A company has decided to change its current business direction and refocus on core business. Consequently,
several company sub-businesses are in the process of being sold-off. A security consultant has been engaged
to advise on residual information security concerns with a de- merger. From a high-level perspective, which of
the following BEST provides the procedure that the consultant should follow?

A.
Perform a penetration test for the current state of the company. Perform another penetration test after the
de-merger. Identify the gaps between the two tests.

B.
Duplicate security-based assets should be sold off for commercial gain to ensure that the security posture of
the company does not decline.

C.
Explain that security consultants are not trained to offer advice on company acquisitions or demergers. This
needs to be handled by legal representatives well versed in corporate law.

D.
Identify the current state from a security viewpoint. Based on the demerger, assess what the security gaps
will be from a physical, technical, DR, and policy/awareness perspective.