1. Establish accountable cyber command
The integration leadership should name executive, security, technology, legal, privacy, communications and business authority for Day One. The required output is a joint cyber command charter. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][2].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that separate chains of command can delay containment. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
2. Protect trusted communications
The integration leadership should verify out-of-band contacts, escalation channels, decision logs and emergency access. The required output is a trusted communications plan. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [3][4].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that a compromised estate can undermine its own response channel. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
Table 1. Day One control chain
| Control layer | Immediate evidence | Decision |
|---|---|---|
| command | named authority and contacts | activate |
| critical services | dependency and tolerance map | protect |
| identity and privilege | owned accounts and access | contain |
| response | tested escalation and recovery | accept |
Illustrative structure; verified transaction evidence and specialist review govern.
Illustrative analytical scenario; verified transaction evidence should replace index values.
3. Map critical services
The integration leadership should link customer, cash, safety, operations, reporting and regulated obligations to technology dependencies. The required output is a critical-service map. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][5].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that asset counts can obscure business consequence. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
4. Build the minimum asset view
The integration leadership should combine known internet, cloud, endpoint, server, network, application and operational technology evidence. The required output is a Day One asset register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [6][7].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that unknown assets can sit outside control coverage. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
5. Map attack paths
The integration leadership should identify external exposure, trust relationships, privileged routes and connections to critical assets. The required output is an attack-path map. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [8][9].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that isolated control tests can miss compound paths. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
6. Protect pre-close boundaries
The integration leadership should limit access, coordination and sensitive information exchange before lawful closing. The required output is a cyber clean-team protocol. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [10][11].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that security preparation can create premature integration. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
7. Verify identity ownership
The integration leadership should correlate people, contractors, service accounts, workloads, devices and credentials to accountable owners. The required output is an identity register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [12][13].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that automatic federation can extend trust to orphaned identities. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
8. Contain privileged access
The integration leadership should inventory administrators, emergency accounts, vaults, keys, tokens and delegated privileges. The required output is a privileged-access matrix. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [13][14].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that hidden privilege can bypass ordinary controls. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
9. Secure administrative work
The integration leadership should separate privileged workstations, accounts, sessions, approval and monitoring from ordinary use. The required output is an administration control plan. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [14][15].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that compromised user devices can become control-plane access. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
10. Control joiner mover leaver changes
The integration leadership should align employment, supplier and organisational events with timely access decisions. The required output is an access-change ledger. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [12][16].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that integration activity can leave excessive or stale access. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
11. Require strong authentication
The integration leadership should prioritise phishing-resistant multi-factor authentication for privileged and externally exposed access. The required output is an authentication coverage plan. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [17][18].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that weak recovery routes can negate strong primary authentication. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
12. Govern service accounts and secrets
The integration leadership should assign ownership, purpose, rotation, scope, storage and monitoring to non-human identities. The required output is a machine-identity register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [13][19].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that long-lived secrets can survive organisational change. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
13. Segment the estates
The integration leadership should control connections, trust zones, management planes and critical-service pathways. The required output is an interconnection control map. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [20][21].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that broad connectivity can spread compromise across both businesses. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
14. Apply zero-trust principles
The integration leadership should verify subject, device, context and resource for each material access decision. The required output is a policy-enforcement design. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [14][20].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that network location can be mistaken for trust. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
15. Centralise essential telemetry
The integration leadership should collect identity, privilege, endpoint, network, cloud, application and backup events needed for detection. The required output is a minimum logging standard. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [22][23].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that visibility gaps can conceal compromise during transition. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
16. Protect logs and time integrity
The integration leadership should secure storage, access, retention, synchronised time and alerting for disabled sources. The required output is a telemetry integrity plan. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [22][24].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that attackers can erase or corrupt response evidence. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
Table 2. Identity-trust matrix
| Identity class | Minimum control | Evidence |
|---|---|---|
| workforce | verified owner and strong authentication | access record |
| privileged | vaulted, approved and monitored | session trail |
| service account | purpose, owner and rotation | secret register |
| third party | bounded scope and expiry | sponsor approval |
Illustrative structure; verified transaction evidence and specialist review govern.
Illustrative analytical scenario; verified transaction evidence should replace index values.
