Two Security Policies, One Company: Who Accepts the Risk?
Harborline Financial completes its acquisition of Vellbrook, a 900-person payments processor, in six weeks. Both firms hold ISO/IEC 27001 certification but under different scopes. Vellbrook's policy mandates 60-day password rotation with an 8-character minimum and a local exception register kept by each business unit; Harborline mandates 14-character passphrases with no forced rotation and a single central register approved by the CISO. Vellbrook's CISO reports directly to its CEO and sits on the deal integration board; Harborline's CISO reports to the CIO, three levels below the board. Internal audit has flagged that 41 of Vellbrook's 63 open exceptions were approved by business-unit managers with no expiry date. The integration steering committee has asked for a single harmonized policy set within 90 days and has not decided who owns risk acceptance in the interim. Regulators require Harborline to evidence quarterly board oversight of material technology risk.
1. Which body should hold decision rights over the harmonized policy set and over interim risk acceptances, and why is the current arrangement inadequate? State the mandate, membership and escalation path.
Read the worked answer
The integration steering committee is a delivery body with a 90-day horizon; it can sequence work but cannot own risk beyond the merger. Decision rights should sit with a permanent Security Risk Committee, chaired by the group CISO and including the CIO, CFO, General Counsel, business unit heads, the DPO and internal audit as a non-voting observer. It should meet monthly, hold a delegated authority from the board risk committee, and accept risk only within a numeric and regulatory threshold set by the board.
The current arrangement fails for three reasons. First, business-unit managers approving exceptions are approving risk they themselves own, a self-approval conflict that produced the 41 stale entries. Second, until an accountable executive is named for the combined estate, no one can accept cross-entity risk. Third, the two CISOs sit at different distances from the board, so oversight is inconsistent.
Escalation: anything above threshold, any exception touching regulated data, and any exception older than 90 days goes to the board risk committee with a written recommendation. Interim measure: freeze new exceptions, cap all existing ones at 90 days with compensating controls, and name the group CISO as interim accountable executive with a standing board reporting line.
2. The two password standards conflict and 41 exceptions have no expiry. How should the conflict be resolved, and what do you do with the exceptions?
Read the worked answer
Resolve to one target standard rather than maintaining two in parallel; parallel standards guarantee ambiguity and give staff a legitimate reason to follow whichever is weaker. Adopt Harborline's passphrase standard because it aligns with modern guidance (length and blocklist checking over forced rotation, combined with MFA), but validate it first: confirm that no Vellbrook application silently truncates at 8 or 12 characters, since silent truncation destroys the security benefit while giving the appearance of compliance. Where an application cannot support the standard, that is an exception, not a reason to keep the old policy.
For the 41 stale exceptions, triage each into one of three outcomes: close (risk no longer exists), remediate (fix the underlying control), or re-justify with a named risk owner, a documented compensating control, and a hard expiry no longer than 90 days attached to a funded remediation date. Publish the count and age of open exceptions monthly so the trajectory is visible.
Sequence the migration around account resets so you do not create a help-desk surge, and brief the service desk before the change so they do not become a workaround channel.
3. What metrics would credibly evidence board-level oversight of material technology risk after the merger?
Read the worked answer
The board needs risk and trend indicators, not activity volume. Recommend a small set with defined thresholds and traffic-light reporting:
- Top material risks with appetite status, movement since last quarter, and the owner's name.
- Open exceptions above threshold: count, median age, and count past expiry (the audit finding becomes a tracked KRI).
- Percentage of crown-jewel systems meeting the unified control baseline, with the denominator stated, because the merged CMDB is incomplete and a percentage over an unknown population is misleading.
- Mean time to remediate critical vulnerabilities on internet-facing and cardholder-data systems.
- Third-party and concentration risk for the largest processors, including the CNC-style vendor dependencies that carry long remediation lead times.
- Merger control convergence milestones against plan.
Exclude metrics such as phishing emails blocked or number of log events, which measure effort. Each metric needs an owner, a target, and a defined escalation when it breaches, otherwise the board is reading rather than overseeing. Where data quality is poor, say so rather than reporting a confident number.