November 17, 2016
M&A Cybersecurity: Due Diligence in Energy Deals
This Andrews Kurth Kenyon memo discusses cybersecurity due diligence in energy sector M&A. This excerpt explains how the oil & gas industry’s investments in digital technologies have raised the profile of cybersecurity issues for dealmakers:
To weather the plunge in prices, many oil companies have sought out new innovations to reduce the cost of extraction and exploration. Investments in digital technologies will likely only increase—a 2015 Microsoft and Accenture survey of oil and gas industry professionals found that “Big Data” and the “Industrial Internet of Things” (IIoT) are targets for greater spend in the next three to five years. Cybersecurity threats were perceived in the survey as one of the top two barriers to realizing value from these technologies.
Companies considering a sale would be well advised to consider a buyer’s likely cybersecurity concerns:
On the target side, energy companies should prepare (in turn) for more scrutiny over their data security and privacy practices. Among other benefits to “knowing thyself,” getting ahead of this process should offer targeted companies a better negotiating position. It would also allow them to take a more proactive role in defining the policies of the combined company post-merger. At the very least, these efforts could help avoid the kind of hiccups and uncertainties that lead to undervaluation. In any event, poor cybersecurity practices can give an impression that a target lacks risk management in other areas—not an ideal pose to strike in any bargain.