Certified Information Security Manager (CISM) — Question 479

Company A, a cloud service provider, is in the process of acquiring Company B to gain new benefits by incorporating their technologies within its cloud services.
Which of the following should be the PRIMARY focus of Company A's information security manager?

Answer options

• A. The cost to align to Company A's security policies
• B. The organizational structure of Company B
• C. Company B's security policies
• D. Company A's security architecture

Correct answer: C

Explanation

The correct answer is C because understanding Company B's security policies is crucial for ensuring compliance and integration with Company A's existing security framework. Options A, B, and D, while important, do not directly address the immediate need to evaluate and incorporate Company B's security measures into Company A's operations.