Acquisition Assessment Policy

1.0 Purpose

The processpurpose of this policy is to establish the framework and minimum security requirements for assessing and integrating a newly acquired companycompanies into the organization's environment. Integrating acquisitions can have a drasticsignificantly impact on the security poster of either the parent company or the child company.  The network and security infrastructureposture of both entities maydue varyto greatlydifferences in infrastructure, policies, and theculture. workforceThis ofpolicy aims to manage these risks by defining a process to:

*   Assess the newacquired company may have a drastically different culture and tolerance to openness.  The goal of the security acquisition assessment and integration process should include:

Assess company’company's security landscape, posture, and policies

practices.
*  

Protect both <Companythe Name>parent organization and the acquired company from increased security risks

during and after integration.
*   Educate the acquired companycompany's aboutpersonnel <Companyon Name>the organization's security policies and standard

standards.
*  

AdoptFacilitate the adoption and implementimplementation <Companyof Name>the Securityorganization's Policiessecurity policies and Standards

standards

Integratewithin the acquired company

entity.
*  

ContinuousEnsure secure integration of networks and systems.
*   Establish requirements for ongoing monitoring and auditing post-acquisition.

This policy outlines the responsibilities of the acquisition

designated

TheIT purposeauthority of this policy is to establish(e.g., Precision Computer responsibilities regarding corporate acquisitions,Team) and definedefines the minimum security requirementsbaseline ofrequired anbefore Precisionconnecting Computeracquired acquisitionsystems assessment.or networks to the organization's infrastructure.

2.0 Scope

This policy applies to all companiescorporate acquiredacquisitions made by <Companythe Name>organization. andIt pertains to all personnel, systems, networks, data, laboratories, test equipment, hardware, softwaresoftware, and firmware,firmware owned and/or operated by the acquired company.company that will be integrated or connected to the organization's environment.

3.0 Policy Statements

3.1 GeneralAcquisition Assessment and Integration Process

Acquisition*   assessments**IT areAuthority conducted to ensure that a company being acquired by <Company Name> does not pose a security risk to corporate networks, internal systems, and/or confidential/sensitive information.Involvement:** The designated IT authority (e.g., Precision Computer TeamTeam) willmust providebe personnel to serve asan active membersmember of the corporate acquisition team from the outset and throughout the entire acquisitionprocess.
*   process.**Risk Assessment:** The PrecisionIT Computer roleauthority is responsible for conducting thorough security assessments of the acquired company to detectidentify and evaluate information security risk,risks related to their infrastructure, systems, applications, data handling practices, and overall security posture.
*   **Remediation Planning:** Based on the risk assessment, the IT authority will develop a remediation plan in collaboration with relevant parties from both the affectedorganization parties forand the identifiedacquired risk,company.
*   and**Implementation:** The IT authority will work with the acquisitionsacquisition integration team to implement solutionsnecessary security controls and remediate identified risks *before* establishing connectivity between the acquired entity's network and the organization's network.

3.2 Minimum Security Requirements for anyIntegration

identified

The security risks, prior to allowing connectivity to <Company Name>'s networks. Below are thefollowing minimum requirements thatmust be met by the acquired company must meet before beingnetwork connectedintegration, tounless thea <Companyformal, Name>risk-accepted network.exception is granted:

*  

**Hosts

(Servers, Requirements

Desktops,

Hosts

Laptops):**
 

  *   All hostsend-user devices (servers, desktops, laptops) willmust either be replaced orwith organization-standard equipment, re-imaged with athe <Company Name>organization's standard imageoperating environment build, or willdemonstrably bemeet requiredall torequirements adoptoutlined in the minimumorganization's endpoint security standards for(e.g., endBaseline userWorkstation devices.

Configuration

BusinessStandard).
    *   All hosts must have organization-approved and updated endpoint protection (anti-virus/anti-malware) software installed and operational before network connection.
    *   Business-critical production servers that cannot be replaced or re-imaged must be audited and a waiver granted by Precision Computer.

All PC based hosts will require <Company Name> approved virus protection before the network connection.

