Thinking About Selling Your Business? Where to Start Before You Tell Anyone

You may not have told anyone yet. Not your CPA. Not your management team. Maybe not even your family.

But you’ve started thinking about selling your business.

Almost everyone who starts a business has that thought at some point. Sometimes it shows up the day you open the doors. Sometimes it comes after a hard year. For most of us, it comes and goes for decades. Lately, it’s been staying a little longer.

You’ve probably done a little math. Written a number on the back of a napkin, maybe more than once, and noticed it never seems to go down. Picked a year that feels right. Maybe you’ve pictured a place you’d like to live, or a vacation where the business doesn’t come to mind.

Maybe you’ve even sat through a day-long seminar under an assumed name, just to learn without anyone knowing. I did, just last year. I’m a business owner too, from that generation between the Boomers and Gen X. I’m not planning to step away, and nothing is changing at NCX Group. But I understand why we think about it.

If you’ve owned your business long enough, you’ve led it through 9/11, the Great Recession, and the pandemic. You found a way to make payroll when you weren’t sure how. You had nights when sleep didn’t come easily, and mornings when you showed up anyway because people were counting on you. You signed the personal guarantees. You left money in the business when you could have used it at home. You missed some dinners.

And you came through. This group of owners has seen just about everything.

Now there’s one more thing to get right: the largest transaction of your life. When you think about selling, you’re thinking about more than a price. You’re thinking about what all of those years were for.

The number you have in mind

Most owners have a number. And that number has a life attached to it: retirement, security, family, the next chapter.

But the number is where the conversation starts, not where it ends. A buyer will have their own napkin. So before you tell anyone, ask yourself: what do I need to understand about my business now, while I still have time to improve the outcome?

The advisor you didn’t know to ask for

When you do start telling people, you’ll hear a lot about building the right team. Your CPA. An attorney. An M&A advisor or banker. Maybe an exit planner and a wealth advisor. Each one has an important job.

It’s a little like selling a house. The agent stages it, the title company handles the paperwork, and everyone admires the new kitchen. But if nobody checks the wiring, the buyer won’t remember the kitchen.

And honestly, how would you know if something was missing? You’ve spent decades learning how to run your company, not how to sell one. A risk can fall between everyone’s job descriptions while each person assumes someone else has it covered.

At that seminar last year, eight hours went by without anyone mentioning cyber risk, the number one business risk in the world according to Allianz.

Cyber risk is often that risk.

Trusting IT and verifying it

The usual answer is, “We’ll have the IT guys give us the information.” That makes sense. Your IT team or managed service provider knows your systems better than anyone, and they should be involved.

But I ask owners a harder question: how do you really know your IT team is doing what you think they’re doing?

You may trust them completely, and that relationship matters. Still, asking the people who run your systems to grade their own work is a bit like asking a teenager whether the homework is done. The answer is almost always yes. That doesn’t make anyone a bad person. It just isn’t verification.

You believe the backups will get you back up and running. What tells you that? Backups are like a spare tire. Everyone has one. You find out whether it holds air on the side of the road. You believe access gets shut off when someone leaves. Who has checked? I’ve talked with IT providers who have never had their own systems checked, and the owners relying on them never thought to ask.

The information comes from IT. The judgment about what it means for your business has to come from someone independent. Could a problem interrupt service to your customers? What would it do to revenue and cash flow? What have you promised in your contracts? What would a buyer be inheriting?

Those are business questions, and buyers are starting to put a price on the answers. In Ansarada’s 2026 Global M&A Predictions Report, Olivier Tricou of Alpen Capital put it plainly:

“Buyers will be increasingly willing to pay premiums for strong cyber resilience while weak digital governance may trigger discounts.”

That’s a prediction, not a promise. But it points to something that matters even more than avoiding a discount.

When opportunity calls

This work can do more than protect value. It can help you create it while you still own the business.

I learned that standing at a gas pump. I was filling up on my way to pick up my son from school, a seventh grader at the time, when my phone rang around two on a Thursday afternoon. It was the CISO at a mortgage company we had worked with since the day it opened. We had built their cyber risk program with them and helped run it for about six years. By then they had a few thousand employees and a network that had grown right along with them.

“You know that internal assessment you wanted us to do about six months ago?” he asked. He sounded a little sheepish. “We need to get that done.”

At first he would only say that “an opportunity” had come up. When I pushed, he told me. A bank wanted his company to service its loans. He needed the assessment by Tuesday.

For a company that size, the work normally took our team eight to twelve weeks. We had four days, and one of them was already half gone.

“I don’t want to say I told you so,” I said. “Let me talk to the guys, and let’s figure out a strategy.”

