FIND YOUR CONSULTANT
JOIN OUR COMMUNITY
FIND YOUR CONSULTANT
JOIN OUR COMMUNITY
Resources >

Commercial Due Diligence Playbook >

Technology and Digital Maturity

Technology and Digital Maturity

Technology is the scaffolding that holds your growth story up—or the hairline crack that gives way under load. In commercial due diligence, we are not grading code elegance or debating microservices doctrine; we are answering a practical question: can the company’s digital capabilities reliably create, convert, fulfill, and retain demand at the velocity and cost implied by the plan? This chapter brings a commercial lens to technology. We focus on how architecture, data, security, operations, and go‑to‑market tooling translate into price power, conversion, NRR, CM2, cash payback, and resilience. We also make the technology risks underwritable: identifiable, quantifiable, and—where possible—tied to specific mitigations within the hold period.

Expect outputs you can plug straight into the model and term sheet: a weighted digital maturity score by segment and route‑to‑market; capacity and reliability headroom at stated SLOs; cloud and third‑party unit‑cost curves; dependency and rate‑limit risks; GTM‑stack hygiene and attribution confidence; and a dated, costed 90‑day plan to lift the two or three bottlenecks that move economics fastest.

12.1 Digital Capability Framework

Purpose and how to use it

The Digital Capability Framework (DCF) is a compact rubric for assessing whether the target’s technology estate can deliver the commercial plan. It organizes digital capabilities into ten pillars, each scored on a 0–5 scale with evidence, then weighted by business model and segment. The result is a Weighted Digital Maturity Score (WDMS) and, more importantly, a short list of gaps whose fixes change revenue, margin, or cash in your horizon. Use it in a two‑ to four‑week diligence sprint with clean‑team access to artifacts (not source code) and with structured sessions across product, engineering, security, data, and revenue operations.

The ten pillars (what “good” looks like and why it pays)

  1. Product Architecture & Extensibility
     What you’re testing: modularity, clear domain boundaries, stable APIs, configuration over customization, versioning/compatibility discipline, multi‑tenant readiness, and partner‑friendly extensibility (SDKs, webhooks, events).
     Why it pays: faster feature velocity and safer change → higher win rate, lower churn hazard after price moves; integration speed → lower CAC and shorter payback in enterprise segments.
  2. Data, Analytics, and AI
     What you’re testing: capture of critical events, unified identifiers, quality and lineage, governed warehouse/lakehouse, self-serve BI, experimentation platform, model governance (features, drift, explainability), and privacy‑by‑design.
     Why it pays: accurate attribution and LTV/CAC; better pricing and packaging; defensible differentiation where data compound (Chapter 8.4).
  3. Platform Operations (SRE) and Reliability
     What you’re testing: explicit SLOs and error budgets, observability, incident response/MTTR, safe deployment (canary/blue‑green), change failure rate, disaster recovery (RTO/RPO), multi‑region posture, and capacity management.
     Why it pays: fewer SLA credits, higher NRR, and price resilience; enables enterprise and regulated customers.
  4. Security, Privacy, and Compliance
     What you’re testing: secure SDLC, vulnerability management, identity and secrets, third‑party risk, encryption/key management, attestations (e.g., SOC 2/ISO), privacy controls and consent, AI/model risk procedures.
     Why it pays: access to RFP‑gated segments, reduced sales friction and cycle time, lower probability of catastrophic churn or fines.
  5. Cloud, FinOps, and Unit Cost
     What you’re testing: cost allocation and showback, autoscaling and reserved commitments, hotspot awareness (e.g., database/egress), third‑party API quotas and pricing, capacity ladders with time‑to‑add.
     Why it pays: CM2 expansion through lower unit cost; prevents margin collapse when usage intensity grows (Chapter 8.3).
  6. GTM Tech Stack and Revenue Operations
     What you’re testing: CRM hygiene and stage discipline, MAP/CDP integration, lead routing, attribution incrementality, CPQ and price governance, billing/subscription/entitlement accuracy, partner portals and marketplace integrations.
     Why it pays: higher conversion and faster cycle, controlled discount leakage, clean realized‑price corridors (Chapters 8.2 and 9.1).
  7. Customer Experience, Support, and Success Tech
     What you’re testing: omnichannel support, deflection/self‑serve, in‑app messaging, proactive detection from telemetry, playbooks tied to health scores, knowledge management, and feedback loops to product.
     Why it pays: lower cost‑to‑serve, reduced churn hazard after changes (price, packaging, policy), and upsell readiness.
  8. Delivery, Dev Productivity, and Quality
     What you’re testing: CI/CD maturity, test automation, environment management, feature flags, trunk‑based development, product discovery cadence, design system reuse, and backlog hygiene.
     Why it pays: higher deployment frequency at lower change‑failure rate → faster revenue capture and lower rework CTS.
  9. Ecosystem and Integrations
     What you’re testing: connectors to priority systems, app‑store readiness, certification and listing status, partner enablement and sandbox, EDI where needed, and API documentation quality.
     Why it pays: unlocks channels and accounts; reduces implementation hours → better payback and win rate.
  10. Digital Governance and Portfolio Management
     What you’re testing: clear product strategy and road‑mapping, investment allocation and kill rules, architecture/runway reviews, risk register (policy, dependency, obsolescence), and value tracking (OKRs linked to P&L).
     Why it pays: fewer zombie initiatives and faster pivot to segments with stronger economics.

Scoring rubric (0–5) and anchors you can defend

  • 0 – Nonexistent: ad hoc, no evidence, outcomes depend on individuals.
  • 1 – Emerging: isolated practices; inconsistent data; manual gates; outages and rework common.
  • 2 – Repeatable: basic processes in place; partial tooling; reliability depends on heroics during peaks.
  • 3 – Defined: documented standards; DORA and SLOs tracked; APIs and data model stable; attestations in flight.
  • 4 – Managed: metrics drive decisions; automation prevalent (tests, deploys, cost allocation); third‑party risk governed; consistent partner integrations.
  • 5 – Differentiating: capabilities compound advantage (e.g., data network effects, developer platform); reliability and cost are strategic levers.

Score each pillar per segment/route‑to‑market where economics actually differ (enterprise vs. SMB, marketplace vs. direct).

Weightings by business model (edit, document, and lock)

  • B2B SaaS / usage‑based: Architecture 20%, SRE 15%, Security/Privacy 15%, Data/AI 15%, FinOps 10%, GTM Stack 10%, Delivery 10%, Ecosystem 5%.
  • Marketplaces / platforms: SRE 15%, Security/Trust & Safety 15% (folded into pillar 4), Data/AI 15%, Ecosystem 15%, FinOps 10%, GTM Stack 10%, Architecture 10%, Governance 10%.
  • E‑commerce / DTC: CX/Support 15%, GTM Stack 15%, Data/AI 15%, FinOps 10%, SRE 10%, Architecture 10%, Ecosystem 10%, Delivery 10%, Governance 5%.
  • Hardware + service: Architecture (embedded/OTA) 15%, SRE/Field Ops 15%, CX/Support 15%, Data/AI 10%, FinOps 10%, Ecosystem 10%, Security/Privacy 10%, Delivery 10%, Governance 5%.

Evidence pack (request once; use across all pillars)

  • Architecture: system and domain diagrams, API catalog, versioning policy, extension points, SDKs/webhooks, backlog for architectural debt.
  • Data/AI: event schemas, ID resolution, lineage, quality SLAs, warehouse governance, experiment logs, model cards and drift alerts.
  • SRE: SLOs/error budgets, incident postmortems, on‑call runbooks, deployment calendars, DORA metrics (deployment frequency, lead time, change‑failure rate, MTTR), DR test results.
  • Security/Privacy: vulnerability scans, pen‑test summaries, secure SDLC artifacts, IAM/secret procedures, SOC/ISO audit letters, DPIAs/consents.
  • FinOps: cloud invoices (by service), reserved vs. on‑demand mix, unit‑cost dashboards (per tenant/API call/GB), third‑party API bills and rate‑limit logs.
  • GTM stack: CRM/MAP/CDP schema, lead routing and dedupe rules, CPQ/discount ladders, billing/entitlement mappings, marketplace/partner portals.

