Newco is a fresh target. The first 90 days are the riskiest.

Identity, access management, and the trust boundary.

Identity is the new perimeter and on Day One it is the highest leverage control. Newco needs an identity provider that manages employee authentication, role assignments, and access reviews. Most carve-outs run the seller’s identity infrastructure under TSA for a transitional period and then migrate to Newco’s own tenant. The migration is sequenced after the most critical applications are decoupled.

The trust boundary between Newco and the seller is the structural risk in the TSA period. Seller employees who supported Newco operations need defined access to Newco systems. Newco employees who continue to need seller systems under TSA need defined access there. Each cross boundary access is logged, time bound, and reviewed monthly by both sides.

Multi factor authentication is required on every Newco system on Day One. The exception list is documented and minimized. Privileged access requires step up authentication and is granted through a privileged access management workflow with full session logging. The control is mature in security maturity benchmarks and trivial to skip in a fast carve out. The fix is to make it a Day One acceptance criterion.

Joiner, mover, and leaver processes are operational on Day One. New employees get provisioned access within a defined timeline. Role changes trigger access reviews. Terminations trigger immediate access revocation across every Newco system and every TSA system where Newco accounts exist. The workflow is documented in carve-out cybersecurity planning.

Endpoint security and device management.

Newco endpoints are the most visible attack surface. Each laptop, desktop, and mobile device that connects to Newco data needs an endpoint detection and response agent, a managed device configuration, and a known patching status. The work covers existing devices that move with employees, new devices issued during the carve out, and personal devices in BYOD environments.

Most carve-outs inherit the seller’s endpoint configuration on Day One and migrate to Newco’s standard over the first 90 to 180 days. The migration sequence is risk driven. Executive devices and privileged user devices migrate first. Standard knowledge worker devices migrate in waves. Shared devices like manufacturing floor terminals migrate last with operational coordination.

The endpoint detection and response telemetry needs to land in a Newco operated security information and event management platform. Where Newco lacks the platform on Day One, the telemetry routes to a managed security services provider with a documented response runbook. The runbook covers the first 90 days and is updated as Newco builds its own capability.

Mobile device management is the parallel discipline. Newco needs mobile device management active from Day One for every device that holds Newco data. The configuration enforces device encryption, screen lock, and remote wipe capability. The control matters because lost or stolen devices are common and the consequences without management are public.

Network perimeter and cloud security baseline.

The network perimeter is more porous than the org chart suggests. Newco has its own internet egress, its own VPN, its own DNS, and its own cloud tenants. Each of these needs a defined security baseline on Day One. The baseline covers firewall rules, intrusion prevention, web filtering, and the documented exceptions for known business purposes.

Cloud security baseline configuration covers the major cloud platforms in use. Identity federation. Logging and monitoring. Network segmentation. Storage encryption. Vulnerability scanning. The baseline is configured in the cloud tenants Newco operates and audited within the first 30 days. Where Newco inherits cloud workloads under TSA, the seller’s baseline is reviewed and gaps are documented.

DNS and email perimeter controls are the highest leverage cheap wins. SPF, DKIM, and DMARC records are configured for the Newco email domain before Day One. The domain registrar account is owned by Newco IT, not by an inherited contact. Phishing protection is enabled in the email gateway with the policies tuned for the first 90 days when phishing volumes typically spike.

The first carve out announcement triggers a wave of impersonation phishing attempts targeting Newco employees, vendors, and customers. The communications playbook accounts for this. Internal communications emphasize verification before any payment instruction change. The pattern is consistent with the customer and vendor communication discipline.

Data protection, classification, and the carve out boundary.

Data protection in a carve out is structurally complex because the underlying data is rarely cleanly separated. Customer data, employee data, financial data, and intellectual property all start co mingled in the seller’s systems and migrate to Newco over the runway. The classification of what stays, what transfers, and what gets cloned is finalized 60 days before Day One.

Where data transfers, the transfer mechanism is logged, authorized, and audited. Bulk extracts are encrypted at rest and in transit. Access to the extract is restricted to named personnel with a defined business purpose. The legal entity that holds the data after transfer is documented and the data protection officer signs off. The discipline matters because regulatory authorities pay attention to carve out data flows.

Data loss prevention controls are active on Day One. The DLP policies cover the obvious egress paths. Email attachments. Cloud storage uploads. USB transfers. Web uploads to unsanctioned destinations. The policies are tuned for the first 30 days based on observed activity and then adjusted to the long term standard. The work is operational and visible in the security operations dashboard.

Where the carve out crosses jurisdictions, the data residency and transfer requirements apply to the security architecture. GDPR, sector specific privacy regulations, and the cross-border transfer mechanisms are documented and reflected in the data flow diagrams. The discipline runs through carve-out data separation planning.

Incident response, monitoring, and the first 90 days.

Newco needs an operational incident response capability on Day One. The capability covers detection, triage, containment, eradication, recovery, and lessons learned. Most mid-market Newco buyers outsource the round the clock monitoring to a managed security services provider in the first 12 months and then evaluate building an internal team based on the operating reality.

The incident response runbook is finalized before Day One. The runbook documents the escalation path, the legal counsel contact, the cyber insurance broker contact, the public relations contact, and the regulatory notification timelines by jurisdiction. The runbook is exercised in a tabletop drill before Day One so the carve out PMO knows the muscle memory.

Cyber insurance is bound effective close. The policy is reviewed for adequacy against the Newco risk profile. The notification obligations under the policy are documented. The retentions and limits are sized to Newco’s revenue and data footprint. The placement runs alongside the broader insurance work in the closing process.

The first 90 days after Day One are the validation period for the security operating model. The security operations dashboard tracks the volume of alerts, the time to triage, the time to contain, and the false positive rate. Where the metrics drift, the carve out PMO investigates and adjusts. A clean cybersecurity readiness program produces a Newco that operates at parity with mature mid-market peers from the first hour. The discipline runs through the Day One readiness program.

More on Day One readiness.