The organization has just completed the acquisition of a smaller company whose systems will be connected to the corporate network over the next six months. What should the information security manager do to BEST support senior management's integration decisions?
Select an answer to reveal the explanation.
Short Explanation
Merging two households means checking what's in the other garage before you knock down the wall between them. You assess the newcomer's risk and tell management how the combined picture has changed, so they can plan the connection with their eyes open.
Full Explanation
An acquisition changes the enterprise's information risk profile by adding assets, users, third parties, legacy systems and possibly different regulatory obligations. Senior management needs to understand that change in order to sequence integration, allocate resources and decide which risks to accept or treat. The information security manager supports this by assessing the acquired company's information risk and reporting how it alters the combined profile, including where it exceeds appetite and what must be addressed before or during network connection. Connecting immediately and fixing issues as they surface imports unknown threats and weaknesses into the corporate environment before anyone has judged whether that exposure is acceptable. Imposing the full corporate policy set without assessment ignores the acquired company's operations and may prioritize the wrong gaps; policies should be applied according to an integration plan informed by risk. Relying on management certification provides assurance from a party with an interest in a favorable answer and no independent evidence. Exam caveat: due diligence before the deal should already have identified major issues, but a post-close assessment is still needed to guide integration. Operational check: confirm the assessment results feed the integration plan and that significant risks are entered into the register with owners.