04 / 06

Cyber · AI · Digital intelligence

Due diligence & digital trust

Assess a third party, a presence or a digital situation before a sensitive commitment.

Empty archive room with document cases and digital evidence storage Illustration · fictional scene

Accessible information is traced to its source, dated, corroborated and placed in context. The deliverable clearly separates established facts, credible signals, hypotheses and unknowns.

04

What the assignment should give you

  1. 01A factual understanding of the third party or situation
  2. 02Visible inconsistencies and dependencies
  3. 03A documented decision without excessive conclusions

How the assignment works

How the assignment works

A short, explicit process adapted to the sensitivity of the situation.

  1. 01

    Scoping

    We define the decision to support, relevant assets, constraints, authorised sources and required confidentiality.

  2. 02

    Investigation

    Collection and analysis follow the agreed scope. Facts, hypotheses and areas of uncertainty remain clearly separated.

  3. 03

    Prioritisation

    Each finding is assessed by reliability, likely impact and the effort required to act.

  4. 04

    Delivery

    You receive a readable synthesis, useful evidence and a roadmap that can be put into practice.

Possible deliverables

Possible deliverables

  • Sourced OSINT dossier
  • Entity and alias mapping
  • Timeline and confidence grid
  • Risk note and direct verification points

Common situations

Common situations

  • Partnership, acquisition or sensitive recruitment
  • Suspected fraud, impersonation or dispute
  • Supplier or intermediary assessment

How can the assignment’s result be verified?

Use these examples to agree on a verifiable deliverable. Checks and thresholds follow the agreed scope; the examples below are not client results.

Example evidence and decisions to agree during scoping
What to checkEvidence to requestDecision it supports
Third-party identityContracting entity, identifiers, jurisdiction and separation of namesakes; dated records.Avoid assigning another entity’s references or incidents to the assessed provider.
Decisive claimClaim, primary source, covered period, possible contradiction and direct confirmation still needed.Accept sufficient evidence or set a condition before commitment.
DependenciesSubprocessors, sensitive access, essential services and declared responsibilities; unverified items distinguished.Identify the failure point or dependency that would change the choice.
Exit and full costCost assumptions, portability, export format, owners and an exit scenario to exercise.Compare options across their usable lifetime and exit, rather than entry price alone.

Put the decision to the test

Eight records received, two inconsistencies to resolve

Before onboarding a supplier, a team receives commercial and technical records. Two name an entity different from the one in the proposed contract.

Fictional teaching case. Figures explain the reasoning; they are neither client results nor thresholds required by a standard.

records received
8
records with an identity to reconcile
2
pending contractual decision
1
Three possible decisions
Possible choiceMissing evidence or supporting reason
Approve based on document volumeQuantity does not resolve an identity mismatch.
Immediately conclude fraudA subsidiary, name change or outdated record may explain a difference.
Hold the conclusion on affected pointsEstablish the relationship between entities and request an up-to-date record.
Read the decision and next check

The summary describes the inconsistency without inferring intent. It separates established facts, the supplier’s explanation and outstanding checks. The contractual decision must account for the unresolved issue and its effect on delivery.

The next check

Select a claim that conditions signature and trace its entity, period and supporting record. If the evidence scope excludes the service being purchased, retain an unresolved condition before commitment.

What this case does not demonstrate

An authentic document can concern a different entity or scope. Documentary consistency does not guarantee future service quality.

References and scope

  • GOV.UK — Define your purchasing strategy

    This UK public procurement guide connects strategy, lifecycle costs and exit. It offers comparison principles; the proposed conditions still need to fit the contract and context.

References checked on 15 October 2026.

Before the assignment

Frame a useful decision

Verification follows the contemplated commitment: a purchase, partnership and dispute need different evidence. The record bounds entities, periods and lawfully accessible information, and preserves contradictions. The dossier connects each decisive claim to an entity, date, document and verification limit. It examines technical dependencies, subprocessors, access, reversibility and claimed continuity. Public evidence is cross-checked with authorised provider responses. Unknowns stay visible and can become decision conditions rather than unsupported reassuring conclusions.

Information to gather

  • Identities and entities to distinguish
  • Planned decision and risks that would change it
  • Authorised documents, countries and relevant periods

Decisions to prepare

  • Which information needs direct confirmation?
  • Which signals justify a condition or pause?
  • How much uncertainty is acceptable?

Illustrative assignment

Situation
A buyer needs to assess a provider that will host sensitive information.
Work
Verify the contracting entity, subprocessors, access and dependencies; match each decisive claim with dated evidence.
Deliverable
An evidence file, unresolved questions, pre-signature conditions and an exit scenario to exercise.