17. Define the vulnerability baseline
The integration leadership should combine scanners, inventories, vendor advisories, configuration evidence and threat intelligence. The required output is an exposure register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [25][26].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that severity scores alone can misstate exploitability and consequence. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
18. Prioritise exploitable paths
The integration leadership should rank exposure by active exploitation, reachability, privilege, criticality and compensating controls. The required output is a remediation priority matrix. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [26][27].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that large patch counts can distract from material attack routes. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
19. Control external attack surface
The integration leadership should verify domains, certificates, remote access, cloud services, APIs and internet-facing systems. The required output is an external exposure map. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [6][28].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that forgotten services can remain publicly reachable. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
20. Secure endpoints and servers
The integration leadership should establish protection, hardening, detection, isolation, encryption and administration baselines. The required output is an endpoint control schedule. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [29][30].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that inconsistent tools can create blind spots and operational conflict. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
Table 3. Exposure-priority matrix
| Factor | Question | Priority signal |
|---|---|---|
| exploitation | actively exploited or credible threat? | urgent |
| reachability | reachable from an untrusted path? | high |
| privilege | enables control-plane access? | high |
| business effect | threatens a critical service? | material |
Illustrative structure; verified transaction evidence and specialist review govern.
Illustrative analytical scenario; verified transaction evidence should replace index values.
21. Protect cloud control planes
The integration leadership should review tenants, subscriptions, identity, roles, keys, logging, networks and inherited responsibility. The required output is a cloud control-plane review. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [14][31].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that cloud ownership can remain ambiguous after closing. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
22. Protect operational technology
The integration leadership should separate safety and availability decisions, vendor access, monitoring and recovery from ordinary IT assumptions. The required output is an OT risk boundary. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [32][33].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that aggressive scanning or isolation can disrupt physical operations. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
23. Validate backup integrity
The integration leadership should test immutability, isolation, identity, coverage, restoration and recovery point evidence. The required output is a backup assurance pack. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [34][35].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that backup existence can be mistaken for recoverability. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
24. Build the joint incident path
The integration leadership should align detection, triage, command, containment, eradication, recovery and learning across both estates. The required output is an incident-response playbook. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [2][36].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that parallel teams can duplicate action or leave gaps. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
25. Set incident authority
The integration leadership should define who can isolate systems, disable identities, stop services, engage specialists and notify stakeholders. The required output is an authority matrix. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [2][37].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that unclear approval can extend attacker dwell time. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
26. Preserve evidence
The integration leadership should protect logs, images, timelines, decisions, communications, chain of custody and legal hold. The required output is an evidence preservation protocol. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [24][36].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that urgent recovery can destroy investigative material. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
27. Integrate legal and regulatory escalation
The integration leadership should map notification tests, decision makers, deadlines, privilege, regulators and law enforcement. The required output is an incident obligation register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [38][39].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that technical severity can differ from legal materiality. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
28. Prepare customer communications
The integration leadership should define verified facts, service impact, protective action, channels, ownership and update cadence. The required output is a cyber communication plan. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [3][40].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that premature certainty can deepen customer harm. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
Table 4. Incident-response authority
| Decision | Accountable role | Required evidence |
|---|---|---|
| isolate asset | incident commander | service and threat impact |
| disable identity | identity lead | ownership and access path |
| notify authority | legal or regulatory lead | applicable threshold |
| restore service | business and technology owners | recovery validation |
Illustrative structure; verified transaction evidence and specialist review govern.
Illustrative analytical scenario; verified transaction evidence should replace index values.
