A corporation has expanded for the first time by integrating several newly acquired businesses. Which of the following are the FIRST tasks that the security team should undertake? (Select TWO).

Removing internet access from acquired companies is an extreme operational disruption and is not a standard first step during acquisition integration.

Federating identity management systems is a later-stage integration task that requires both a completed risk baseline and an interconnection policy to already be in place.

Installing firewalls between businesses is a technical control that must be informed by the interconnection policy and risk analysis, not performed before them.

Re-imaging end user computers is a remediation action that logically follows a risk assessment identifying the need, not a first-priority task.

Developing an interconnection policy establishes the rules, requirements, and conditions governing how the acquired companies' networks will be linked to the corporate network, which must exist before any integration activity begins.

Conducting a risk analysis of each acquired company's networks identifies existing vulnerabilities, misconfigurations, and threat vectors that could expose the corporate infrastructure before interconnection occurs.