Question

A manufacturing enterprise is acquiring a smaller competitor. The acquiring company follows ISO/IEC 27001, while the target has an informal, undocumented security program built around a different framework. The board has asked the information security manager how to approach integrating the two security programs to deliver value while managing risk. What should the information security manager do FIRST?

Accepted Answer

Perform a gap assessment of the target's security posture against the acquiring organization's governance framework and risk appetite

Answer

Immediately impose the acquiring company's ISO/IEC 27001 controls and policies on the target to enforce consistency

Answer

Retain the target's existing framework indefinitely to avoid disrupting its operations during the transition

Answer

Purchase additional cyber insurance to transfer the risk introduced by the acquired entity