Last week's breach of communication software start-up Slack offered a great example of how information security is not just a big consideration of customers and business partners, but also potential investors and acquiring companies. Increasingly, financial experts believe that the examination of a company's IT security posture should be as much a part of the due diligence process prior to investment or mergers and acquisition activity as an ROI analysis should be.

In the case of Slack, the breach occurred just after the company was rounding up $160 million in investment. According to a report from the Wall Street Journal, "It’s unclear when Slack discovered the breach or if new investors were told of it before they agreed to the deal." Because the funding story was the result of leaked information from confidential sources and the company is pretty closed-mouthed over the deal, it may be hard to ever know if the breach has or will materially impact the closing of Slack's latest funding round. But one thing you can bet on is that as large-scale breaches continue to gain awareness in the board room, M&A and other investment deals may include security contingencies to cover investors' backsides.

"I could foresee a situation in which, number one, a deal might go through, but one of the terms is that certain upgrades and certain measures be taken from a data security perspective between the time of signing and closing," says Scott Vernick, head of the data security and privacy practice at the law firm Fox Rothschild LLP. "And, two, I could see closing contingent upon there being no material adverse changes, just like anything else. I could also see certain holdbacks from the purchase price if the buyer determines that you've got to spend $5 million or $10 million or whatever it is to bring someone up to best practices or a more robust security environment."

As Vernick explains, though security evaluation adds yet another layer of complexity to the already arduous due diligence process, it is something that shouldn't be optional within the vetting process for M&A.

"If I was sitting on a board, now in addition to asking all the questions you would normally ask, like 'What's this going to do for us?' and Where do we see our ROI and how quickly will we realize it?' the next question is 'What liability from a data security persepctive are we taking on?'" he says. "Because the last thing that you want to do is end up doing a merger or acquisition and then becoming responsible for a whole other set of liabilities because you have no real understanding of what the data security is of the target."

This means understanding what kind of data it collects from customers, how it collects it, what other intellectual property assets it has, where it keeps that data, how long it keeps it and who has access to that data. Those should all be part of the baseline questions asked during due diligence, he says.

Also important is ensuring that whoever asks those questions has the technical knowledge to capably ask the right questions and analyze the answers to truly understand the picture of risk they paint. This may be a role that the CISO plays in the acquiring company.

"In a typical deal you have due diligence which is done by a combination of in-house resources,  outside counsel and an investment banker," Vernick says. "Now you're going to have to make sure that one of those three or somebody else that you bring on board  has the technical skill set to ask the right questions."