This report is prepared by Maple Growth Partners, an investment research and strategic advisory firm. The project was commissioned by one of our $250mn+ private equity fund client. The primary objective of this report was to provide a market overview of the requested standards within the IT security compliance industry along with their adoption rates by relevant geographies, identification of the most attractive growth pockets globally to scale operations, and a detailed competitive landscape / bolt-on acquisition targets list. Standards included were PCI; HIPAA; HITRUST; EI3PA; FedRamp; SOC 1 and SOC 2; GDPR; and NYDFS. As a part of an exercise to identify the most attractive geography pockets for IT security compliance to scale operations globally, we provided a detailed cybersecurity preparedness research for each country to eventually come up with necessary insights to present the most suitable countries to invest in from a US PE portfolio company perspective. We then screened hundreds of companies and identified 151 relevant competitors / bolt-on acquisition targets and have presented them in a matrix format outlaying their presence across standards along with ownership details in a standardized profile template. From a PE perspective, we believe that this industry is perfectly positioned for a roll-up strategy. Broadening the scope of solutions offered to sell more to one client, coupled with scalability through cloud adoption and outsourcing the operations/support functions will likely enhance incremental value in the respective target. While the full report is exclusively prepared for the said client, we have provided a gist of our overall analysis to showcase our research capabilities, especially for a niche market such as IT security compliance.

1. 0
United States IT Security Compliance Market Overview
Market Study and Competitive Landscape
2018
Maple Growth Partners
While the full report is exclusively prepared for the said client, we have provided a gist of our overall
analysis to showcase our research capabilities.

2. 1
• This project was commissioned by one of our $250mn+ private equity fund client. The primary objective of this
report was to provide a market overview of the requested standards within the IT security compliance industry
along with their adoption rates by relevant geographies, identification of the most attractive growth pockets
globally to scale operations, and a detailed competitive landscape / bolt-on acquisition targets list
• Standards included were PCI; HIPAA; HITRUST; EI3PA; FedRamp; SOC 1 and SOC 2; GDPR; and
NYDFS
• As a part of an exercise to identify the most attractive geography pockets for IT security compliance to scale
operations globally, we provided a detailed cybersecurity preparedness research for each country to
eventually come up with necessary insights to present the most suitable countries to invest in from a US PE
portfolio company perspective
• We then screened hundreds of companies and identified 151 relevant competitors / bolt-on acquisition targets
and have presented them in a matrix format outlaying their presence across standards along with ownership
details in a standardized profile template
• From a PE perspective, we believe that this industry is perfectly positioned for a roll-up strategy. Broadening
the scope of solutions offered to sell more to one client, coupled with scalability through cloud adoption and
outsourcing the operations/support functions will likely enhance incremental value in the respective target
• While the full report is exclusively prepared for the said client, we have provided a gist of our overall analysis
to showcase our research capabilities, especially for a niche market such as IT security compliance.
Project Objective and Focus of the Document

3. 2
Table of Contents
Executive Summary
A. IT Security Compliance Market Overview
B. IT Security Compliance Market by Standards
C. Industry Trends
i. Penetration / Adoption Rates by Standards
ii. Growth Pockets - Ranking of Markets With Highest Business Opportunity
D. Enterprise Security Market by Key Service Segments
E. Unit Economics / Major Costs
F. Regulatory Overview
G. Investment Thesis and Risks / Concerns
H. Value Creation Playbook
I. 151 Competitors / Potential Targets for Bolt-On Acquisitions
J. PE/VC and M&A Transactions (Of the Presented 151 Competitors)
K. Transaction Advisors, Influencers, and Conferences
i. PCI
ii. HIPAA
iii. HITRUST
iv. SOC 1 and SOC 2
v. EI3PA
vi. FedRamp
vii. GDPR
viii. State of New York Standard