     

  • CX/Support: ticketing and knowledge base metrics, contact rate per account/order, deflection flows, in‑app messaging events, health‑score inputs.
  • Delivery: CI/CD pipeline config, test coverage reports, feature flag usage, environment parity notes, release notes cadence.
  • Ecosystem: connector catalog, listing status, certification evidence, partner sandbox availability, EDI maps.
  • Governance: portfolio and OKR reviews, architecture board minutes, risk register and mitigations.

Commercial metrics to compute (tie tech to dollars)

  • Reliability: availability and p95 latency vs. SLO by region/tier; SLA credits as % of revenue (Chapter 10.3).
  • Velocity/quality: DORA metrics with trend; % canary/blue‑green; change‑failure rate × cost of rework.
  • Unit cost: $ per API call/account/order and per GB stored/egressed; % on‑demand vs. reserved; third‑party API $ per active.
  • GTM efficacy: attribution incrementality (test or MMM‑validated), CPQ exception rate, discount depth by stage, entitlement accuracy (credits/write‑offs).
  • Success/serve: contact rate per account/order, FRT/TTR by severity, implementation hours per project, backlog age.
  • Data health: event capture coverage, ID match rate, data defect rate, model drift frequency.
  • Ecosystem: time‑to‑integrate for top 3 systems, % deals using connectors, marketplace rank/SLAs.

The Digital Capability Canvas (copy‑ready; fill one per pillar × segment)

  • Scope and owner; maturity score (0–5) with evidence links.
  • Why it matters commercially (price, win rate, NRR, CM2, payback, service).
  • Key metrics and latest values (with corridor and trend).
  • Gaps that move economics (top three, expressed as $/bps).
  • 90‑day actions with cost, time‑to‑impact, and dependencies.
  • Risks and watchlist items (policy, dependency, rate limits).
  • Confidence label and verifier initials.

     

Computation: Weighted Digital Maturity Score (WDMS)

For each segment, compute WDMS = Σ(Pillar Score × Pillar Weight). Show both the number and a heatmap, then translate the result into two sets of model edits: (i) reliability/capacity constraints that cap bookings or raise SLA credits; (ii) unit‑cost and discount‑leakage adjustments that change CM2 and payback.

Step‑by‑step assessment (five focused passes)

  1. Scope and segmentation (Half‑Day 1): Freeze segments and routes where economics differ. Set target SLOs you will test against (availability/latency for digital; OTIF/lead‑time for fulfillment).
  2. Evidence landing (Half‑Day 1): Collect the artifacts listed above; confirm clean‑team boundaries (no source code).
  3. Ops and reliability pass (Day 2): Extract DORA, SLO/incident, and DR evidence; quantify SLA credits; compute reliability headroom and the cost of running at “surge” (Chapter 10.2).
  4. Data/GTM pass (Day 3): Check event capture, ID resolution, and attribution incrementality; tie CPQ/billing and entitlement accuracy to realized price corridors (Chapters 8.2 and 9.3).
  5. FinOps and unit‑cost pass (Day 4): Build per‑unit cloud/third‑party costs; model three curves—on‑demand, reserved, and “with hotspot fixes”—and reflect in CM2 (Chapter 8.3).
  6. Synthesis and scenarios (Day 5): Score pillars, compute WDMS, and run two stress tests: traffic spike (+30% concurrency for four weeks) and dependency shock (third‑party API throttling or policy change). Push results into price, CM2, and timing lines within 24 hours; propose covenants or earnouts when uncertainty is material.
  • Price power: Architecture and data enable packaging that sustains realized price; missing entitlement accuracy shows up as credits and leakage—lower price corridors in the model.
  • NRR/GRR: Reliability, success tech, and proactive telemetry lower churn hazard; reflected in cohort survival curves (Chapter 6.3).
  • CAC/payback: GTM stack hygiene and integrations shorten cycle and reduce spend; reflect in CAC (Chapter 9.4) and payback.

     

  • CM2: Cloud and third‑party unit costs, discount governance, and returns/contact rates land in CT S (Chapter 10.4) and CM2 (Chapter 8.3).
  • Capacity & service: SRE and delivery maturity set throughput and SLA risk; cap bookings or add SLA credit lines where headroom is thin (Chapters 10.2 and 10.3).
  • Policy & platform: Security/privacy and marketplace rules are gates; reflect timing and cost in 11.1/11.4.

Early‑warning indicators to monitor monthly post‑close

  • SLO burn rate and incident MTTR; p95 latency creep near SLO.
  • Deployment frequency and change‑failure rate trend; feature‑flag coverage.
  • Cloud $ per active/user/API call; on‑demand share; hotspot cost growth.
  • CPQ exceptions and discount depth; billing/entitlement error rates and credits.
  • Event capture gaps and ID match rate; experiment win rate and cycle time.
  • Contact rate and backlog age; implementation queue length and slippage.
  • Third‑party API throttling and marketplace policy diffs.

Red flags—and immediate responses

  • Chronic SLA credits or rising p95 latency without an error‑budget process → move price power to upside only; require a 60‑day reliability sprint as a closing condition.
  • On‑demand cloud dependence with unit‑cost spikes at growth tiers → lower CM2; add reserved commitments and hotspot fixes to the 90‑day plan.
  • No entitlement/usage accuracy → haircut realized price; tie earnouts to price realization/NRR.
  • Manual billing and CPQ workarounds → elevate discount leakage risk; enforce DOA/guardrails and prioritize CPQ clean‑up post‑close.
  • Weak privacy/security attestations where RFPs require them → cap enterprise growth to upside only; include certification milestones as conditions precedent.
  • Single critical dependency (payment, messaging, data) with rate‑limit or policy risk → run dependency shock in the model; set diversification or premium‑tier SLAs as covenants.

90‑day uplift plan (only moves that change cash fast)

  • Reliability sprint on the top two incident classes; lock SLOs and error‑budget gates; ship feature‑flag coverage.
  • FinOps quick wins: reserved/savings plans where utilization justifies; cache/egress fixes on the noisiest paths; drop or renegotiate low‑ROI third‑party APIs.
  • GTM stack hygiene: repair lead routing and dedupe; harden CPQ discounts and entitlement mapping; close the loop from billing to realized price analytics.
  • Data foundation: fix the top five missing events, unify IDs, and activate a basic experimentation cadence tied to pricing and onboarding.
  • Ecosystem unblockers: certify or list top two connectors/marketplace apps that unlock named accounts.
  • Security/privacy: close the top pen‑test findings; publish the audit schedule; align product telemetry to privacy commitments.

Acceptance criteria for a decision‑grade digital review

  • Pillar scores with evidence and confidence labels by segment/route‑to‑market; WDMS computed and explained.
  • Reliability, unit‑cost, GTM, and data metrics quantified with corridors and trends; links to SLA credits, realized price, CAC/payback, and CM2.
  • Two stress scenarios run (traffic spike, dependency shock) with model toggles updated within 24 hours.
  • A 90‑day plan with owners, costs, and time‑to‑impact; term‑sheet protections proposed where maturity gaps are material (certification milestones, indexation, earnouts on NRR/price realization).
  • Clean‑team protocols followed; all exhibits footnoted and replicable.

Adopt this framework and “strong tech” or “legacy platform” stop being vague labels. You’ll have a crisp, economic view of digital capability—what it enables, what it constrains, and exactly what to fix first to protect and expand the value you’re buying.

