Building a Programmatic Approach to Cybersecurity Portfolio Oversight

For several years, private equity firms have been dipping a toe in the water with regard to cybersecurity oversight. Typically, this would include bringing in outside consultants and vendors to portfolio companies with known cybersecurity challenges and instituting minimum expectations for cybersecurity controls across the portfolio. In 2022, 79% of firms polled by ACA reported to be actively engaging in some level of cyber oversight. 

Yet, the types of cyber oversight activities undertaken by these firms has often been inconsistently applied and has varied substantially. According to a survey conducted by ACA Group in March 2023, 73% of private equity firms do not have a minimum-security baseline, and 68% do not perform annual risk assessments when it comes to their portfolio companies. 

As recently reported in the Wall Street Journal, this ad-hoc approach is no longer considered sufficient to protect investments from cybersecurity threats and reassure investors. It has become imperative that private equity firms institute formal and more far-reaching cybersecurity portfolio oversight programs to meet investor expectations about cybersecurity as well as safeguard and grow the valuation of their investments. 

What’s needed is a programmatic approach to cybersecurity across all portfolio companies, designed to be formally governed and applied consistently. A confidence-building portfolio oversight program provides a competitive advantage today for attracting and retaining investment from limited partners; tomorrow, it will likely be table stakes.  

Assess the state of your cyber oversight program 

We have identified thirteen elements of successful programmatic cyber oversight. While there is no one-size-fits-all solution to oversight, these thirteen elements are shared features that should be present in any cyber oversight program. 

In our most recent white paper, 4 Myths About Cybersecurity Portfolio Oversight we provide a scorecard to help firms assess and monitor their approach to cybersecurity. Firms who have highly programmatic approaches will consistently score a 4 or 5 across all areas. For those scoring lower, it may be time to explore how ACA Vantage for Cyber can support your firm. 

 

 

 

Download our white paper to access the scorecard

How we help

ACA’s new portfolio oversight solution, ACA Vantage for Cyber, can provide ongoing visibility to monitor and oversee your portfolio companies’ cyber health, giving you control to navigate risk, add value, and gain a competitive advantage.

Powered by ACA Aponix^®, ACA Vantage for Cyber combines our renowned advisory service with our award-winning regulatory technology, ComplianceAlpha^®, and our exclusive "RealRisk" risk assessment methodology. 

ACA Vantage for Cyber will help you to:

• Align your cybersecurity oversight program to investor needs by leveraging best practices developed working with over 100 PM firms on oversight 
• Save time with instant access to assessment results and the status of related remediation efforts 
• Keep stakeholders informed and direct resources where they are needed most 
• Uncover your firm’s risk from your investments from the fund level all the way down to individual cyber capabilities at individual portfolio companies. 

Contact us to find out how we can help you protect your portfolio. 

Additional Resources

Watch our on-demand webcast

Our on-demand webcast discusses best practices for cybersecurity oversight as well as the value-add it brings to sponsors. Watch our webcast to understand: 

• Elements of a world-class cybersecurity oversight program 
• The value-add of establishing an effective cybersecurity oversight program 
• Action steps your firm can take to build an effective cybersecurity oversight program

Watch now