Do not grandfather everything under one waiver. Inventory the acquired systems, triage the findings, give each unfixed item its own time-boxed exception with an owner, and publish a dated plan that brings the acquired estate to your policy. Auditors accept a documented glide path far more readily than silence.
Acquired code arrives with its own backlog, its own scanners, and often its own definition of "critical". Your policy applies on day one, so you need a bridge.
Why a blanket exception backfires
A single exception reading "all acquired systems exempt until integration completes" has no scope, no owner, and no end. It also hides the findings that really matter. Per-system records cost more effort, but they let you spend that effort where exposure is highest.
A four-step plan
- Inventory. List repositories, services, images, and third-party components. Without an SBOM or equivalent per system, you are guessing.
- Triage by exposure. Internet-facing and customer-data systems first, internal tools last. Check the CISA KEV catalog for anything on the list that is known exploited, and treat those as urgent.
- Decide per finding. Fix now, schedule a fix, or open a time-boxed exception.
- Publish the glide path. A dated table showing when each acquired system reaches your policy.
Sample glide path
| System tier | Policy applies | Exception window | Review |
|---|---|---|---|
| Internet-facing | Day 1 | 30 days maximum | Weekly |
| Customer data, internal | Day 30 | 60 days | Biweekly |
| Internal tools | Day 90 | 90 days | Monthly |
Adjust to your own risk tolerance. The shape matters more than the numbers: the riskiest systems get the shortest exceptions.
Who approves
The acquirer's security owner approves, not the acquired team's lead. The people who own the code know the quirks, but approval needs independence from the requester. Record the acquired owner as the requester and the acquirer's approver as the decision maker.
Evidence to keep
- The inventory and the date it was taken.
- The triage list with decisions.
- Each exception record with scope and expiry.
- Progress snapshots at each review.
If a buyer or auditor later asks how you integrated an acquisition, these four items answer it. NIST SP 800-30 describes risk assessment as input to leaders' decisions; the triage list is that input made concrete.
Common traps
Scanners tuned differently in the two companies will report different counts for the same code. Normalize on one tool or one severity scale before you compare. Also watch for secrets, deployment credentials and vendor accounts that came with the acquisition. They are outside this post but belong on the same checklist.
Where Safeguard fits
Safeguard's asset discovery and SBOM and dependency scanning help build the first inventory of an acquired estate, and its policies can apply one standard across both codebases.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an inventory groups components by service, which is the starting point for per-system triage.
Quick check
Can we exempt acquired systems for a year?
A year with no review is hard to defend. Use short windows for exposed systems and review often.
Do inherited findings count against our SLA from day one?
Decide and document when the clock starts, for example from the integration date, and apply that choice consistently.
Sources
- CISA Known Exploited Vulnerabilities Catalog
- NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments
Last reviewed: 19 October 2026.