12.2 Tech Stack Competitiveness Checklist

A “competitive” tech stack is not a fashionable architecture diagram. It is a set of capabilities that lets the company win and keep customers at an attractive realized price, deliver reliably at scale, and improve unit economics as it grows—faster than credible alternatives. In commercial diligence, your task is to test that claim with evidence you can underwrite. This checklist gives you a defendable, segment‑aware way to compare the target’s stack against named competitors and substitutes, translate gaps into dollars (price power, win rate, NRR, CM2, CAC/payback), and define a 90‑day uplift plan that changes outcomes in your hold period.

What “competitiveness” means in diligence (anchor this up front)

  • Right to win: The stack enables differentiated outcomes customers will pay for (integration depth, workflow fit, analytics/AI, speed, reliability, trust).
  • Scale curve: Performance and unit cost improve with growth (cloud/FinOps curves, automation, partner leverage), not degrade.
  • Switchability: It is easier for a buyer to switch to the target than from it (migration tooling, data portability, API surface, ecosystem pull).
  • Resilience: The stack keeps promises under stress (traffic spikes, dependency throttling, policy changes) without ruinous expedites or credits.
  • Velocity: Teams can ship value faster and safer than rivals (DORA, change failure rate, time‑to‑integration), compounding advantage.

Step‑by‑step assessment (fast path for diligence)

1) Fix scope, segments, and comparators
 Name the two to four segments/routes‑to‑market that move dollars (from Chapter 6). For each, list the credible alternatives buyers actually compare you to: two named competitors, one substitute (e.g., spreadsheet + services), and, where relevant, a platform’s native offering. Write a one‑line WHTBT statement per segment: “To win Mid‑Market Manufacturing, the stack must integrate with ERP X in <4 weeks, deliver p95 latency <300 ms at 10k concurrent users, and support a 3–5% realized price premium via analytics Y.”

2) Land the evidence pack once (reuse across cuts)

  • Architecture & platform: system and domain diagrams, API catalog, SDKs/webhooks, extension points, versioning policy, multi‑tenant posture.
  • Reliability & operations: SLOs/error budgets, incident postmortems, DORA metrics, DR test logs, capacity headroom.
  • Data/AI: event schemas, lineage/quality SLAs, governed warehouse/lakehouse, model cards, drift alerts, experiment logs.
  • Security & privacy: secure SDLC artifacts, pen‑test summaries, IAM/secret handling, attestations (e.g., SOC/ISO), DPAs/consents.
  • FinOps & unit cost: cloud invoices by service, reserved vs. on‑demand mix, $/API call or account, third‑party API bills and rate‑limits.
  • Ecosystem & integrations: connector catalog, certification/listing status, marketplace ranks/tier, partner sandbox and enablement.
  • GTM & billing: CRM/CPQ discount rules, price ladders, entitlement mapping, billing accuracy/credits, partner portal health.
  • Performance tests: p95/p99 latency and throughput at documented loads; change‑failure rate; migration time studies.
  • Competitor artifacts (clean‑team rules): public docs, APIs, listing/compliance status, pricing pages, open benchmarks, procurement interview recalls.

3) Score along six competitive planes (0–5 scale with anchors)
 Use the same segments and comparators across all planes; write “proof required” beside each criterion.

  1. Functional fit & extensibility
    • Depth of workflow coverage; configurability vs. customization debt; API completeness; SDKs/events.
    • Proof: win/loss reasons; time‑to‑integration studies; partner adoption of extension points.
    • Pays through: win rate, faster cycle, lower implementation CTS, higher NRR.
  2. Performance & reliability at target SLOs
    • Availability; p95/p99 latency; MTTR; change‑failure rate; surge headroom at 80–85% constraint utilization.
    • Proof: SLO burn logs, incident metrics, load‑test reports.
    • Pays through: fewer credits, better retention, enterprise access.
  3. Data advantage & AI leverage
    • Event coverage, ID resolution, quality/lineage; governed features; experimentation cadence; model governance.
    • Proof: telemetry gaps closed, uplift from tests, model drift handling.
    • Pays through: price premium, upsell, lower CAC.
  4. Security, privacy, and compliance access
    • Attestations; third‑party risk; encryption/key management; privacy‑by‑design; AI/algorithmic accountability where applicable.
    • Proof: audit letters, DPIAs, RFP gate passes.
    • Pays through: RFP wins, shorter cycles, fewer escalations.
  5. Economics & scalability (FinOps + third‑party)
    • Unit cost curves (on‑demand vs. reserved/savings); hotspot awareness (DB, egress, third‑party API fees); automation level.
    • Proof: $/API call or account trends; reserved coverage; cost anomalies resolved.
    • Pays through: CM2 lift with volume; protected margin in usage spikes.
  6. Ecosystem & channel readiness
    • Integration coverage for “must‑have” systems; marketplace/app‑store status; partner certification; EDI where needed.
    • Proof: listing/tier, connector attached on deals, partner‑sourced pipeline.
    • Pays through: access, lower CAC, faster implementations.

Scoring anchors (0–5) should mirror 12.1’s rubric: 0 = nonexistent, 3 = defined and repeatable, 5 = differentiating and compounding.

4) Weight by business model (lock and publish)

  • B2B SaaS/usage‑based: Performance/Reliability 20%, Data/AI 15%, Security/Privacy 15%, Architecture/Extensibility 15%, FinOps 15%, Ecosystem 10%, GTM/Billing 10%.
  • Marketplaces/platforms: Ecosystem 20%, Performance/Reliability 20%, Security/Trust 15%, Data/AI 15%, FinOps 15%, Architecture 10%, GTM 5%.
  • E‑commerce/DTC: CX/Support tech 15% (treat within Performance/Reliability for service), GTM/Billing 15%, Data/AI 15%, FinOps 15%, Ecosystem 10%, Architecture 10%, Security/Privacy 10%, Delivery/Quality 10%.
     Document any deviations for regulated or embedded/hardware‑plus‑service models.

5) Compute the Weighted Tech Competitiveness Score (WTCS)
 WTCS_segment = Σ (Plane Score × Weight). Show the math and a confidence label (H/M/L). Publish a heatmap versus named competitors using only public or clean‑team‑approved data. Where competitors are unknown, benchmark to “credible substitute” thresholds (e.g., spreadsheet + SI delivery time, platform native latency).

6) Quantify economics (turn scores into dollars)
 For each segment/channel, tie WTCS and its sub‑scores to:

  • Price corridors (8.2): higher Performance/Data/Security scores → higher realized price or lower discount reliance.
  • Win rate & cycle (9.1): Functional fit/Ecosystem → stage conversion; Security/Privacy → cycle compression.
  • CAC & payback (9.4): Ecosystem/GTM stack → lower acquisition cost and faster implementation.
  • CM2/unit cost (8.3, 10.4): FinOps → $/API call/account/order; reduced credits/returns.
  • NRR/GRR (6.3): Reliability/Support tech/Data → lower churn hazard, higher expansion.

7) Stress‑test where tech usually breaks
 Run two or more fast scenarios and propagate results into the model:

  • Traffic spike: +30% concurrency for 4 weeks—does p95 latency stay under SLO without on‑demand cost blow‑up?
  • Dependency shock: third‑party API throttling or price hike; payment or messaging provider incident.
  • Migration surge: 10 enterprise cutovers in parallel—does implementation capacity or data tooling become the constraint?
  • Policy change: marketplace or platform terms shift (rate limits, ranking, take‑rates); privacy residency requirement.
  • Feature parity attack: named rival ships capability X—time‑to‑parity and economic impact (8.4 parity‑creep monitor).

8) Write the 90‑day uplift plan (only moves that change cash fast)

  • Reliability sprint on top two incident classes; lock SLOs/error budgets; expand feature‑flag coverage.
  • FinOps moves: convert high‑utilization services to reserved/savings; fix two hotspot endpoints (cache, query plan, shard); renegotiate or replace low‑ROI third‑party APIs.
  • Ecosystem unlockers: certify/list top two connectors; publish migration tooling; stand up a partner sandbox with quick‑start guides.
  • GTM/billing hygiene: repair CPQ guardrails; tighten entitlement mapping; resolve billing credits at root cause.
  • Data foundation: close top five missing events; unify IDs; restart an experiment cadence for pricing/onboarding tweaks.
  • Security/privacy gates: close critical pen‑test findings; schedule attestations required in RFPs; document AI/algorithmic risk controls where applicable.

