Don’t Acquire a Company Until You Evaluate Its Data Security

guest · Apr 16, 2019

Don’t Acquire a Company Until You Evaluate Its Data Security
April 16, 2019
https://hbr.org/2019/04/dont-acquire-a-company-until-you-evaluate-its-data-security

When Marriott International acquired Starwood in 2016 for $13.6 billion, neither company was aware of a cyber-attack on Starwood’s reservation system that dated back to 2014.

When an acquirer does not protect itself against a data lemon and seek sufficient information about the target’s data privacy and security compliance, the acquirer may be left with a data lemon [...]
Finding the Problem Before You Own It
The acquirer would investigate the target firm’s past data breaches and require disclosure of prior data-related audits and any pending investigations worldwide.
The acquiring firm would also conduct a review of the target’s processes and procedures regarding information security — like acceptable use of data, data classification, and data handling.
Once You’ve Acquired a Data Lemon
Even if you’ve done all the above, you may still acquire a data lemon. What should you do then? At this point, it is essential to set up an incident response strategy to address risks, including both those that are legal or regulatory or customer-facing in nature.
Click to expand...

Log in or Sign up

Don’t Acquire a Company Until You Evaluate Its Data Security

guest Guest

Log in or Sign up

Don’t Acquire a Company Until You Evaluate Its Data Security

guest Guest

Useful Searches