Networks

All network devices will beimmediately replaced or re-imaged withrequire a <Companyspecific Name>security audit and a formal waiver granted by the IT authority (e.g., Precision Computer Team). These servers must meet applicable organizational security standards for servers.
*   **Networks:**
    *   Network infrastructure devices (routers, switches, firewalls) within the scope of integration must typically be replaced with organization-standard image.equipment

or

reconfigured/re-imaged to meet organization standards.
    *   Wireless network access points willmust be configuredreconfigured or replaced to thecomply <Companystrictly Name> standard.

Internet

All Internet connections will be terminated.

When justified by business requirements, air-gapped Internet connections require Precision Computer review and approval.

Remote Access

All remote access connections will be terminated.

Remote access towith the productionorganization's networkWireless willNetwork beConnection providedStandard. byUnauthorized <Companyor Name>.

insecure

Labs

wireless

Lab equipmentnetworks must be physicallydisabled.
*   separated**Internet andConnections:**
 secured   from*   non-labExisting areas.direct

internet

Theconnections labof networkthe acquired company must generally be separatedterminated frompost-integration, with internet access routed through the corporateorganization's productioncontrolled networkperimeter.
 with   a*   firewallAir-gapped betweenor thesegmented two networks.

Any direct networkinternet connections (includingrequired analogfor lines,specific, ISDNjustified lines,business T1, etc.) to external customers, partners, etc.,needs must be reviewed and formally approved by the IT authority (e.g., Precision Computer Team).
*   **Remote Access:**
    *   All existing remote access solutions (VPNs, dial-up, etc.) of the acquired company must be terminated.
    *   Remote access for acquired personnel will be provisioned through the organization's standard, approved remote access solutions and policies.
*   **Laboratory Environments (If Applicable):**
    *   Laboratory networks must be logically and, where appropriate, physically segregated from corporate/production networks, typically using firewalls managed according to organizational standards.
    *   Physical access to lab environments must be secured and restricted based on organizational physical security policies.
    *   Any direct external network connections (e.g., to partners, customers) originating from labs must be reviewed, justified, and approved by the relevant security authority (e.g., Precision Computer Team or a specialized Lab Security Group (LabSec)["LabSec"], if applicable).

 

  *   All acquired labs must meetadhere withto LabSecthe organization's specific lab policy,security policies/standards or be grantedobtain a formal waiver byfrom LabSec.the relevant authority ("LabSec" or IT Security).

3.3 High-Risk Acceptance

*   In theexceptional eventcircumstances thewhere critical business needs necessitate connecting acquired networks and computeror systems being connected to the corporate networkthat fail to meet these minimum requirements, the <Companyassociated Name>risks must be formally documented by the IT authority. Connection under such circumstances requires explicit acknowledgment and acceptance of the identified risks by the organization's Chief Information Officer (CIO) mustor acknowledgeanother designated executive sponsor.

4.0 Compliance

4.1 Compliance Measurement

The designated IT authority (e.g., Precision Computer team) will verify the acquired company's compliance with these requirements through audits, configuration reviews, vulnerability scans, interviews, documentation review, and approveother assessment methods before and during integration. Ongoing compliance will be monitored post-integration.

4.2 Exceptions

As noted in sections 3.2 and 3.3, exceptions to specific requirements require formal documentation, risk assessment, justification, compensating controls (if applicable), and advance approval from the designated IT authority (e.g., Precision Computer team) or, for high-risk acceptance, the CIO.

4.3 Enforcement

Failure to meet these requirements may delay or prevent the integration of the riskacquired to <Company Name>'company's networks

and

Compliancesystems. Measurement

Continued

The Precision Computer team will verify non-compliance topost-integration thismay policyresult throughin variousdisconnection methods,or includingfurther butremediation notactions. limitedPolicy to, business tool reports, internal and external audits, and feedback to the policy owner.

Any exception to the policy must be approvedviolations by the Precision Computer team in advance.

An employee found to have violated this policypersonnel may be subject to disciplinary action,action upaccording to andthe includingparent terminationorganization's of employment. policies.

None.5.0 Definitions

The*   following definition and terms can be found in the SANS Glossary located at:

https://www.sans.org/security-resources/glossary-of-terms/

**Business Critical Production ServerServer:** A server hosting applications or services whose failure would significantly impact core business operations, revenue generation, or service delivery.
*   **Air-gapped:** A security measure where a computer network or device is physically isolated from other networks, particularly unsecured ones like the public internet.