Six things we hear from every operating partner.
Mid-market portfolios run on thin IT. The fund carries the risk. Recognise any?
Fractional leadership and delivery, across the whole portfolio.
A named security owner for each portco and a group rollup for the fund. Risk register, board reporting, insurer evidence, incident escalation. One framework so portcos stop reinventing the wheel.
Senior technology leadership for portcos in transformation, carve-out or scale-up. Roadmaps, vendor and MSP management, build-vs-buy calls, hiring support. Days per month, not headcount.
Pre-deal red flags in ten working days: infrastructure and cloud posture, security history, licence and contract exposure, key-person risk, tech debt and integration cost, AI and data exposure.
Post-completion security baseline, TSA exits, tenant separations and integrations delivered by the engineers, not just planned on a slide. DD findings carried straight into the plan.
Cyber Essentials and Cyber Essentials Plus across the portfolio, ISO 27001 where a portco's market demands it. One framework, per-portco evidence packs your insurers and LPs can actually read.
The 6-week AI Pilot deployed where it moves portco margin: back-office automation, document processing, customer operations. Prove it in one portco, repeat the playbook across the others.
One agreement at fund level. Per-portco everything else.
One master agreement with the fund or opco. Rates, confidentiality and working model agreed once, then never renegotiated per deal.
Each portfolio company gets its own statement of work sized to its risk and stage: some need a CISO day a month, some need a full carve-out team.
Every portco board gets its own pack. The operating partner gets the group view: one heatmap of risk, spend and progress across the portfolio.
Risk registers, certificates, DR test results and incident records maintained as a living data room folder, so vendor DD lands on prepared ground.
New acquisition? It's a statement of work, live in days, with DD findings already in hand. Exit? Cover ends at completion and the evidence pack transfers with the business. The fund relationship carries on.
The first 100 days in a new portco.
Day one is about sight. You cannot defend an estate you cannot list.
The risks diligence found stop being findings and start being fixes.
Control you can't evidence doesn't exist to an insurer or a buyer.
Baseline certified. Cover settles into cadence and the fund sees it all.
- Asset and identity inventory
- Admin access recovered and documented
- Incident escalation line live
- MFA gaps closed on day one accounts
- Backups verified with a real restore
- Endpoint protection across the estate
- Licence and contract register built
- DD findings triaged into the plan
- Cyber Essentials scope agreed
- Incident response runbook tested
- First board report delivered
- Insurer evidence pack assembled
- Baseline certified and documented
- Fractional cover cadence agreed
- Roadmap priced for the hold period
- Group rollup includes the new portco
Evidence that's ready before anyone asks.
The difference between a portfolio that manages risk and one that can prove it is about four ring binders of evidence nobody enjoyed making. We maintain it as we go: insurer questionnaires stop being a quarterly fire drill, LP requests get answered the same week and vendor due diligence at exit starts from a prepared data room instead of a scramble.
- Risk register with owner, status and movement since last quarter
- Cyber Essentials / CE Plus certificate and scope
- Backup and disaster recovery test results, dated
- Incident response runbook and post-incident records
- MFA, access and joiner-leaver evidence for insurers
- Licence, contract and MSP register with renewal dates
Sectors your portcos probably live in.
What operating partners ask first.
Eight questions deal teams and operating partners ask on every first call about portfolio cover.
From £3,000 a month per portfolio company on a three month minimum, with portfolio rates once three or more portcos are covered. That buys a named security owner, a maintained risk register, board reporting, insurer evidence and an incident escalation line. One agreement sits at fund level and each portco has its own statement of work, so cover starts and stops cleanly as companies join and exit the portfolio.