The Hidden Risks of Inherited IT

What the Maersk incident tells us about compliance visibility

As businesses grow, so does the complexity of managing their information security.

Acquisitions, mergers and organisational changes bring new opportunities. But they also introduce new systems, processes, suppliers and data that need to be brought into the wider business's security and compliance programme.

This week, Maersk confirmed a security incident involving a local legacy system inherited through a previous acquisition.

According to Maersk's initial findings, the incident was isolated to that system, with no indication of impact on its wider IT environment or connected customers and partners. Its investigation remains ongoing.

While the full circumstances are still being established, the incident raises an important question for organisations of all sizes:

As your business evolves, how confident are you that your security and compliance programme has visibility of everything it needs to protect?

Business growth brings new compliance considerations

Whether through acquisition, expansion or restructuring, business growth rarely happens without introducing additional complexities.

New systems are integrated, responsibilities change and existing processes need to adapt. Inherited IT environments may have been developed under different security policies, with different approaches to asset management, access controls and risk assessment.

And while integrating these environments is often a priority, it can take time.

Legacy systems may continue to support important business operations long after an acquisition is complete. Others may hold historical information or remain connected to wider infrastructure.

The challenge isn't necessarily the presence of legacy technology.

It's ensuring those systems remain visible, appropriately managed and accounted for within the organisation's wider security posture.

Because you can't effectively manage risks you don't have visibility of.

Why ISO 27001 extends beyond technical security

ISO 27001 provides a framework for managing information security risks across an organisation, combining people, processes and technology.

And while technical controls play a critical role, they're only one part of the picture.

Of the 93 controls in ISO 27001:2022, just 34 are classified as technological. The remaining 59 address organisational, people and physical security.

For organisations managing inherited IT, several areas are particularly relevant:

• Asset management: Maintaining an accurate inventory of systems, information and associated assets, with clear ownership and accountability‍
• Risk management: Reviewing and reassessing information security risks as the business changes, particularly following acquisitions or significant operational developments
• ‍Vulnerability and configuration management: Ensuring inherited systems are appropriately assessed, maintained and managed in line with organisational security requirements‍
• Information lifecycle management: Understanding what information is held, why it's needed and how it should be retained or securely disposed of‍
• Continuous monitoring: Maintaining visibility of security controls and identifying changes that could affect the organisation's risk posture

These aren't simply activities to complete ahead of an audit.

They're ongoing responsibilities that help maintain a clear understanding of your security and compliance posture as the business evolves.

The importance of visibility across the whole business

One of the important details in Maersk's initial statement is that the incident appears to have remained isolated, with no indication of wider impact.

While investigations continue, it reinforces the value of taking a layered approach where controls work together to manage and contain potential risks.

But it also highlights why compliance visibility needs to extend beyond the systems organisations actively monitor every day.

For growing businesses, the challenge is often bringing together information from multiple teams, systems and processes to maintain a consistent view of risk.

IT teams may manage technical vulnerabilities.

Operations teams may oversee suppliers and processes.

Compliance teams may maintain risk registers, policies and audit evidence.

All have an important role to play.

The real value comes when these activities are connected, with clear ownership and a shared understanding of the organisation's wider compliance posture.

Five questions worth asking as your business evolves

Whether your organisation has recently completed an acquisition, introduced new technology or simply grown over time, there are a few useful questions to consider:

1. ‍Do we have a complete picture of our IT assets? Including systems inherited through acquisitions, restructuring or changes in suppliers
2. ‍Is ownership clearly defined? Does every system have someone responsible for its ongoing management and associated risks?‍
3. Are inherited systems included in our security processes? Including vulnerability management, monitoring and regular risk assessments
4. ‍Do we understand the information they hold? And whether that data is still needed, appropriately protected and managed.‍
5. Are we regularly reviewing our risk posture? Not just ahead of certification or audit deadlines, but whenever significant changes occur across the business.

These questions are just as relevant to scaling businesses as they are enterprises, particularly those organisations growing through acquisition or managing increasingly complex operations.

Compliance needs to evolve alongside your business

For me, this is where the conversation needs to move beyond achieving certification.

ISO 27001 provides an important foundation, but maintaining an effective ISMS requires ongoing visibility, ownership and engagement across the business.

As organisations grow, their systems, people, processes and risks change. Their approach to compliance needs to evolve with them.

Alongside this, teams require visibility to make informed decisions and understand how to maintain accountability as their requirements evolve.

Effective compliance isn't just about understanding where your business stands at the point of certification. It's about maintaining that understanding as your business moves forward.