The checklist (use this as you work)

Architecture & Extensibility

  • Domain boundaries clear; versioned public APIs; stable event model; configuration over customization; multi‑tenant guardrails.
  • Extension points (SDKs/webhooks) used by partners; backwards compatibility policy enforced; migration scripts/templates exist.

Performance & Reliability

  • SLOs with error budgets; p95/p99 latency and availability by region/tier; DORA metrics trending the right way; DR tested with RTO/RPO met.
  • Constraint headroom ≥15–20% at base; surge plan for +30% concurrency without SLO breaches or ruinous cost.

Data & AI

  • Event capture ≥95% on critical flows; lineage and quality SLAs; governed features; experiment platform with documented wins; model drift detection and rollback.
  • Customer‑facing analytics/ML demonstrably move outcomes (price premium, win rate, upsell), not vanity.

Security & Privacy

  • Secure SDLC; secrets and IAM hygiene; vuln management SLAs; attestations current/dated; DPAs & consents aligned to product telemetry; third‑party risk governed.
  • For AI: model inventory, evaluation, explainability for regulated segments.

FinOps & Unit Cost

  • Cost allocation/showback; reserved vs. on‑demand commitments aligned to utilization; hotspot visibility (DB/egress/API fees).
  • Unit‑cost curves built (per API call/account/order) with targets and owners.

Ecosystem & Integrations

  • Connectors for “must‑haves” by segment; certification/listing status; marketplace rank/tier; partner enablement; EDI where relevant; time‑to‑integrate < target.
  • Migration kits (schema maps, playbooks, test harnesses) lower switching friction.

GTM Stack & Billing

  • Clean CRM/MAP/CDP flows; lead routing/dedupe; CPQ discount ladders; billing/entitlement accuracy; credits tracked to root cause.
  • Attribution incrementality tested (not platform ROAS only).

Delivery & Quality

  • CI/CD automation coverage; change‑failure rate low and improving; environment parity; feature‑flag use; defect escape rate trending down.

Governance

  • Roadmap tied to P&L (OKRs); architecture review cadence; risk register for dependencies and obsolescence; kill rules enforced.

Quantitative lenses you can compute quickly

  • Performance/Cost Index (PCI) = (p95 latency at target load vs. SLO) × (unit cost at load ÷ target) → lower is better.
  • Integration Coverage Ratio = (# certified/”must‑have” connectors delivered ÷ # required in segment).
  • Migration Friction Index = (median hours to cutover + data quality defects per migration) ÷ cohort size.
  • Reliability Penalty Rate = SLA credits ÷ segment revenue (LTM).
  • FinOps Leverage = ($ on‑demand − $ reserved/savings counterfactual) ÷ total cloud $ (LTM).
  • Entitlement Accuracy = (credit notes and write‑offs due to entitlement errors ÷ billings).
  • DORA Health = composite of deployment frequency ↑, lead time ↓, change‑failure ↓, MTTR ↓.

Copy‑ready templates (paste into your workspace)

A) Tech Stack Competitiveness Card (one per segment)

  • Segment & comparators (2–3 named + 1 substitute).
  • WHTBT statement (win conditions).
  • Plane scores (0–5) with proof links; WTCS and confidence.
  • Economics link: price corridor, win/cycle, CAC/payback, CM2, NRR effects.
  • Top 3 gaps and 90‑day actions (cost, owner, time‑to‑impact).
  • Stress‑test results (traffic spike, dependency, migration, policy).
  • Sources and clean‑team notes; verifier initials.

B) Performance Test Charter

  • SLOs (availability/latency); traffic profile; data set size; concurrency; success criteria; rollback plan.
  • Metrics to capture (p50/p95/p99, error rates, MTTR); cost telemetry on the same window.
  • Owner; date; environment parity notes.

C) Unit‑Cost Curve Sheet

  • $/API call/account/order at p50/p95 load; reserved vs. on‑demand; third‑party API $ per active; hotspots and planned fixes.

D) Integration Coverage Sheet

  • “Must‑have” systems by segment; connector status (GA/beta/roadmap), marketplace/listing level; % deals using connector; migration kit availability.

E) Third‑Party Dependency Card

  • Provider; function; rate limits and SLAs; incident history; price tiers; diversification plan; economic impact of throttle/outage.

Industry nuances (handle explicitly)

  • Regulated B2B (health/financial/public sector): attestations and data residency are gate conditions; weight Security/Privacy and Reliability more heavily; encode timing and cost into 11.1/11.4.
  • Marketplaces/platforms: trust & safety belongs with Security; search rank and take‑rates are quasi‑regulatory; treat paid placement creep as a FinOps and channel risk (9.2, 11.4).
  • E‑commerce/DTC: returns and contact rates dominate CTS; CX and fulfillment tech must link to 10.3/10.4.
  • Hardware + service: field telemetry and OTA update capability are core; treat spares/diagnostics as part of reliability and NRR.

Clean‑team and competition guardrails

  • Compare to competitors using public artifacts, procurement/partner interviews, and anonymized, aggregated data only.
  • No pre‑close coordination or competitively sensitive exchanges. Maintain a source log and ring‑fence.

Early‑warning indicators (monitor monthly)

  • SLO burn and p95 latency creep; incident MTTR; change‑failure rate.
  • Unit‑cost $ per API call/account/order; on‑demand share rising.
  • Entitlement/billing credits; CPQ exception and discount depth drift.
  • Connectors attach rates on new wins; marketplace rank/tier shifts; partner certification decay.
  • Data capture gaps; experiment cadence; model drift alerts.
  • Third‑party API throttle events; fee increases; platform policy diffs.

Red flags—and immediate responses

  • SLA credits trending up with no error‑budget process → lower price corridors; require a reliability sprint as a closing condition.
  • On‑demand cloud dependence at growth tiers → reflect CM2 downside; fund reserved commitments and hotspot fixes in the 90‑day plan.
  • No migration tooling while growth depends on takeaways → haircut win‑rate and cycle assumptions; build migration kits Day‑1.
  • Connector gaps on “must‑have” systems → move enterprise growth to upside only; prioritize two connectors for certification.
  • Entitlement/billing inaccuracies → discount leakage risk; harden CPQ rules and entitlement mapping; tie earnouts to realized price/NRR.
  • Single critical dependency without diversification → model throttle/outage scenario; require alternate or premium SLA.

72‑hour sprint plan (from blank page to decision‑grade view)

  • Day 0: Freeze segments, comparators, and weights; issue the evidence request; confirm clean‑team boundaries.
  • Day 1: Score Performance/Reliability and FinOps (SLOs, DORA, unit‑cost curves); draft two Tech Stack Competitiveness Cards.
  • Day 2: Score Architecture/Data/Security; complete Integration Coverage and Dependency Cards; run traffic spike and dependency shock.
  • Day 3: Compute WTCS by segment; translate into price, win/cycle, CM2, CAC/payback, and NRR changes; publish the 90‑day uplift plan and term‑sheet protections (certification milestones, indexation, earnouts on NRR/price realization).

Acceptance criteria for a decision‑grade competitiveness review

  • Segment‑level cards completed with plane scores, WTCS, sources, and confidence labels.
  • Reliability, unit‑cost, integration, and billing/entitlement metrics quantified and tied to economics.
  • Two stress scenarios run; model toggles updated within 24 hours; valuation ranges and structures reflect residual risk.
  • A 90‑day uplift plan with owners, costs, and time‑to‑impact; clean‑team protocols documented.

Use this checklist and “modern tech” or “legacy stack” stops being a slogan. You’ll have a comparative, economics‑anchored view of the stack—where it truly leads, where it lags, and exactly what to fix first to defend price, accelerate win rate, lift CM2, and protect retention.

