A legacy customer platform will be retired over three years through several interim architecture states in which old and new systems exchange data. The target architecture has already been fully assessed for security. What should the information security manager ensure?
Select an answer to reveal the explanation.
Short Explanation
Moving house is when stuff gets lost, not after you've unpacked. Each interim state where old and new systems talk to each other is its own environment with its own risk, so you assess each one. The trap is trusting the shiny end-state assessment to cover three years of messy in-between.
Full Explanation
Enterprise architecture describes a baseline, a target and the transition states between them. During a multi-year migration the organization actually operates in those transition states, often with temporary interfaces, duplicated data, bridging accounts and mixed control sets. Each state therefore carries its own risk profile, and the security manager should ensure it is assessed and treated before the organization moves into it. Freezing the legacy platform's controls ignores the fact that it will remain in service for years and keeps exchanging data; threats and vulnerabilities keep changing during that time. Deferring testing until the end state leaves the riskiest period, when old and new coexist, unexamined. Reusing the target assessment for interim states assumes conditions that do not exist yet, such as the removal of legacy interfaces, so its conclusions do not transfer. Exam caveat: proportionality still applies, and an interim state that changes little may need only a light review, but none can be skipped by assumption. Operational check: list every planned transition state, confirm each has a recorded risk assessment and named risk owner, and verify temporary interfaces have an agreed removal date.