Example acceptance criteria to agree during scoping

  • Examined entities and periods remain identifiable.
  • Decisive claims connect to evidence and its limitations.
  • Reservations and reassessment conditions accompany the recommendation.
Related public methods

References: data, uses and limitations

Documentation reviewed on .

Software bill of materials: inventory to verificationActual delivered artefact. SPDX · Describe. CycloneDX · Describe. Applicability assessment. Link document and build. Components and information. Components and dependencies. Versions, advisories and settings. A bill of materials is not evidence of vulnerability absence.Software bill of materials: inventory to verificationActual delivered artefactLink document and buildSPDX · DescribeComponents and informationCycloneDX · DescribeComponents and dependenciesApplicability assessmentVersions, advisories and settingsA bill of materials is not evidence of vulnerability absence
Software bill of materials: inventory to verification
References: data, uses and limitations
Source and purposeVerified data or benchmarkHow to use itLimitation to retain
NIST · Cybersecurity Framework

Structure the outcomes expected from a cybersecurity programme.

 CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe a single way to achieve outcomes. Describe current and target profiles with evidence, gaps and owners. Connect each priority to the services it helps protect.

Explore the method →

 Mapping to the framework is neither certification nor proof that every control works.
SPDX · Specifications

Describe components and information in a software bill of materials.

 The official specifications page distinguishes SPDX 3.0 from earlier versions such as 2.3. Document version affects schema and tool compatibility. Request format, version, build scope and component identifiers. Compare the bill of materials with the delivered artefact.

Explore the method →

 A bill of materials alone proves neither vulnerability absence, dependency completeness nor compliance with every licence.
OWASP · CycloneDX

Exchange bills of materials and supply-chain information.

 The official overview dates specification 1.7 to 21 October 2025 and documents JSON, XML and Protobuf. Check version, component references and dependency links. Retain the connection between the bill of materials, build and deployed product.

Explore the method →

 Changing format does not fix missing components. A descriptive inventory and a vulnerability impact assessment answer different questions.

Media provenance and C2PA validation

A signed item does not validate every supplier claim

A document signature or image provenance alone establishes neither operational capacity, a customer reference nor the reality of a depicted site. Relate the item to the actual claim being examined.

  • Describe the scope of technical validation.
  • Request specific evidence for the decisive capability or attribution.
  • Do not count several commercial repetitions as independent sources.

Open the C2PA explorer and publication cases →

References consulted on · C2PA · Content Credentials Explainer ODNI · ICD 203, Analytic Standards

VEX and product applicability

Request an applicability assertion matching the delivered product

A supplier may provide an SBOM and VEX document whose scope does not match your build. Connect those records to the vulnerability, delivered version and explicit status conditions.

  • Check issuer, product identifiers, version, time and inherited information in the complete document.
  • Request not_affected justifications or affected actions; preserve under_investigation as uncertainty.
  • Review the assertion when the build, dependencies or execution assumptions change.

Read VEX statuses and applicability conditions →

Sources checked on · OpenVEX · Specification v0.2.0

PDF: redaction and release

Document review covers both file and sharing

A digital-trust dossier must show which checks covered which copy. A result grid replaces neither content inspection nor checks on access and accessible versions.

  • Define confidentiality scope and information needed by the recipient.
  • Retain results and unperformed checks without turning them into a reassuring score.
  • Match the approved copy to the file actually released.

See surfaces and the pre-sharing review matrix →

Sources reviewed on · Adobe · Redacting and sanitizing PDFs · Adobe · Redact sensitive content · Adobe · Sanitize PDFs · ICO · Avoid accidental breaches when redacting · ICO · Hidden information in documents · Microsoft · Document Inspector

FAQ

Frequently asked questions

Practical answers to help frame the need before an initial conversation.

What information can be researched?

The assignment uses lawful open sources and authorised documents: registers, publications, domains, digital presence, historical records and publicly documented relationships.

Can due diligence provide complete certainty?

It reduces uncertainty without inventing what sources cannot establish. The report separates facts, signals, contradictions and checks that still need to be conducted directly.

How can entities with the same name be distinguished?

Reconcile the legal name, registry identifier or LEI where available, jurisdiction and dates. Distinguish company, subsidiary and brand before attributing adverse information. Keep an unresolved identity as an explicit uncertainty rather than merging dossiers. An identifier helps recognise an entity; it does not establish trustworthiness.

Digital due diligence: a trust checklist before commitment

GLEIF — The Legal Entity Identifier

Services

01Strategic intelligence & OSINT 02Cyber exposure review 03Applied AI & agents 05Secure, high-performance web 06SEO, AEO & GEO visibility