IT & Cyber Compliance Comparables
| Date ↓ | Target ⇅ | Acquirer ⇅ | EV ⇅ | LTM Rev ⇅ | EV / Rev ⇅ | LTM EBITDA ⇅ | EV / EBITDA ⇅ | Rationale |
|---|
Universe. Private M&A transactions in IT and cyber compliance: compliance audit and assessment firms (3PAOs, C3PAOs, SOC and ISO auditors), compliance and GRC software, cyber and GRC advisory services, CMMC and FedRAMP specialists, and testing, inspection, certification and compliance (TICC) platforms. US and Europe, 2022 onward.
Multiples. Enterprise value divided by last twelve months EBITDA (EV / LTM EBITDA). Most compliance deals do not disclose terms; multiples shown are Harbor Ridge Capital estimates derived from publicly available information and market intelligence, and are directionally correct but not independently verified. Qmulos is shown at 10x ARR (EV / Rev column). Where several deals were reported at or above 25x, they are shown at 25.0x.
Dates. Where only the month of a transaction is known, the date is shown as the first of that month.
Sources. PitchBook, press releases, and Harbor Ridge Capital research, including the HRC CMMC and FedRAMP 20x whitepapers (Q2 2026).
| Company | Segment | EV | EV / Rev | EV / EBITDA | Growth YoY | EBITDA Margin | Rule of 40 |
|---|
Universe. US-listed companies most relevant to compliance buyers: UL Solutions (testing, inspection and certification) and government IT and managed services firms active in CMMC and FedRAMP (Leidos, CACI, Parsons, SAIC, Kratos). UL Solutions figures are LTM through Sep 30, 2026 and exclude the Eurofins E&E business acquired Oct 1, 2026.
Multiples. Enterprise value divided by LTM revenue and LTM EBITDA, in US$ millions, as of June 10, 2026. Click Refresh to pull current share prices and market caps from Finnhub; enterprise value is then recalculated using net debt from the latest filing, and EV / Rev and EV / EBITDA are recomputed against the same LTM financials. Kratos (99.3x EV / EBITDA) is shown in the table but excluded from the averages and medians as an outlier.
Rule of 40. Revenue growth plus EBITDA margin.
Sources. Finnhub (live prices), Capital IQ, company filings, and Harbor Ridge Capital research (HRC FedRAMP 20x whitepaper, Q2 2026).
Advising founders and sponsors in IT and cyber compliance.
Recent work includes the sale of Core Business Solutions to LRQA (Goldman Sachs) and Qmulos to PSG, plus sell-side, buy-side, and growth capital mandates across CMMC, FedRAMP, and GRC.