A fast-moving technology startup is being merged into a heavily regulated bank, and the two organizations have very different attitudes toward security. The security manager is asked to establish a common security culture for the combined entity. Which approach is BEST?
Select an answer to reveal the explanation.
Short Explanation
Merging two security cultures is like merging two households: if one side just moves its furniture in and throws the other's out, nobody's happy. You figure out what the new household needs, here that's the combined risk appetite and the bank's regulatory load, then pick what works from both. The trap is assuming 'stricter wins' automatically.
Full Explanation
A merger creates a new organization with its own business objectives, regulatory profile and risk appetite. The right security culture for that entity is the one that supports those objectives at an acceptable level of risk, so the security manager should assess both existing cultures against the combined entity's risk appetite and legal obligations and then define shared norms with leadership endorsement. Imposing the bank's norms wholesale assumes that stricter is always better; it may apply controls where they add cost without proportionate risk reduction and will likely provoke resistance that undermines adoption. Leaving each entity with its own practices indefinitely ignores that the startup now operates within a regulated group, creating compliance exposure and inconsistent protection of shared data. Adopting the startup's lighter practices everywhere would almost certainly breach regulatory obligations that the bank carries. Exam caveat: where regulation sets a floor, that floor applies wherever regulated data or activities exist; culture can be shaped above that floor but not below it. Operational check: obtain the combined entity's approved risk appetite, compare each organization's key security behaviors against it and the regulatory baseline, and present a harmonization plan to the integration steering committee.