12.3 Cybersecurity & Data Privacy Risk Guide

Cybersecurity and data privacy are commercially material. A breach, outage, or misuse of data does not just generate headlines—it shows up as SLA credits, delistings, failed audits, lost tenders, churn, litigation, and lengthened payback. In commercial due diligence your job is not to re‑run an audit; it is to (i) locate the crown jewels and the likely failure points, (ii) quantify revenue‑at‑risk (RaR) and margin‑at‑risk (MaR) under realistic incidents, and (iii) specify the few fixes that change outcomes within the hold period. Use this guide to produce decision‑grade outputs that tie directly to price realization, NRR/GRR, CM2, CAC/payback, and timing.

How this guide is structured

 You will (1) assemble a compact evidence pack; (2) map crown jewels and attack surface; (3) baseline security and privacy controls; (4) quantify incident scenarios; (5) push toggles into the model and term sheet; and (6) issue a 90‑day plan with owners, dates, and costs. Keep it segmented by product family, customer tier, channel, and region; averages hide exposure.

Scope and lenses (freeze before you start)

  • Segments and routes‑to‑market: same segmentation as Chapter 6 (customer/job, size band, channel, region, product).
  • Crown jewels: data that creates legal or reputational exposure (PII/PHI/PCI, user‑generated content, biometrics), systems that produce revenue (checkout, trading, payments, APIs), and secrets that create advantage (source code, models, pricing).
  • Incident families to test: ransomware/outage, data exfiltration, business email compromise (BEC) and payment fraud, credential‑stuffing on consumer apps, third‑party/subprocessor breach, cloud misconfiguration, insider error, and regulatory enforcement after privacy/control failures.

Evidence pack (request once; analyze many times)

  • Governance & assurance: current security and privacy policies, risk register, board/C‑level reporting, security roadmap and budget, SOC/ISO/PCI/HIPAA attestations or gaps, results of the last penetration test and vulnerability scans (summary only), audit letters, business continuity & disaster recovery (BCP/DR) tests, breach/incident postmortems for L24M.
  • Architecture & operations: system and data‑flow diagrams; public‑facing assets inventory; identity directory (SSO/MFA coverage); privileged access model; secrets management; logging/observability scope; EDR/XDR coverage; backup architecture, immutability, and restore tests; change management; third‑party dependencies and rate limits.
  • Data privacy: data inventory and classification; Records of Processing Activities (RoPA); retention & deletion schedules; consent and preference management; cookie/SDK deployment; cross‑border transfer mechanisms; DPIAs; DSAR volumes and SLA performance; marketing law compliance (e.g., opt‑in/opt‑out evidence).
  • Commercial interfaces: customer security addenda in MSAs, SLA credit ladders for security/reliability breaches, marketplace/retailer policy requirements, RFP security/privacy gates, subprocessor list and contracts/DPAs, cyber insurance cover (limits, retentions, exclusions).
  • People & process: security awareness program, phishing simulation metrics, joiner‑mover‑leaver controls, shadow‑IT/SaaS sprawl reports, contractor/offshore access.

Step‑by‑step assessment (fast path for diligence)

1) Map crown jewels and blast radius
 List the top 5–10 data sets and systems that matter commercially. For each: owner, where stored/processed, copies/backups, who has access (by role), and which customers/regions are implicated. Add the blast radius: if this asset is compromised or down, which segments stop transacting, for how long, and which contracts trigger credits or termination.

2) Draw the external attack surface and control coverage
 Summarize internet‑facing assets (domains, APIs, apps), third‑party entry points (IDP, payment, messaging, data vendors), and privileged access paths. Compute quick coverage ratios by segment/tenant where relevant: MFA coverage, SSO adoption, EDR coverage, log coverage on crown‑jewel systems, backup immutability share, critical/high CVE remediation time (p50/p90), and admin account count.

3) Baseline privacy posture and commercial gates

  • Data lifecycle: what’s collected, minimum necessary, legal basis, consent granularity, retention and deletion actually enforced, and DSAR throughput.
  • Cross‑border/residency: where data sits vs. where users live; residency toggles for regulated customers; latency/cost impacts if regionalization is required.
  • Marketing & cookies: CMP in place; evidence of consent sync to MAP/CDP; email/SMS compliance; platform/OS privacy changes affecting attribution or re‑engagement (connect to 9.3).
  • RFP & channel gates: which certifications or attestations must‑have (e.g., SOC/ISO, PCI scope), and what revenue is contingent on them.

4) Review incident history and leading indicators
 Over the last 24 months, summarize: incidents (type, cause, dwell time, MTTD/MTTR), near misses, credits/fines paid, external notifications, and changes implemented. Track phish click rate, BEC attempts, ticket backlog for security/privacy, and open high‑severity pen‑test findings.

5) Quantify scenarios that change decisions
 Translate incidents into dollars with simple, auditable equations. Tie every number to a driver or contract term.

  • Ransomware/outage (platform or 3PL/DC):
     RaR_day = Daily revenue in affected segments × % unable to transact.
     MaR_day = SLA credits + expedites + overtime + cloud overage − any insurance recovery (after retention, within limits).
     Total impact ≈ (RaR_day + MaR_day) × duration_days + churn hazard uplift × at‑risk ARR.
  • Data exfiltration (PII/PHI/PCI/intellectual property):
     Incident cost = Notification & forensics + monitoring + legal/regulatory + customer credits + PR + insurance retention + churn hazard.
     Churn hazard ≈ affected accounts × hazard uplift (from observed post‑breach churn in similar segments) × ARR/account.
     Add platform/retailer delist risk where applicable (Chapter 9.2, 10.3).
  • BEC & payment fraud (AR/AP tampering):
     Loss exposure = Average invoice size × probability of diversion × detection lag − recoveries.
     Add DSO drift if disputes rise; reflect in working‑capital lines.
  • Credential‑stuffing (consumer apps/marketplaces):
     MaR = fraud reimbursements + support CTS + chargebacks + platform penalties; include downstream CAC/payback elongation if trust signals fall.
  • Third‑party/subprocessor or cloud misconfiguration:
     RaR/MaR proportional to dependency share for affected segments; include compliance penalties if residency or purpose limitations are violated.
  • Enforcement & privacy fines:
     Exposure = range of penalties relevant to jurisdiction × likelihood band × duration of non‑compliance; add remediation capex/opex and cycle‑time slippage for new controls.

Where data are thin, present corridors (low/base/high) with assumptions. Always show insurance math explicitly: limits, coinsurance, exclusions (e.g., war/critical infrastructure), and time to recovery.

6) Push findings into the model within 24 hours

  • Price realization: lower corridors in segments where security/privacy gaps create discount pressure or escalate security addenda.
  • CM2: add SLA credit lines and CTS deltas (for fraud/chargebacks, support load, cloud overage during incidents).
  • NRR/GRR: apply a churn‑hazard uplift for affected cohorts (link to 6.3).
  • Timing: slip revenue recognition where remediation or certification is a gate.
  • Working capital: increase DSO and dispute reserves under BEC/fraud risk. 

7) Translate residual risk into terms and covenants

  • Conditions precedent: close specific “go/no‑go” gaps (e.g., certification, pen‑test remediation, DR test pass) before closing.
  • Indemnities/escrows: known or suspected incidents, unresolved investigations, privacy violations, legacy data debt (e.g., untracked archives).
  • Covenants: maintain SSO/MFA coverage, EDR/log coverage on crown‑jewel systems, backup immutability and quarterly restore tests, subprocessor change notifications, privacy program milestones, and indexation for new compliance cost.
  • Earnouts: tie to NRR or price realization in ESG‑/security‑gated segments once certifications land.