4. 3
Executive Summary
• Market Size and Growth Outlook: The global governance, risk, and compliance (GRC) market is expected to grow from
$8.5bn in 2016 to $11.8bn by 2021 at a CAGR of 6.7%
• Favorable Macros: The market is expected to grow at a solid rate as business leaders are looking for compliance solutions to
meet the challenges of regulatory change, increasing cybersecurity threats, third-party exposure, and reputation risk
• The cybersecurity market is experiencing a shift in spend from prevention to detection and response
• It is a large and underserved market for risk and performance management software. While the US and European
markets are moderately penetrated with the industry’s services, other developing regions such as Asia-Pacific, Middle
East, and South America exhibit low cybersecurity adoption rates currently, hereby, expanding the scope of immediate
addressable market
• Growth Pockets: As a part of an exercise to identify the most attractive geography pockets for IT security compliance to scale
operations globally, we have provided a detailed cybersecurity preparedness research for each country to eventually come up
with the insights to present the most suitable countries to invest in from a US PE portfolio company perspective –
• Chile, Vietnam, Greece, Kazakhstan, Angola, Kuwait, and Slovakia provide relatively large addressable market and high
growth cybersecurity adoption potential
• Competitive Landscape / Bolt-On Acquisition Targets List: We then screened hundreds of companies and identified 151
relevant competitors / bolt-on acquisition targets and have presented them in a matrix format outlaying their presence across
standards along with ownership details in a standardized profile template
• Value Creation Strategy: Broadening the scope of solutions offered to sell more to one client, coupled with scalability through
cloud adoption and outsourcing the operations/support functions will likely enhance incremental value in the respective target
• From a PE perspective, we believe that this industry is perfectly positioned for a roll-up strategy
• Private equity firms (that are looking to build an integrated risk and compliance management platform) can
facilitate a smooth transition to exit by scouting for potential add-ons to improve cost synergies and enhance
global scalability in this large, underserved, yet highly fragmented market with no real dominant players

5. 4
IT Security Compliance – Service Landscape
IT Security Compliance – Service Landscape
Regulatory
compliance and
audit services
Vulnerability
management
Data security
services
Cloud Solution Providers (CSP)
Data centers / Infra compliant
services
Government Entities
Financial institutions
Healthcare Organizations
Large Enterprises (Inc. Public
Companies) and SMEs
E-Commerce
Financial Services
Government
Healthcare
Insurance
Manufacturing
Retail
Technology
Utilities
Education
IT Security
Compliance Firms
Primary Customers (sourced directly
from sales team or channel partners)
End-Markets or Key
Focused Industries
TypicallyprovidesolutionsthroughaSaaSmodel,withone-
timeservicefeeorrenewableannualsubscriptions
PCI, HIPAA, HITRUST,
SOC 1, SOC 2, EI3PA,
GDPR, FedRamp,
NYDFS, etc.
Vulnerability intelligence
and security patch
management to reduce
cybersecurity risks
Services that stops
threats, manages risk
and compliance, and
protects one’s business
Security,management,supportandinfrastructuretomeeta
varietyofcompliancerequirementsforspecificindustries
PrimaryserviceSecondaryservices
Source: MGP insights

6. 5
Typical Compliance Assessment Process
Required for NIST 800-171 Compliance
Typical Compliance Assessment Process
Source: Imprimis Inc. Youtube Video - Cybersecurity Compliance: Process Overview

