CISM Question 343

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C2

  This is actually a tough one. B, C and D are all correct in a way. One of the definitions of due diligence in M&A is the following: "Due diligence allows the buyer in the M&A process to confirm hitherto undisclosed details about the selling company's financials, contracts, personnel and customers. In other words, it allows the buyer to obtain a complete picture of the business being acquired." So infosec manager should look into their security policies and processes (B), see how much they differ (D) and assess the risks based on that (C). So if I'd have to pick the most comprehensive answer, I'd say C. But I'm not 100% on this.

• 3

  C. Perform a risk assessment Performing a risk assessment is crucial because it helps identify potential vulnerabilities and threats associated with the acquisition target. This assessment allows the acquiring organization to understand the security risks and make informed decisions about the acquisition. While reviewing security awareness, information security policies, and performing gap analysis are all important aspects of the due diligence process, assessing the specific risks associated with the acquisition target takes precedence because it forms the foundation for addressing security concerns and making risk-based decisions.

• Chose C1

  Risk Assessment is more appropriate