Following a merger, the two combined companies have conflicting acceptable use policies, and managers are unsure which one applies to integrated teams. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Two rulebooks for one team is like two referees calling the same match by different rules. You run both through governance and come out with one approved policy, rather than letting each team pick its favorite.
Full Explanation
Conflicting policies create uncertainty about acceptable behavior, make enforcement inconsistent and expose the combined organization to risk, particularly where integrated teams share systems and information. The information security manager should bring both policies into the governance process, compare their requirements, consult affected stakeholders, and produce a single reconciled policy that senior management approves for the combined organization. That ensures one clear set of expectations, consistent with the new organization's risk appetite and obligations. Keeping both policies in force perpetuates the confusion for integrated teams, who cannot follow two conflicting rule sets for the same activity. Applying the acquiring company's policy unchanged may seem efficient, but it ignores requirements or good practices in the acquired company's policy, may conflict with its legal obligations or operations, and bypasses the analysis that governance requires. Allowing each department to choose fragments the organization and produces inconsistent controls across teams that now share information. Exam caveat: an interim decision on which policy applies may be needed while reconciliation proceeds, and that decision should also be made through governance. Operational check: confirm a single approved acceptable use policy is published, communicated, acknowledged by all staff and referenced by both legacy companies' onboarding.