We set up three teams working around the clock. As each section of the report was finished, it went straight to the client. They fixed what we found, we tested it again, and we moved on to the next one. The report went to the auditors on Tuesday.

The bank awarded them the business: a ten-year servicing agreement the client told me was worth about $2 billion a year. When it came down to the decision, all else being equal, their security was better than everyone else’s.

And they could prove it.

I took two lessons from that week. First, the opportunity didn’t wait for them to be ready. It showed up on a Thursday with a Tuesday deadline. Second, we pulled it off only because six years of work were already behind it. Nobody builds that kind of history over a long weekend.

Today, some customers write the same expectation right into the contract. On Department of War contracts, the Cybersecurity Maturity Model Certification (CMMC) makes it official: where it applies, contractors have to meet the required cybersecurity assessment to qualify for the award. Think of it as a ticket to the game. It doesn’t win the game for you. Without it, you’re watching from the parking lot.

So the question shifts from “What will this cost?” to “What business could we win that we can’t win today?” And when you eventually sell, you’ll be able to show how your risk management supports real customers, contracts, and revenue, not just how you managed to stay out of trouble.

Quality of Evidence
All of this comes down to one idea. In financial diligence, QoE means quality of earnings. In our work, I use the same initials for Quality of Evidence.

No buyer would accept “our earnings are great, trust me” without seeing the books. Cyber is heading the same way.

When you say your company manages cyber risk, what backs that up? A questionnaire records answers. A policy describes good intentions. A list of products shows what you bought. Owning a gym membership doesn’t make you fit. Evidence shows what was reviewed, what was found, what you did about it, and whether anyone checked afterward.

Over time, that becomes a record. And you can’t go back three years and create one after a buyer asks for it. That’s why we built MyCSO Assurance: an ongoing, independently checked record of what was found, what was fixed, and the proof behind it, kept up year after year instead of thrown together in a rush for a buyer.

Your IT team supplies the information. An independent advisor examines it, the same way an outside reviewer examines your financials in a quality-of-earnings review.

Use the time you have now
Deal professionals like to say, “Time kills deals.” I agree that time matters. So do surprises. That’s exactly why the time before the deal is so valuable.

FTI Consulting’s 2026 research looked at executives who had dealt with a cyber incident during or shortly after a transaction. Among them, 20% saw deals delayed or paused, 42% saw a significant drop in deal value, and 58% said financial targets took a hit. Those numbers come mostly from larger companies, so they won’t predict how your sale goes. But they do show where the damage tends to land.

That’s why I tell owners not to wait for the letter of intent. By the time you sign an LOI, the price is on paper, the clock is running, and you’re usually committed to one buyer. Every question gets answered on their timeline. Anything they find isn’t something you get to fix on your terms. It’s something they get to negotiate.

Starting at the LOI is like patching the roof while the home inspector is already up on the ladder.

So when should you start? Sooner than you think. The best time is two to three years before you plan to sell. That gives you time to find what needs attention, fix it, and build a record that shows it stayed fixed. At the very least, start before you hire a banker or take that first serious call from a buyer.

Right now, you can look into an issue and fix it because it’s good for the business, not because someone across the table needs an answer by Friday.

Protecting the outcome after closing
The risk doesn’t end when the papers are signed. You still have a business to run during the sale. And if part of your proceeds comes from an earnout, that money depends on how the business performs after closing. In other words, part of your price is still on the field after the final whistle. A ransomware attack during the earnout period could hurt the very results your payment depends on.

Insurance may help, but “we’re insured” deserves the same scrutiny as “our backups work.” An umbrella is a fine thing to own. It’s better to check it for holes before the storm. What does the policy cover? What does it leave out? What are you still carrying yourself?

Settle those questions while you can still shape the plan and negotiate the terms.

Start while the idea is still yours
You don’t need an offer, a buyer, or a retirement date to get started. Start by asking who is independently looking at cyber as a business risk, and what evidence you have today. If the answer is fuzzy, you’ve found something worth working on.

A few years ago, most of us thought of AI as something our kids used to write book reports. Now buyers are using it to look at companies. We just started our 25th year at NCX Group, and in all that time I haven’t seen anything move this fast. I believe buyers three years from now will ask different questions and expect different proof than they do today. You can’t predict every question. You can build a record that’s ready for them.

So go ahead and imagine the trip, the next chapter, that first morning when the business doesn’t need you. Then give that future a little attention today.

I want owners to do more than get a deal signed. I want them to keep as much of what they built as they reasonably can, and to reach the next chapter they’ve been picturing all these years. Preparing now is how you protect it.

If any of this has you thinking, I’m always glad to talk, owner to owner. No pitch. Just a conversation.