones and conduits named for the site, a target security level for each zone, and the design set against what is actually installed.
- 05Day 5
Initial risk assessment
The worst case for each zone, before any control is counted.
- 06Days 6 to 7
Threats, vulnerabilities and readiness
A threat model and a threat hunt on the captured traffic, vulnerabilities by asset, and a ransomware readiness tabletop on the organisation's ability to detect, triage, respond and recover.
- 07Days 8 to 9
Detailed risk assessment
Risk reduced so far as is reasonably practicable, and the level of effort to reach the buyer's target security level before the site joins the buyer's network.
- 08Day 10
Workshop 2: the deal readout
The priority list mapped to price, conditions on the seller and the integration budget.
What we do not claim
- No active testing on the seller's systems before signing. Collection is passive; penetration testing, where wanted, follows signing.
- What was not observed is reported as not observed, not as absent.
- Findings are engineering findings for the deal team. They are not legal or financial advice.
A method Jim McKenney designed and has run on acquisitions many times, on short deal clocks.
Case study · anonymised
Biogas and LNG distribution, with fertilizer from by-products. Western Europe. Pre-acquisition diligence for the buyer.
The seller's asset list showed advanced robotic equipment on the line. The robots were installed. They did not work. Older equipment was running the process, and the assumptions about the site's condition and capacity rested on machines that were not doing the work.
The as-is model also found undocumented remote access, a flat network, controllers past vendor support, and cloud-hosted services the facility depended on. Each had to be fixed before the site could join the buyer's network and run on its ERP and MES.
The findings became conditions on the seller before close, and the buyer set its integration budget from the level-of-effort estimate.
Scoped to the facility
Every engagement starts from the facility's country, sector, type, supply chain and external pressures. The researched record for the country, and the origins of its parts and software, set what the work has to cover.
Where this has been done
- Energy & grid
- Australia: grid stability and battery energy storage (BESS) · Deep Fission nuclear installation, Australia
- Manufacturing
- A manufacturing center of excellence · digital transformation for MES (manufacturing execution systems)
Start with the facility
Send the country, the sector and the facility type. The enquiry form carries the service with it.
This Site Uses No Cookies
Eigenia does not set cookies. The only thing stored in your browser is one preference, saved in local storage, noting that you have seen this notice.