Security at the seam is the deal you make on Day One. Anything less is exposure.

The Day One security baseline is non negotiable. Six controls minimum.

Six controls have to be operational on the morning of separation. Identity and access management with multi factor authentication. Endpoint detection and response on every Newco device. A network perimeter that segments Newco from the seller. Encrypted backup running daily against the Newco data estate. Security monitoring with documented escalation. An incident response plan with named owners and external counsel.

These controls are not optional and they are not negotiable. The buyer-side advisor builds the Day One security architecture before the deal closes and confirms that each control is operational, monitored, and documented before the carve-out is announced. The seller's TSA may cover some of these for a transitional period. The buyer-side advisor still verifies that the seller's controls actually apply to Newco scope and meet the standard Newco needs.

The work pairs with Day One cybersecurity and feeds into the broader Day One readiness program.

Network segmentation at the seam. Newco traffic stops being seller traffic.

On the morning of close, Newco traffic is still flowing across seller infrastructure. The corporate WAN, the office networks, the data center fabric, and the cloud accounts are shared. Each shared element is a potential exposure point and a TSA service that needs an exit plan. The buyer-side advisor maps every shared network element and prioritizes the segmentation by data sensitivity and regulatory risk.

The simplest architecture sets up a Newco managed network from Day One, with seller resources accessed via a controlled site to site VPN or a dedicated cloud interconnect. Office networks get their own SSIDs, their own internet egress, and their own firewall policy. Production workloads in the cloud get their own accounts or subscriptions with their own identity boundaries. Any continued sharing is documented in the TSA service catalog with a defined sunset date.

Segmentation is not just a network architecture decision. It is a legal and compliance commitment. Newco's seller can no longer see Newco's traffic by accident. Newco can no longer see the seller's traffic by accident. The work pairs with carve-out network separation.

Identity, endpoint, and the access boundary. Who can do what, and from where.

Identity is the new perimeter. Newco needs its own identity provider on Day One, with every employee account provisioned, every multi factor token enrolled, and every legacy seller account either decommissioned or carefully bridged with a defined exit. The buyer-side advisor designs the identity architecture in parallel with the HR data migration so that every transferring employee has a working account on the morning of separation.

Endpoint security follows. Every Newco device runs an EDR agent reporting to a Newco managed console. Devices that arrive from the seller are reimaged or, at minimum, joined to the Newco management console with a clean security baseline. The most common Day One incident is a personally owned device that was previously permitted on the seller's network and now sits on Newco's network without managed controls. The buyer-side advisor enforces a no exception policy on this point.

Privileged access is the highest risk category. Administrative accounts, root credentials, and break glass procedures are recreated for Newco scope with documented owners and rotation policies. Inherited shared credentials from the seller are rotated or retired. The work pairs with carve-out Active Directory migration and TSA Okta identity separation.

Monitoring, logging, and the SOC question. Build, buy, or borrow.

Newco needs security monitoring on Day One. Three patterns are common. The seller continues to provide SOC services through the TSA. Newco contracts a managed SOC provider directly. Or Newco builds its own internal SOC. The right choice is shaped by Newco's scale, the regulatory environment, the budget, and the speed at which the operating partner wants the seller dependency to close.

A managed SOC provider is the most common landing point for mid market carve-outs because it is fast to stand up, predictable in cost, and includes 24 by 7 coverage that Newco cannot reasonably staff internally. The buyer-side advisor runs a focused selection sprint with two or three candidates, picks one before Day Minus 30, and gets the EDR feeds, the cloud logs, and the network sensors wired in before the cutover.

Logging architecture is the foundation under monitoring. Newco builds a central log aggregation point, with retention periods that meet regulatory minimums, and integrates EDR, identity, cloud, application, and network logs from Day One. Without central logging the SOC has nothing to investigate. The work pairs with TSA CrowdStrike security separation.

Vulnerability management and patching. Cadence matters more than tooling.

Vulnerability scanning runs on a defined cadence from Day One. External attack surface, internal infrastructure, cloud configuration, and application code each have their own scan pattern. The buyer-side advisor sets the scanning baseline before Day One and ensures that the first scan results are reviewed within the first week, with critical findings remediated within an agreed window.

Patching policy is the operational reality behind vulnerability management. Critical security patches get applied within days. High severity within weeks. Lower severity on the standard maintenance cadence. The buyer-side advisor builds the patching SOP into the operating model and confirms that the helpdesk and infrastructure teams have the tools and the authority to enforce it. A vulnerability scan with no patching cadence is a generator of audit findings, not a security control.

A specific Day One activity is the inherited vulnerability backlog. Devices and applications transferring from the seller often carry unpatched issues that the seller had triaged at a lower priority. Newco's risk profile is different and some of those issues become critical at standalone scale. The buyer-side advisor surfaces the backlog and prioritizes remediation in the first 90 days. The work pairs with carve-out endpoint management.

Incident response and the regulatory reality. A breach on Day One is a board level event.

The incident response plan covers what happens when something goes wrong. Named incident commander, named legal counsel, named public relations support, named insurance contact, named regulatory notification owner. Each role has a deputy. Contact details are tested. The runbook is written for the specific Newco environment, not copied from a generic template. The buyer-side advisor runs a Day Minus 14 tabletop exercise to confirm the plan works.

The regulatory reality is that data breach notification requirements apply from the moment Newco exists as a legal entity. Some regulators have 72 hour notification windows. Some require notification of affected individuals within a defined period. The plan documents which regulators apply to Newco scope, what triggers a notification, who has the authority to decide, and how the notification is delivered. Without this preparation, the first incident becomes a regulatory failure on top of the technical incident.

Cyber insurance binding is the final piece. Newco needs its own policy in place from Day One because the seller's policy will not cover Newco after separation. The buyer-side advisor coordinates with the broker to confirm the policy is bound before the cutover and that the controls Newco committed to in the application are actually in place. A gap between application and reality voids the policy. The work pairs with Day One insurance binding.

More on carve-out technology.