Quick‑compute metrics that tie to economics

  • MFA coverage (users/admins) and SSO adoption across employees/contractors and customer tenants.
  • Critical/high CVE remediation time (median and p90) and % overdue.
  • EDR/XDR coverage on endpoints and servers; log coverage for crown‑jewel systems.
  • Privileged identities: count, break‑glass accounts, SoD conflicts, orphaned accounts.
  • Backup posture: immutability enabled (Y/N), last successful restore test age, RPO/RTO achieved.
  • Incident performance: MTTD/MTTR for top three incident types; open high‑severity findings >30 days.
  • Privacy throughput: DSAR volumes and SLA adherence; deletion job success; consent capture rate; % marketing sends without valid consent.
  • Third‑party risk: % revenue touching vendors without current security/privacy attestations; single‑point dependencies with no premium SLA or alternative.

Clean‑team & safe‑handling rules (non‑negotiable)

  • No customer‑ or key‑material‑identifiable artifacts outside the clean‑team ring‑fence.
  • Accept summaries of pen tests and scans; do not request exploit details or credentials.
  • No active scanning or phishing simulations in diligence without written authorization from the target’s counsel.
  • Redact subprocessor endpoints and IPs in external exhibits; use codenames for critical assets.

Industry nuances you must handle explicitly

  • Healthcare/life sciences: HIPAA/clinical data and device cybersecurity create timing gates; tie to approvals and coverage (11.1).
  • Fintech/payments: PCI scope and key management; BEC and ACH fraud are primary cash risks; card network programs create chargeback thresholds.
  • Marketplaces/e‑commerce: credential‑stuffing, account‑takeover, and refund abuse drive penalties and delist risk; trust & safety staffing is CTS.
  • Industrial/IoT: legacy OT, weak patching windows, and vendor remote access; safety and downtime hit revenue directly.
  • SaaS/AI platforms: model governance, training‑data provenance, prompt/embedding data handling, and tenant isolation; API rate‑limit and dependency shocks are central (12.2).

Copy‑ready templates (paste into your workspace)

A) Cyber & Privacy Risk Canvas (one per segment)

  • Scope & owner: [segment/channel/region]; accountable exec; security and privacy POCs.
  • Crown jewels: [data sets/systems], access paths, backups.
  • Controls snapshot: MFA/SSO %, EDR %, log %, CVE remediation p50/p90, backups (immutability/RPO/RTO), pen‑test open Sev‑1/2.
  • Privacy snapshot: data map status, retention/deletion, DSAR SLA, consent/CMP status, residency controls.
  • Commercial gates: certifications/attestations, marketplace/retailer rules, RFP must‑haves.
  • Incidents (L24M): type, cause, MTTD/MTTR, credits/fines, actions taken.
  • Scenario impacts (corridors): RaR/MaR for ransomware/outage, exfiltration, BEC/fraud, credential‑stuffing, third‑party breach.
  • Model hooks: price, CM2/CTS, NRR/GRR, working capital, timing.
  • Mitigations (90‑day): top 3 with cost, owner, and time‑to‑impact.
  • Confidence & sources: H/M/L; artifact links; verifier initials.

B) Security Control Checklist (tick H/M/L; add notes)

  • Identity: SSO, MFA (all users/admins), PAM for privileged sessions, JML automation, SoD enforcement.
  • Endpoints/servers: EDR/XDR coverage, disk encryption, patch SLAs, device management for BYOD.
  • Secrets & keys: vault usage, rotation, HSM for payment/PII, no secrets in code.
  • Network/app: WAF, API gateway, DDoS plan, secure SDLC, SAST/DAST, dependency scanning, feature flags for kill switches.
  • Observability: central logs, retention, alerting to on‑call, playbooks, tabletop frequency.
  • Backup/DR: immutable backups, offline copy, restore tests, RPO/RTO met.
  • Third‑party: subprocessor register, security addenda, SLA tier, exit/portability, rate‑limit monitoring.
  • Training: phish simulations, secure coding, privacy by design in product discovery.

C) Privacy Operating Checklist

  • Data map & classification complete; RoPA maintained; minimization in place; retention & deletion enforced; DSAR tooling and SLA.
  • Consent and preference capture; CMP configured; marketing systems honor preferences; children’s data safeguards where needed.
  • Cross‑border transfer mechanism and residency toggles; vendor DPAs current; audit program for subprocessors; cookie/SDK inventory reviewed quarterly.
  • DPIAs for high‑risk processing; breach notification procedures tested; incident linkage to comms/legal.

D) Scenario Card (one per incident family)

  • Trigger & scope; affected assets and segments; duration bands.
  • Impact bridge: RaR, SLA credits, fraud/chargebacks, support CTS, cloud overage, legal/PR, insurance.
  • Churn hazard uplift & pipeline impact; marketplace/retailer penalties.
  • Mitigations & lead times (e.g., reserved capacity, premium SLAs, rate‑limit increases, DR drills, vendor switch).
  • Owner; playbook and comms templates; next tabletop date.

Early‑warning indicators (monitor weekly/monthly)

  • Rising p95 latency toward SLO; recurring Sev‑1/2 incidents; MTTR drift (link to 10.3, 12.1).
  • Open critical/high CVEs >30 days; EDR/log coverage dips; new orphaned or privileged accounts.
  • Phish click rate and BEC attempts; payment‑diversion near‑misses; spike in refunds/chargebacks.
  • DSAR backlog; deletion job failures; consent error rates; CMP deployment gaps.
  • Subprocessor changes without notice; platform/marketplace policy diffs tied to security/trust.
  • Insurance notices (coverage changes, exclusions) and premium hikes.

Red flags—and immediate responses

  • No SSO/MFA on employees or admins → downgrade enterprise price/NRR assumptions; require MFA/SSO rollout as CP; enforce discount guardrails until closed.
  • Backups without immutability/restore tests → cap bookings in regulated segments; add DR pass as CP; reflect outage downside in model.
  • Open Sev‑1/2 pen‑test findings >60 days → haircut realized price and NRR; escrow remediation costs; tie earnouts to price realization/NRR.
  • Subprocessor with repeated findings or no attestation → haircut revenue in affected segments; require alternate or premium SLA; add covenant on subprocessor changes.
  • Privacy programs exist only on paper (no data map, DSAR backlog) → increase compliance cost and churn hazard; add milestones and holdbacks.

90‑day uplift plan (only moves that change cash fast)

  • Identity first: SSO + enforced MFA for employees/admins; PAM for break‑glass; kill orphan/admin bloat.
  • Incident & DR: lock SLOs and error budgets; run two tabletops (ransomware, BEC); enable immutable backups; complete a restore test; publish RPO/RTO.
  • FinOps & resilience: reserve cloud capacity on hot paths; raise rate limits or add a secondary provider for critical dependencies; ship feature‑flag kill switches.
  • Third‑party & contracts: upgrade to premium SLAs for single‑point providers; update DPAs; align customer security addenda with what the platform can actually deliver.
  • Privacy hygiene: finish the data map; enforce deletion/retention on crown‑jewel systems; fix consent capture and DSAR tooling; publish a cross‑border/residency statement where it wins deals.
  • Billing & credits loop: tag every security‑/privacy‑related credit and drive root‑cause fixes; reflect reductions in CM2.

72‑hour sprint plan (from blank page to decision‑grade)

  • Day 0: Freeze segments and crown jewels; issue evidence request; confirm clean‑team boundaries.
  • Day 1: Build control coverage snapshot (MFA/SSO, EDR, logs, backups, CVE SLAs, admin counts); draft two Cyber & Privacy Risk Canvases.
  • Day 2: Quantify three scenarios (ransomware/outage, exfiltration, BEC/fraud) with low/base/high bands; compute insurance math; identify certification/RFP gates and subprocessor exposures.
  • Day 3: Push toggles into the model (price corridors, CM2 credits/CTS, NRR hazard, working capital, timing); publish early‑warning indicators and a 90‑day plan; propose term‑sheet protections (CPs, covenants, indemnities, earnouts tied to NRR or price realization).

