In a merger penetration test scope, which item should be included?

In a merger penetration test scope, which item should be included?

• A. Employee salaries
• B. Office furniture
• C. Brand color
• D. Company culture

Answer: (D)

In a merger penetration test, the scope must cover how people and organizational practices influence security. The way employees from both organizations behave, follow policies, and interact with processes can create real risk—often more so than any single technical control. Company culture shapes security awareness, incident response readiness, access management discipline, and how smoothly security policies are adopted across the merged entity. If cultural differences aren’t considered, testers may miss vulnerabilities that arise from inconsistent training, conflicting procedures, or different risk tolerances, such as weak onboarding, rushed privilege provisioning, or poor cross‑team coordination. Salaries, office furniture, and brand color don’t affect the security controls or risk posture the test is designed to evaluate, so they aren’t relevant to the scope. Therefore, including company culture makes the most sense because it directly impacts how security is practiced in the merged organization.

In a merger penetration test, the scope must cover how people and organizational practices influence security. The way employees from both organizations behave, follow policies, and interact with processes can create real risk—often more so than any single technical control. Company culture shapes security awareness, incident response readiness, access management discipline, and how smoothly security policies are adopted across the merged entity. If cultural differences aren’t considered, testers may miss vulnerabilities that arise from inconsistent training, conflicting procedures, or different risk tolerances, such as weak onboarding, rushed privilege provisioning, or poor cross‑team coordination.

Salaries, office furniture, and brand color don’t affect the security controls or risk posture the test is designed to evaluate, so they aren’t relevant to the scope. Therefore, including company culture makes the most sense because it directly impacts how security is practiced in the merged organization.