7. 6
Standards Description Market Size Growth
Relevant
Industry
Assessment
Frequency
Pricing Penetration
PCI
Refers to payment security standards that ensure all sellers safely
and securely accept, store, process, and transmit cardholder data
during a credit card transaction
North America
Payment Security:
~$4.6bn
Global: ~$11.4bn
~15-17% Credit Card
Quarterly and
annual
~$100-
$50,000
~50%
HIPAA
United States legislation that sets data privacy and security
provisions for safeguarding medical information, such as medical
records and other identifiable health information
North America
Healthcare
cybersecurity:
~$2.3bn
Global: ~$5.5bn
~8-9% Healthcare
Ranges 1-3
years
~$20,000-
$60,000
~70%
HITRUST
In collaboration with healthcare, technology and information security
leaders, it has established a Common Security Framework (CSF)
that can be used by all organizations that create, access, store or
exchange sensitive and/or regulated data
- - Healthcare Typical annual
~$60,000-
$80,000
83% of
Hospitals and
82% of Health
Plans
SOC 1 and
SOC 2
SOC audits to comply with the SSAE 16 standards. Sets auditing
standards for attestation engagements.
Global Audit
Management
Software: ~$1bn
12%
Service
Organizations
Typical annual
~$15,000-
$30,000
~100%, as its
mandatory
for all
relevant firms
EI3PA
Experian created a set of requirements to promote stronger
protection of consumer credit information
- -
Consumer
Credit
Annual - -
FedRamp
A government-wide program that provides a standardized approach
to security assessment, authorization, and continuous monitoring for
cloud products and services
US Federal Cloud
Computing Market:
~$4.7bn
~16%
Federal
Agencies
Typical annual
~$250,000-
$385,000
~40%
GDPR
A regulation by which the European Parliament, the Council of the
European Union and the European Commission intend to strengthen
and unify data protection for all individuals within the European
Union (EU). It also addresses the export of personal data outside the
EU
~$258mn in 2016,
expected to reach
$1.7bn in 2019
~87.5% Universal Typical annual
~$1-10mn
for US
companies
US (84%),
Europe (75%)
NYDFS
First in the US to impose cyber security standards for the financial
services industry in the midst of the looming threat of hack attacks
threatening the privacy of consumer data.
- -
Financial
Institutions
-
~$4,000-
$12,000
~67%
Summary of All Requested Standards – IT Security Compliance Services Market
Source: MGP Research Compilation

8. 7
Global Cybersecurity Index World Heat Map by Commitment Levels
Global Cybersecurity Index World Heat Map by Commitment Levels
North America region (along with Australia) is the most committed towards cybersecurity, followed by Europe / Eurasia
region. Asia Pacific and South America are expected to increase their cybersecurity commitment levels going forward.
Africa is the least compliant region with minimal efforts towards cybersecurity.
Source: ITU - Global Cybersecurity Index (GCI) 2017
Potential growth pockets
– incremental sales
driven by a marginal
uptick in adoption

9. 8
Private Equity Roll-Up Strategy to Facilitate a Smooth and Incremental Transition
to Exit
Portfolio
Company
Bolt On
1
Bolt On
2
Bolt On
3
MultiCompanyMerger
Post Merger Integration: Group Company With Combined
Complementary Capabilities Into a Full-Service Business
Pre Roll-Up Strategy: Scout for Potential Add-Ons
to Improve Synergies and Enhance Scalability
Post Roll-Up and Exit Planning – Increasing Scale
Generally Enhances the Options Available for Exit
Rolling-Up Options:
• Rolling up across geographies for an expanded
footprint
• Rolling up solutions - taking portfolio company
from a one-solution company to a multi-solution
company
Most Successful Roll-ups Target Large, Yet Highly Fragmented Industries With No Real Dominant Players
Rolling-Up Advantages:
• Enhanced value through cost synergies / economies of
scale
• Valuation multiple arbitrage
• Improved exit options
• Global reach and scalability
• Integrated platform with broader suite of services offer
cross-selling opportunities, smarter solutions, more
expertise and expanded reach to innovate and meet
customers, and a centralized brand
• Roll-up strategy in SaaS is by acquiring and combining a
number of vendors in a space to create a best-of-breed
provider
• These combined entities would then be primed for IPO or a
later sale, deriving cost synergies by reducing duplicative
expenses among the multiple organizations, while still
investing in growth
• Roll-ups are a part of the consolidation process that usually
occurs as new market sectors mature
Source: MGP insights