Acceptance criteria for a decision‑grade cyber/privacy review

  • Crown jewels and blast radius mapped by segment; control coverage quantified with evidence and confidence labels.
  • Three incident scenarios modeled with RaR/MaR corridors and insurance effects; model updated within 24 hours.
  • Privacy program assessed end‑to‑end (data map, consent, DSAR, retention, residency); commercial gates and channel policies documented.
  • 90‑day uplift plan issued with owners, cost, and time‑to‑impact; term‑sheet protections drafted where residual risk is material.
  • Clean‑team protocols observed; all exhibits footnoted and replicable.

Run this guide and “we take security seriously” becomes a defensible, economics‑anchored view: what is truly at risk, what it would cost if it broke, and exactly what to do in the first 90 days to protect price, retention, and margin.

12.4 Innovation Pipeline Assessment Template

Innovation is only valuable when it is timely, de‑risked, and wired to economics. In commercial due diligence, the objective is not to admire the roadmap; it is to translate the pipeline into revenue timing, price power, NRR uplift, CM2 impact, and cash burn—and to assign realistic probabilities and lead times. Treat “innovation” broadly: new features, SKUs, analytics/AI capabilities, packaging and pricing changes, new routes‑to‑market, partnerships, and business‑model moves. Your assessment should separate ideas from investable options with defined evidence thresholds, resources, and go/no‑go dates.

This template gives you a step‑by‑step method, scoring rubric, and copy‑ready tools to (i) inventory the pipeline, (ii) stage projects with evidence‑based gates, (iii) quantify risk‑adjusted value, (iv) reconcile to capacity and compliance, and (v) wire the result into valuation ranges and term‑sheet structure.

What “good” looks like (anchor this before you start)

  • Customer pull is explicit. Each initiative is tied to named customer jobs, quantified pain, and observed willingness‑to‑pay (6.2).
  • Feasibility is proven where it matters. Critical uncertainties have experiments or prototypes with measured outcomes; dependencies and rate limits are known (12.1, 12.2).
  • Unit economics survives contact with scale. There is a credible path to CM2 neutrality/positivity within the hold period (8.3, 10.4).
  • Regulatory and privacy gates are priced and scheduled. Approvals, certifications, or data residency are treated as timing gates with costs (11.1, 12.3).
  • GTM readiness is real. Packaging, price fences, channel enablement, and entitlement/billing accuracy are specified (8.2, 9.2).
  • Portfolio is balanced and kill rules are enforced. Zombie projects are rare; capital is concentrated where option value is highest.

Step‑by‑step pipeline assessment (a two‑ to four‑week sprint)

1) Freeze scope and segmentation
 Use the same segmentation from Chapter 6 (customer/job, size band, route‑to‑market, region, product family). Define the hold‑period horizon (e.g., 18–36 months) and materiality thresholds (e.g., ≥2% revenue lift or ≥100 bps CM2 swing).

2) Build the pipeline inventory (single source of truth)
 Collect all in‑flight and proposed initiatives. For each, capture: problem statement, target segment(s), proposed value proposition, evidence to date, stage, critical dependencies, resourcing, spend to date, and next decision date. Include non‑product innovations (pricing and packaging experiments, channel programs, partnerships, service models).

3) Assign stages with evidence‑based gates
 Avoid calendar‑based “percent complete.” Use four stages with Definition of Done checklists:

  • Discover (desirability risk): problem validation interviews; quantified pain; first WTP signal; success metric defined.
  • Validate (viability risk): prototype or concierge MVP; initial conversion/retention; pricing experiment read; evidenced willingness‑to‑pay; compliance path drafted; FMV estimate for feature/package.
  • Build (feasibility + scale risk): architecture and data design complete; SLO impact assessed; capacity ladder (10.2) and unit cost (12.1/FinOps) defined; security/privacy review passed; pilot/lighthouse signed.
  • Scale (GTM risk): billing and entitlement accuracy validated; channel enablement live; support runbooks and SLAs set; service and cost‑to‑serve modeled (10.3/10.4); DR and incident playbooks updated.

Promote at gate reviews only when evidence is in hand, not when a plan exists.

4) Quantify risk‑adjusted value (rNPV) and option logic
 Convert narrative to dollars and timing using simple, auditable equations:

  • Cash flows: forecast incremental revenue by segment × realized price (8.2) × attach/penetration × ramp curve − CM2 drag (COGS + CTS; 10.4) − opex.
  • Risk‑adjusted NPV (rNPV): sum over stages: rNPV=∑t(CashFlowt×∏i≤tpi)/(1+r)t−StageCosts\text{rNPV} = \sum_{t} \left( \text{CashFlow}_t \times \prod_{i \le t} p_i \right) / (1+r)^t – \text{StageCosts}rNPV=∑t​(CashFlowt​×∏i≤t​pi​)/(1+r)t−StageCosts
     where pip_ipi​ is the probability of clearing stage iii, updated from actual evidence (not generic priors).
  • Expected Value of Information (EVI): value of running the next experiment = (change in rNPV if the uncertainty resolves favorably × probability of learning) − experiment cost. Use EVI to prioritize tests.
  • Option elasticity: compute “value at stake per week” (ΔrNPV/Δtime) to surface where delays punish economics most.

5) Reconcile with capacity, reliability, and privacy/security
 For each initiative, confirm (i) constraint headroom at target SLOs (12.1, 10.2), (ii) unit‑cost curves and cloud/third‑party fees (12.1 FinOps), and (iii) privacy/security gates and attestations (12.3). If any are binding, cap the upside and/or push milestones.

6) Validate GTM readiness and price power
 Map each initiative to packaging, fences, and list pricing (8.2), channel activation (9.2), and CAC/payback math (9.4). No GTM plan → no upside in base case.

7) Portfolio balance and kill rules
 Aggregate by Core / Adjacent / New and by time to cash. As a baseline, many portfolios benefit from ~70/20/10 allocation of spend to Core/Adjacent/New, adjusted for context. Enforce kill rules: if a project misses two evidence gates in a row or burns EVI < 0 for a quarter, shelve it or pivot.

8) Push into the model and term sheet

  • Base case: include only initiatives with ≥70–80% combined stage probability and inside the hold period; haircut realized price until entitlement/billing error rate is ≤ target.
  • Upside case: include initiatives with 30–60% stage probability, capped by capacity and policy gates; tie to earnouts or covenants.
  • Reflect timing gates (regulatory/attestations), CM2 effects (unit cost + CTS), and NRR uplift for expansion features.

Scoring rubric and portfolio view

Weighted Innovation Health Score (WIHS)
 Score each initiative 0–5 on five dimensions, then weight by segment economics to produce a project score; portfolio WIHS is the weighted mean by spend.

  1. Desirability (0–5): Voice‑of‑Customer proof, LOIs, cohort retention or usage uplift in tests.
  2. Viability (0–5): unit economics corridor (CM2 path; payback within horizon); pricing/packaging tested.
  3. Feasibility (0–5): architecture fit, SLO headroom, unit cost curve defined, security/privacy cleared, dependency risk.
  4. GTM Readiness (0–5): packaging, entitlement, billing accuracy, channel enablement, support runbooks.
  5. Momentum (0–5): velocity (cycle time to learning), team capacity, on‑time gates, EVI positive.

Anchor scores to evidence (artifacts, metrics, contracts); never to opinions.

Copy‑ready templates

A) Innovation Pipeline Inventory (fields to capture for every initiative)

  • Title and short problem statement.
  • Target segment(s)/route‑to‑market; customer jobs and quantified pain.
  • Stage (Discover/Validate/Build/Scale) and next gate date.
  • Evidence to date: VoC, experiments, prototypes, pricing tests, LOIs/lighthouse customers.
  • Dependencies: platform components, third‑party APIs, data, privacy/security, regulatory approvals, supply chain.
  • Resource plan: squad composition (PM/Eng/Design/Data/QA/Legal/Sec), capacity months, partner reliance.
  • Economic model: realized price path, attach/penetration, unit cost and CTS, expected CM2, cash burn, payback.
  • Risk & mitigations: top 3 risks, owner, EVI for the next test.
  • Decision rules: go/kill/shelve criteria and date.

