Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
How does ShipReady Metrics support M&A technical due diligence?
Last verifiedShipReady Metrics supports diligence by sharing posture (Passport), scoring readiness (A–E), mapping controls with disclosed density, and attaching evidence, vulns, AI inventory, and DORA metrics. It does not close a deal or replace counsel. This page is not legal advice and not investment advice.
SRM for M&A diligence, last verified 10 September 2026 against shipped product capability and against ISO/IEC 27001, AICPA TSC, and the EU AI Act only where a feature maps to those instruments. Crosswalk density and evidence overlay are disclosed — not absolute claims. Not legal advice. Not investment advice.
Map capabilities to diligence needs — without puffery
Audience: a CTO or acquirer already using, or evaluating, ShipReady Metrics. This page is not legal advice and not investment advice. Kind of text: rows below are shipped capability. Named standards are mapping targets, not a finding that they apply to YOU. Industry best practice still wants human diligence. ShipReady Metrics recommendation: use the product as the live workpaper, not as a fairness opinion.
Capability-to-diligence-need mapping
Last verified 10 September 2026. Honesty caveats are part of the row. Not legal advice. Not investment advice.
| Diligence need | Shipped capability | Honesty caveat |
|---|---|---|
| Share posture without a slide rebuild | ShipReady Passport. | Not a pen-test report, not a filing, not a valuation. This page does not href the app route. |
| One scored summary | Readiness score and A–E ratings with a quality gate. | Coverage-as-confidence. Not a deal recommendation. |
| Control coverage across frameworks | About 24 frameworks mapped to about 72 canonical controls. | Crosswalk-density layer: mapping is not certification and not “we implement every control.” |
| Evidence that an auditor can sample | Evidence collection, review, met-verdict overlay. | A met verdict is not a SOC 2 or ISO opinion. |
| Vuln and blast-radius questions | Ingest (Dependabot / code-scanning / secret-scanning), KEV, EPSS, CVSS, dedup, blast radius. | Not an independent pen test. |
| AI and AI-authored code | AI inventory, AI risk register, AI-authored-code floor. | Not a determination that the EU AI Act applies. Not copyright advice. |
| Engineering economics | DORA metrics and per-committer metering. | Not EBITDA. Not an HR ranking product. |
What to do now
Operational steps. Last verified 10 September 2026. Not legal advice. Not investment advice.
- Open the tech-DD hub, the pre-acquisition security playbook, and the readiness-report outline on this site — then attach live artifacts rather than rewriting them.
- If you already have a session: signed-in app → Compliance → Evidence and the obligation map; Passport for sharing. Naming those paths is not a public href to /compliance or /passports.
- Tell counterparties what the crosswalk density means before they treat a mapped row as “certified.”
- Keep counsel on reps, licenses, and AI-output ownership. The product does not replace them.
Checklist
Question list. Not legal advice. Not investment advice.
- Have we disclosed crosswalk density to the other side?
- Is Passport being described as posture, not as a filing?
- Are pen-test and certificate PDFs still in the room?
- Has anyone claimed the product determines that a framework applies?
Where this shows up in ShipReady Metrics
Passport, readiness A–E, 24-framework / ~72-control crosswalk, evidence and met-verdict overlay, vulnerability management, AI inventory and risk register, DORA, per-committer metering. This product does not replace an independent pen test, does not file with anyone, does not determine that a framework applies to YOU, does not start a clock, and does not give investment advice.
Primary sources (last verified 10 September 2026)
Shipped ShipReady Metrics surfaces (authoritative for capability claims). ISO/IEC 27001, AICPA TSC, and Regulation (EU) 2024/1689 named only where a feature maps to them. Not legal advice. Not investment advice.