Not necessarily. A small set of urgent controls should apply quickly, such as visibility into what the acquired code depends on and a way to deal with serious known issues. The full policy is usually better phased in on a published schedule, after a dry run. Whether any rule is required by contract or regulation is a question for your advisers.
Myth: day one adoption is the safe choice
Fact: Overnight adoption often reduces safety. Builds break, people bypass the new process, and nobody checks whether the rules even fit the acquired product. Safe means the rules are followed, not that they are announced.
Myth: the parent's policy is automatically better
Fact: Sometimes the acquired team has stricter or more suitable practices. A company that ships software to customers may care about license terms more than one that runs only internal tools. Compare rules before you declare a winner.
Myth: waiting means doing nothing
Fact: A phased approach has real work in the first weeks. A reasonable first set:
- Know what is there. Produce an inventory of repositories and dependencies for the acquired code.
- Find the urgent problems. Look for known exploited vulnerabilities and high severity findings that are reachable, and assign owners.
- Control access. Review who can publish packages or change pipelines, and rotate shared credentials.
- Agree on a contact. Name who answers policy questions.
None of these require rewriting how the team builds software.
Myth: one exception means the policy failed
Fact: Exceptions are part of a working policy. The failure is an exception with no owner and no end date. See policy exceptions in code, not in chat.
Myth: tools must be consolidated immediately
Fact: Tools can follow policy. Agree on outcomes first, then decide which tooling delivers them, and move teams on a plan. See security integration plan after an acquisition and acquisition day one security checklist.
When faster is right
Some situations justify speed: a known active compromise, customer data at risk, or a contractual commitment with a date. In those cases, apply the specific control quickly and leave the rest for the schedule.
| Situation | Approach |
|---|---|
| Active incident | Contain first, align policy later |
| Customer commitment with a date | Meet the commitment, record how |
| Routine alignment | Phase by rule |
| Unknown state | Inventory first, then decide |
A note on obligations
This post is general guidance, not legal advice. If a regulation or contract applies to the combined company, ask your legal or compliance advisers what it requires and by when.
Try it yourself
Click through it at your own pace, or open it full screen. This is the day one view: what the code depends on.
Safeguard's asset discovery and dependency scanning can build that inventory for acquired repositories, and its free scan at https://gold.safeguard.sh/scan covers a first look.
Quick check
What is the minimum for week one?
An inventory, a review of the most serious reachable findings, control over publishing and credentials, and a named contact.
Who decides when to phase and when to rush?
The policy owner, with input from security and the acquired team's leads, and with the reason recorded.
Last reviewed: 19 October 2026.