29. Coordinate cyber insurance
The integration leadership should verify notice, consent, panel providers, costs, exclusions and evidence requirements. The required output is an insurance response map. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [41][42].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that unapproved action can impair recovery rights. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
30. Govern critical suppliers
The integration leadership should map access, concentration, incidents, subcontractors, exit, logs and recovery responsibilities. The required output is a supplier cyber register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [43][44].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that third-party trust can connect both estates indirectly. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
31. Control data exposure
The integration leadership should classify sensitive data, restrict movement, monitor high-risk transfers and preserve lawful purpose. The required output is a data-protection control map. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [45][46].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that integration teams can over-share sensitive information. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
32. Run a Day One exercise
The integration leadership should simulate identity compromise, ransomware, supplier failure and customer disruption with decision makers. The required output is an exercise evidence pack. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [2][47].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that untested plans can fail at handoffs. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
33. Define minimum acceptance criteria
The integration leadership should require evidence for identity, privilege, logging, vulnerability, backup, response and communications controls. The required output is a Day One cyber gate. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][5].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that calendar completion can substitute for risk acceptance. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
34. Govern exceptions
The integration leadership should record rationale, compensating controls, accountable owner, duration, monitoring and expiry. The required output is a cyber exception register. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][48].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that temporary risk acceptance can become permanent. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
35. Monitor leading indicators
The integration leadership should track privileged changes, failed authentication, disabled logs, external exposure and critical vulnerabilities. The required output is an early-warning dashboard. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [22][27].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that volume metrics can obscure control failure. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
36. Monitor business outcomes
The integration leadership should track service disruption, containment time, recovery, customer impact, loss and control effectiveness. The required output is a cyber outcome scorecard. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][2].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that tool deployment can be mistaken for resilience. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
37. Stage longer-term convergence
The integration leadership should sequence identity, security tooling, networks, cloud, data and response integration by evidence. The required output is a cyber convergence roadmap. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [14][20].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that rapid standardisation can create new control gaps. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
38. Reforecast cyber economics
The integration leadership should update remediation cost, downtime exposure, insurance, specialists, licences and residual risk. The required output is a cyber value case. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [5][42].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that initial budgets can ignore discovered exposure. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
39. Issue the Day One cyber certificate
The integration leadership should reconcile assets, identities, privilege, logs, vulnerabilities, incidents, recovery, exceptions and risk. The required output is an auditable cyber certificate. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][2].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that leaders can declare security without tested evidence. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
Table 5. Day One cyber certificate
| Conclusion | Evidence | Acceptance |
|---|---|---|
| estate visibility | asset and service map | approved |
| access control | identity and privilege register | controlled |
| detection and response | telemetry and exercise evidence | verified |
| residual risk | exceptions and recovery evidence | accepted |
Illustrative structure; verified transaction evidence and specialist review govern.
Illustrative analytical scenario; verified transaction evidence should replace index values.
40. Institutionalise combined cyber governance
The integration leadership should embed accountable ownership, control testing, exercises, lessons, investment and board oversight. The required output is an enduring cyber governance cycle. Record the business purpose, service and asset scope, evidence, accountable owner, cyber impact, legal boundary, decision rationale and review date [1][49].
Assess immediate resilience across both estates. Test critical-service impact, identity and privilege, exploitable exposure, telemetry integrity, containment authority, recovery evidence, supplier dependency and the critical decision window. Apply documented business judgement to verified evidence.
The principal risk is that integration-period controls can decay after stabilisation. Compare preventive, detective, response and recovery controls, including temporary containment, compensating controls, rehearsed escalation, rollback and staged convergence.
Retain asset and identity inventories, approved configurations, logs, vulnerability evidence, incident records, exercise results, recovery tests, approvals, exceptions and outcomes. Reforecast when threats, exposure, service dependencies, transaction timing, control coverage or recovery needs change.
References
- National Institute of Standards and Technology, Cybersecurity Framework 2.0, https://www.nist.gov/cyberframework