B) Innovation Evidence Map (one‑pager per initiative)

  • Hypotheses: desirability, feasibility, viability, GTM.
  • Critical uncertainties: ranked by rNPV sensitivity.
  • Experiments/tests: design, success metric, sample size/power, start/stop dates, decision rule.
  • Evidence so far: numeric outcomes; confidence label (High/Medium/Low).
  • Next decision: promote/hold/kill with rationale.

C) Stage Gate Checklist (use verbatim at reviews)

  • Discover → Validate:
    • ≥10 target‑customer interviews with convergent pain; quantified WTP or revealed preference.
    • One high‑fidelity prototype or concierge MVP with ≥1 target success metric movement.
    • Pricing test design approved (8.2); security/privacy pre‑check done.
  • Validate → Build:
    • Lighthouse customer(s) signed (paid pilot, LOI, or contract addendum).
    • Measurable lift in activation/retention or conversion vs. control.
    • Architecture/design review passed; capacity ladder and SLO impact assessed (12.1/10.2); initial FinOps curve set.
    • Regulatory/attestation path and timelines signed off (11.1, 12.3).
  • Build → Scale:
    • DR/incident playbooks updated; SLOs met at load in test; entitlement/billing accuracy ≥99.5% for scope.
    • Support runbooks, SLAs, and training complete; channel materials shipped; price fences enforced.
    • CM2 corridor validated on pilot cohort; CTS within plan (10.4).

D) Risk‑Adjusted Economics Card (attach to each initiative)

  • Incremental revenue and CM2 by quarter (base/range).
  • Stage probabilities with evidence notes.
  • rNPV and ΔrNPV per quarter of delay.
  • Required capex/opex; cash burn profile; payback month at scale.
  • Capacity and policy gates with dates; model hooks (price, CM2, NRR, timing).

E) Governance & Cadence

  • Monthly portfolio review: WIHS trend, spend vs. EVI, kills/shelves, headcount reallocation.
  • Quarterly customer council: lighthouse feedback, NPS for beta features, price realization checks.
  • Change control: any promotion that changes SLOs, unit cost, or CTS must pass a technical/operations review (12.1, 10.x).

Quantitative lenses you can compute quickly

  • Innovation Velocity: number of evidence‑based gate promotions per quarter ÷ active squads.
  • Learning Lead Time: median days from test start to decision; target a steady decline.
  • Dollarized Learning Rate: ΔrNPV created per month from evidence; use to prioritize squads.
  • Zombie Ratio: share of initiatives with >60 days and no customer touch or code/experiment artifact.
  • Attach/Uplift Evidence: change in conversion, activation, retention, or ARPU in treatment vs. control cohorts.
  • Price Realization Readiness: % of CPQ/billing/entitlement test invoices with zero credits.
  • Capacity Shadow Price: ΔrNPV per engineer‑month for the top three initiatives—guides reallocation.

Integration points with other workstreams

  • Chapter 6 (Demand): VoC and elasticity findings must anchor desirability and price experiments.
  • Chapter 8 (Pricing/Unit Econ): Pack/price tests and unit economics determine viability; entitlement accuracy determines realized price corridors.
  • Chapter 9 (GTM): Channel enablement and CAC/payback shape the scale stage.
  • Chapter 10 (Ops): Capacity and service SLOs constrain timing and CM2; include test traffic and pilot logistics in 10.2/10.3 plans.
  • Chapter 11 (Regulatory/ESG): Approvals and policy shifts create timing gates and cost toggles.

Early‑warning indicators (monitor monthly)

  • Gate slippage >30 days on any initiative with ≥5% of plan revenue.
  • Entitlement/billing errors >0.5% on pilots; rising SLA credits on beta features.
  • Capacity headroom <15% at the constraint, or cloud on‑demand share rising on hot paths (12.1).
  • LOIs/lighthouse churn; pilot NPS or engagement below control.
  • EVI negative for two consecutive months; zombie ratio trending up.
  • New regulatory or platform policy diffs affecting launch (11.4).

Red flags—and immediate responses

  • Roadmap without evidence. Response: freeze promotions; run two fast tests to establish WTP and behavior change; cut projects with no path to proof.
  • Entitlement/billing not ready. Response: move upside to upside‑only case; add CPQ/billing cleanup to 90‑day plan; enforce discount guardrails (8.2).
  • SLO headroom thin. Response: cap beta cohort; run reliability sprint before scale; widen SLA credit lines in the model (10.3, 12.1).
  • Privacy/regulatory unclear. Response: treat as timing gate; push revenue right; add CP or covenant for certification/approval (11.1, 12.3).
  • Unit cost balloons with load. Response: reserve capacity and fix hotspots; lower CM2 corridors; require FinOps milestones pre‑scale.

90‑day uplift plan (only moves that change cash fast)

  • Evidence engine: stand up an experimentation cadence (weekly start/stop decisions), with a shared calendar and pre‑registered analysis plans.
  • Two pricing tests live: finalize fences, discount guardrails, and invoice accuracy; measure realized price and churn hazard (8.2, 6.4).
  • Lighthouse program: sign and activate 5–10 lighthouse customers with success metrics and reference rights.
  • Billing/entitlement hardening: close top three failure modes; set ≥99.5% invoice accuracy target for scale‑gated initiatives.
  • FinOps fixes: convert top two services to reserved/savings plans; fix one hotspot endpoint; instrument unit‑cost dashboards per initiative.
  • Regulatory and privacy milestones: lock the attestation/approval schedule; draft customer‑ready statements for gated segments.
  • Capacity ladder commits: book the first rung for the bottleneck shared by the top two initiatives (10.2).

Term‑sheet levers tied to the pipeline

  • Earnouts: target realized price, NRR from named initiatives, or ARR activation milestones.
  • Conditions precedent: certifications/attestations, approval letters, DR test pass for scale initiatives, billing/entitlement accuracy thresholds.
  • Covenants: indexation clauses on new offers, SLA floors, subprocessor change notifications, inventory/service levels for hardware‑plus‑service launches.
  • Capex escrow: tied to capacity adds required for scale.

72‑hour sprint plan (from blank page to decision‑grade)

  • Day 0: Freeze scope, segmentation, horizon, and materiality; issue a single pipeline/evidence request; set clean definitions for stages and gates.
  • Day 1: Build the Pipeline Inventory; run first pass WIHS scoring; draft three Innovation Evidence Maps.
  • Day 2: Quantify rNPV for top five initiatives; compute EVI and capacity/policy gates; draft Stage Gate Checklists and Risk‑Adjusted Economics Cards.
  • Day 3: Push base and upside toggles into the model; publish portfolio WIHS, kill/shelve list, and a 90‑day uplift plan; propose earnouts, CPs, and covenants where uncertainty is material.

Acceptance criteria for a decision‑grade innovation review

  • Pipeline Inventory complete and segmented; stages assigned with evidence‑based gates on page.
  • rNPV and EVI computed for top initiatives with documented assumptions; capacity, reliability, and policy gates reconciled.
  • WIHS scored with evidence; portfolio balance reviewed; zombies identified and addressed.
  • Model updated within 24 hours (price, CM2, NRR, timing); term‑sheet levers tied to specific initiatives.
  • A 90‑day plan with owners, costs, and dates; early‑warning indicators defined; clean‑team protocols observed.

Run this template and the “innovation story” becomes a portfolio of priced options with clocks, owners, and evidence—not promises. You will know which initiatives create value in your hold period, what could break them, and the minimum set of actions and terms that protect and amplify their economics.

Find a Commercial due diligence consultant
Commercial Due Diligence Playbook 2025

Request the Umbrex Commercial Due Diligence Playbook

see the Commercial Due Diligence Checklists