A manufacturer buys a smaller rival in 30 days. The CEO wants its network joined to the corporate cloud on day one. Its security posture has never been reviewed. What should the security manager do FIRST? A. Connect it behind a restrictive firewall B. Require it to adopt corporate security policies C. Perform security due diligence on its environment D. Extend cyber insurance to cover its systems (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A marketing team wants three years of customer support transcripts in an overseas AI analytics tool by month end. The transcripts were never classified and have no named owner. What should the security manager do FIRST? A. Approve the upload once the transcripts are anonymized B. Assign a data owner and classify the transcripts C. Require the provider to sign a data processing agreement D. Limit the upload to transcripts older than one year (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

A hospital must move its imaging platform to a public cloud within 90 days; design approval is due next week. The architect proposes provider managed encryption at rest for every workload. What should the security manager do FIRST? A. Approve the design to protect the contract deadline B. Confirm data classification and the shared responsibility split C. Require customer managed keys in a hardware security module D. Schedule a penetration test of the platform before go live (Explain your answer for more points in the comments!) Come back for the answer tomorrow, or study more now!

Welcome to the group! Please share what you hope to gain from being here, and for fun, tell us the best piece of advice you've ever received!