10. 9
E. Unit Economics / Major Costs

11. 10
Major Cost for the IT Security Consulting Industry is to Cover the Employee
Expenses
Major costs for the IT Security Consulting companies:
• Wages (~50% of revenue): As with most service-oriented industries, wages for highly skilled employees with
extensive hardware and software knowledge represent the largest cost incurred by firms operating in the IT
security consulting industry. However, there has been an ongoing trend of outsourcing operations and
support-oriented services to countries like India, an effort to reduce overall cost of employee and operations
expenses
• Purchases (~50% of revenue): The majority of purchases are for computer hardware and software used for
evaluating and preventing IT security threats. Purchases as a portion of average industry expenditures
increased, largely a result of the increased level and sophistication of technology
• Others (~20% of revenue): Primarily accounts for the research and development expenses. Industry firms
invest a large portion of their revenue in developing new products to open up new markets and gain a
competitive edge. As cyber threats increase, IT security consulting firms increasingly invest in R&D to fight off
the new threats
IT Security Consulting Companies’ Cost Structure
Wages, 47.8% Purchases, 18.6%
Depreciation, 0.8%
Marketing, 2.0%
Rent and Utilities, 3.0%
Others, 19.5%
Operating
Profit, 8.3%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
OperatingExpenses
(%ofRevenue)
Source: IBIS World - IT Security Consulting in the US October 2016

12. 11
Qualys – A Market Leading IT Security and Compliance Solutions Provider:
Key Financials Overview
Qualys, Inc. provides cloud-based security and compliance solutions in the US and globally. It offers Qualys Cloud Apps, which
includes asset inventory, CMDB sync, vulnerability management, continuous monitoring, cloud agent, threat protection, security
configuration assessment, indication of compromise, policy compliance, PCI compliance, security assessment questionnaire, etc.
Qualys Revenue ($ mn) and y-o-y Revenue Growth
65 76 91 108 134
164
198
231
277
325
382
14%
17%
20%
18%
24% 23%
21% 17% 20%
17%
18%
0%
5%
10%
15%
20%
25%
-
100
200
300
400
500
2010 2011 2012 2013 2014 2015 2016 2017 2018E 2019E 2020E
GrowthY-o-Y
Revenue($mn)
Revenue Revenue Growth Y-o-y
Strong and consistent organic revenue growth outperforming market and gaining share
Qualys Gross Profit Margin Qualys EBITDA Margin
82.9% 82.6%
79.9%
77.2%
78.3%
79.1% 78.2%
77.7%
78.8%
78.9%
74%
76%
78%
80%
82%
84%
2010 2011 2012 2013 2014 2015 2016 2017 2018E2019E
Ongoing steady operating margins but expected to
improve through the projected period
This has increased significantly since 2014 primarily due
to the continued momentum in cloud agents platform¹
8.8%
10.9%
11.3%
11.0%
15.8%
23.8%
24.2%
25.1%
35.3% 35.6%
0.0%
10.0%
20.0%
30.0%
40.0%
2010 2011 2012 2013 2014 2015 2016 2017 2018E2019E
Cloud agent platform¹ was introduced in 2015. Since then, SG&A
margin has declined from 51.7% in 2014 to 43.0% in 2017
Note: 1. Cloud agents platform extends Qualys’ industry-leading cloud security and compliance platform with lightweight agents to continuously assess security and
compliance of organizations’ global IT infrastructure and applications. It is centrally managed and self-updating, with no need to reboot.
Source: Company Filings; Investor Presentation; Capital IQ; Projections from CapIQ Estimates

13. 12
Qualys: Strong Customer Retention With Expanding Platform; Growth in the
Number of Cloud Agents Sold, and Best-In-Class EBITDA Margins
Qualys Quarterly Revenues ($mn) v/s Customers Number of Cloud Agents Sold (In millions)
2.6
3.4
4.7
6.0
LTM Q1 2017 LTM Q2 2017 LTM Q3 2017 LTM Q4 2017
Q3 CY2017 EBITDA Margin v/s Select Security and SaaS Peers
Qualys - Industry-leading margins and scalable business model
($inmillions)
Exponential
increase in
revenue
coupled with
steady growth
in customers
indicate strong
customer
retention
Source: Qualys Investor Presentation February 2018

