A large enterprise is expanding through the acquisition of a second corporation. Which of the following should be undertaken FIRST before connecting the networks of the newly formed entity?

Scanning systems to verify they are secure is a technical activity that should occur after risks have been identified and prioritized, not before the risk landscape is understood.

Implementing a firewall or DMZ is a mitigation control and should be designed based on the results of a risk analysis rather than deployed without that context.

Developing a risk analysis first establishes a clear understanding of the threats, vulnerabilities, and potential impacts introduced by merging the two network environments. Without this foundational step, any subsequent actions - such as scanning systems or deploying firewalls - lack prioritization and may address the wrong risks. Risk analysis drives all downstream security decisions during a merger or acquisition and is the recognized first step in secure network integration.

Reviewing the acquired corporation's security posture is an important input into the risk analysis but is a narrower sub-task that feeds into, rather than replaces, the full risk analysis process.