- National Institute of Standards and Technology, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, https://csrc.nist.gov/pubs/sp/800/61/r3/final
- UK National Cyber Security Centre, Cyber Security Toolkit for Boards, https://www.ncsc.gov.uk/collection/board-toolkit
- Cybersecurity and Infrastructure Security Agency, Cybersecurity Incident and Vulnerability Response Playbooks, https://www.cisa.gov/news-events/news/cybersecurity-incident-and-vulnerability-response-playbooks
- UK Financial Conduct Authority, Operational Resilience, https://www.fca.org.uk/firms/operational-resilience
- Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Cybersecurity and Infrastructure Security Agency, Cross-Sector Cybersecurity Performance Goals, https://www.cisa.gov/cross-sector-cybersecurity-performance-goals
- National Institute of Standards and Technology, Guide for Conducting Risk Assessments, https://csrc.nist.gov/pubs/sp/800/30/r1/final
- MITRE, ATT&CK Enterprise Matrix, https://attack.mitre.org/matrices/enterprise/
- UK Competition and Markets Authority, Interim Measures in Merger Investigations, https://www.gov.uk/government/publications/interim-measures-and-derogations-guidance-and-templates
- European Commission, EU Merger Control Procedures, https://competition-policy.ec.europa.eu/mergers/procedures_en
- National Institute of Standards and Technology, Digital Identity Guidelines, https://pages.nist.gov/800-63-4/
- National Institute of Standards and Technology, Security and Privacy Controls for Information Systems, https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
- National Institute of Standards and Technology, Zero Trust Architecture, https://csrc.nist.gov/pubs/sp/800/207/final
- UK National Cyber Security Centre, Privileged Access Workstations, https://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/privileged-access-workstations
- Cybersecurity and Infrastructure Security Agency, Identity and Access Management Recommended Best Practices, https://www.cisa.gov/resources-tools/resources/identity-and-access-management-recommended-best-practices-administrators
- Cybersecurity and Infrastructure Security Agency, Implementing Phishing-Resistant MFA, https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
- National Institute of Standards and Technology, Authentication and Lifecycle Management, https://pages.nist.gov/800-63-4/sp800-63b.html
- Cybersecurity and Infrastructure Security Agency, Secure Cloud Business Applications, https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
- National Institute of Standards and Technology, Implementing a Zero Trust Architecture, https://csrc.nist.gov/pubs/sp/1800/35/final
- Cybersecurity and Infrastructure Security Agency, Zero Trust Maturity Model, https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model
- Cybersecurity and Infrastructure Security Agency, Best Practices for Event Logging and Threat Detection, https://www.cisa.gov/resources-tools/resources/best-practices-event-logging-and-threat-detection
- UK National Cyber Security Centre, Logging Made Easy, https://www.ncsc.gov.uk/information/logging-made-easy
- National Institute of Standards and Technology, Computer Security Log Management, https://csrc.nist.gov/pubs/sp/800/92/final
- National Institute of Standards and Technology, Enterprise Patch Management Planning, https://csrc.nist.gov/pubs/sp/800/40/r4/final
- Cybersecurity and Infrastructure Security Agency, Stakeholder-Specific Vulnerability Categorization, https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
- Forum of Incident Response and Security Teams, Common Vulnerability Scoring System v4.0, https://www.first.org/cvss/v4.0/
- Cybersecurity and Infrastructure Security Agency, External Attack Surface Management, https://www.cisa.gov/resources-tools/services/external-attack-surface-management
- Cybersecurity and Infrastructure Security Agency, Ransomware Guide, https://www.cisa.gov/stopransomware/ransomware-guide
- UK National Cyber Security Centre, Device Security Guidance, https://www.ncsc.gov.uk/collection/device-security-guidance
- National Institute of Standards and Technology, Cloud Computing Security Reference Architecture, https://csrc.nist.gov/pubs/sp/500/299/final
- National Institute of Standards and Technology, Guide to Operational Technology Security, https://csrc.nist.gov/pubs/sp/800/82/r3/final
- Cybersecurity and Infrastructure Security Agency, Cybersecurity Performance Goals for Industrial Control Systems, https://www.cisa.gov/resources-tools/resources/ics-cybersecurity-performance-goals
- UK National Cyber Security Centre, Offline Backups in an Online World, https://www.ncsc.gov.uk/blog-post/offline-backups-in-an-online-world
- National Institute of Standards and Technology, Data Integrity Recovering from Ransomware, https://csrc.nist.gov/pubs/sp/1800/11/final
- National Institute of Standards and Technology, Computer Security Incident Handling Guide, https://csrc.nist.gov/pubs/sp/800/61/r2/final
- Cybersecurity and Infrastructure Security Agency, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks, https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf
- UK Information Commissioner's Office, Personal Data Breaches, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/
- European Union Agency for Cybersecurity, Incident Reporting, https://www.enisa.europa.eu/topics/incident-reporting
- UK National Cyber Security Centre, Incident Management, https://www.ncsc.gov.uk/collection/incident-management
- UK Financial Conduct Authority, Cyber Resilience, https://www.fca.org.uk/firms/cyber-resilience
- UK Government, Cyber Security Guidance for Business, https://www.gov.uk/government/collections/cyber-security-guidance-for-business
- UK National Cyber Security Centre, Supply Chain Security Guidance, https://www.ncsc.gov.uk/collection/supply-chain-security
- Cybersecurity and Infrastructure Security Agency, ICT Supply Chain Risk Management, https://www.cisa.gov/topics/cyber-threats-and-advisories/information-communications-technology-supply-chain-risk-management
- UK Information Commissioner's Office, Data Sharing and Mergers and Acquisitions, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/due-diligence/
- European Union, General Data Protection Regulation, https://eur-lex.europa.eu/eli/reg/2016/679/oj
- UK National Cyber Security Centre, Exercise in a Box, https://www.ncsc.gov.uk/information/exercise-in-a-box
- National Institute of Standards and Technology, Risk Management Framework, https://csrc.nist.gov/projects/risk-management/about-rmf
- UK Government, Cyber Governance Code of Practice, https://www.gov.uk/government/publications/cyber-governance-code-of-practice