14. 13
H. Value Creation Playbook

15. 14
Single Platform Architecture – Broaden the Scope of Solutions Offered…
Broader IT Security Compliance Activities and Respective Applications
• A single platform architecture streamlines activities, creates more efficiencies, and delivers bottom-line advantages
• By transforming multiple, disparate single-use applications into a single, cohesive and self-managed GRC platform,
companies can save substantial dollars through resource optimization, reduced maintenance costs and higher GRC
productivity
• According to a Deloitte survey, 85% of companies believe their organization would benefit from integrating and
streamlining use of technology for GRC activities enterprise-wide
Compliance IT
Third Party /
Vendor
Management
Control
Management
and Testing
Risk
Management
Audit
Management
• Policy
management
• Risk
assessment
• Controls testing
• Rules inventory
mapping
• Regulatory
change
management
• Regulatory
engagement
management
• Compliance
management
• Risk
assessments
• Threat and
vulnerability
management
• Third party
onboarding
• Third party
contracts
• Third party risk
assessment
• Third party
monitoring
• Finance
controls
• IT controls
• Business
controls
• Risk
assessments
• Risk event data
capture
• Metrics capture
• Scenario
analysis
• Resource and
timesheet
management
• Risk
assessment
• Work paper
management
• Finding and
remediation
management
Focus to evolve from compliance solutions to other related applications in
order to provide an enterprise-wide integrated risk management platform
VCP 1

16. 15
…To Sell More to One Client, Thereby Accelerating Platform Adoption;
Case In Point – Qualys Numbers Presented Below
% of Enterprise customers with 4+ Qualys products has almost doubled in the last year
% of Customers with 3 or more Qualys Solutions % of Customers with 4 or more Qualys Solutions
Qualys Q3 CY2017 EBITDA Margin v/s Select Security and SaaS Peers
16%
20%
26%
32%
0%
5%
10%
15%
20%
25%
30%
35%
2014 2015 2016 2017
1%
3%
8%
15%
0%
2%
4%
6%
8%
10%
12%
14%
16%
2014 2015 2016 2017
$42k $46k $50k $47k
$111k
$131k
$154k
$182k
$60k
$151k
$179k
$239k
$0k
$50k
$100k
$150k
$200k
$250k
$300k
2014 2015 2016 2017
Enterprise customers with 1 product Enterprise customers with 3+ products Enterprise customers with 4+ products
Enterprise customers with 4+ products spend more than 5x 1-product customers
Source: Qualys Investor Presentation February 2018
VCP 2

17. 16
Scalability Through Cloud Adoption, Capitalizing the Shifting Trend From
Physical to Virtual IT
• Growth in the GRC market is primarily due to the rise of cloud solutions, which are growing faster than the overall market
• Adoption of GRC applications among small and medium-sized businesses, line of business managers, and less-
regulated industries have been central to the growth of these cloud-based solutions.
• Enterprises shift from physical to virtual IT, whether public or hybrid cloud, the priorities become scalability, managing who is
granted entry in and dynamically protecting workloads
• Cloud computing paradigm is (1) on-demand, (2) borderless, (3) without hardware, (4) consumption model pricing, and
(5) scalable
• Traditional hardware approaches to security (appliances) fail on each of these accounts. Appliances require capacity
planning, aren’t on-demand or scalable, are predicated on rigid hardware, and assume the existence of defined borders
The Cloud Security Spending Disconnect
Source: Credit Suisse Cybersecurity Report, September 2017
VCP 3

18. 17
Outsourcing to Reduce Operation/Support Costs In Order to Improve
Operating Efficiencies (Qualys Numbers Below)
Average Spending of Large Customers ($500k+ Revenue) Qualys SG&A Margin
Revenue per Sales and Marketing Headcount % of Support, Operations, and R&D headcount in India
$17m
$25m
$35m
$54m
19
27
38
51
0
10
20
30
40
50
60
$0m
$10m
$20m
$30m
$40m
$50m
$60m
2014 2015 2016 2017
CustomerCountwithgreaterthan
$500Kinannualrevenue
CumulativeRevenue
Cumulative Revenue Customer Count
Largest customers
spend an average of
LTM ~$1M+ with Qualys
$0.9m
$1.0m
$1.1m
$1.2m
$0.0m
$0.2m
$0.4m
$0.6m
$0.8m
$1.0m
$1.2m
$1.4m
2014 2015 2016 2017
28%
36%
46%
58%
0%
10%
20%
30%
40%
50%
60%
70%
2014 2015 2016 2017
Source: Qualys Investor Presentation February 2018; Capital IQ
56.1%
56.9%
53.0%
54.5% 54.9%
51.7%
45.5%
44.1%
43.0%
40.0%
45.0%
50.0%
55.0%
60.0%
2009 2010 2011 2012 2013 2014 2015 2016 2017
SG&A margin
has drastically
come declined
primarily due to
outsourcing
activities
Continuous increase in
outsourcing to India
Decline in employees cost has resulted in
improvement in operating efficiencies
VCP 4

19. 18
Private Equity Roll-Up Strategy to Facilitate a Smooth and Incremental
Transition to Exit
Portfolio
Company
Bolt On
1
Bolt On
2
Bolt On
3
Multicompanymerger
Post Merger Integration: Group Company With Combined
Complementary Capabilities Into a Full-Service Business
Pre Roll-Up Strategy: Scout for Potential Add-Ons
to Improve Synergies and Enhance Scalability
Post Roll-Up and Exit Planning – Increasing Scale
Generally Enhances the Options Available for Exit
Rolling-Up Options:
• Rolling up across geographies for an expanded
footprint
• Rolling up solutions - taking portfolio company
from a one-solution company to a multi-solution
company
Most Successful Roll-ups Target Large, Yet Highly Fragmented Industries With No Real Dominant Players
Rolling-Up Advantages:
• Enhanced value through cost synergies / economies of
scale
• Valuation multiple arbitrage
• Improved exit options
• Global reach and scalability
• Integrated platform with broader suite of services offer
cross-selling opportunities, smarter solutions, more
expertise and expanded reach to innovate and meet
customers, and a centralized brand
• Roll-up strategy in SaaS is by acquiring and combining a
number of vendors in a space to create a best-of-breed
provider
• These combined entities would then be primed for IPO or a
later sale, deriving cost synergies by reducing duplicative
expenses among the multiple organizations, while still
investing in growth
• Roll-ups are a part of the consolidation process that usually
occurs as new market sectors mature
VCP 5

20. 19
• This document has been compiled by Maple Growth Partners (MGP) from sources believed to be reliable, but
no representation or warranty, express or implied, is made by MGP, its affiliates or any other person as to its
accuracy, completeness or correctness. Such information may be incomplete or condensed and/or may not
have been independently validated by MGP. MGP expressly disclaims liability for any direct or consequential
loss arising from any use or reliance upon this material or the information contained herein.
• Certain of the information contained herein represents or is based upon forward-looking statements or
information, which may include descriptions of anticipated market conditions and changes, and expectations
of future industry activity. Maple Growth Partners believes that such statements and information are based
upon reasonable estimates and assumptions. However, forward-looking statements and information are
inherently uncertain and actual events or results may differ from those projected. Therefore, undue reliance
should not be placed on such forward-looking statements and information.
Disclaimer
MAPLE GROWTH PARTNERS
+91 9930-206-207
niraj.singhvi@maplegrowthpartners.com