New System for how Bitsight Manages Mergers & Acquisitions

Following a November 2020 Policy Review Board (PRB) ruling, Bitsight has updated how acquired companies are incorporated into an acquirer's ratings tree.

PRB Case Study: Preview period when acquisitions introduce new infrastructure [Nov. 2020]

A rated company requested that Bitsight grant a preview period for monitoring one of its acquisitions’ infrastructure before it was incorporated into their company tree as a subsidiary, and therefore affected the acquiring company’s rating. The PRB agreed that immediately after an acquisition, the security posture of the acquired company is unlikely to reflect the security posture of the acquirer; it takes time for the acquirer to make meaningful changes. To help establish an appropriate time period, the PRB solicited input from companies of various sizes on their typical acquisition timeline. Based on these discussions, the PRB decided to change the policy on acquisitions to the following: Bitsight will incorporate an acquired company into the acquirer’s rating six months after the transaction was closed, or three months after Bitsight finds out about the acquisition, whichever date is further in the future. Furthermore, acquirers who are Bitsight customers will be permitted a Security Performance Management (SPM) view into the acquired company’s infrastructure during the preview period. A future product enhancement will annotate the acquisition on both the acquirer’s and acquired company’s reports.

To learn more and view other PRB case studies, please click here.

When a new Merger & Acquisition (M&A) event is detected

• Attribution Update: The system automatically expires the attribution associated with the old parent entity.
• Grace Period (Preview Period): The acquiring company is granted a preview period before the acquired entity affects their ratings tree.
• Monitoring Access: During this preview period, acquiring customers are granted a "My Subsidiary" license to monitor the report.
• Incorporation Timeline: Bitsight incorporates the acquired company into the acquirer's rating six months after the transaction closes, or three months after Bitsight identifies the acquisition, whichever date is further in the future.

Please note that with this new system, the three-month grace period mentioned in the policy does not apply.

To keep stakeholders informed, the system triggers notifications at three key stages:

1. At the start of the process.
2. 30 days before the grace period ends.
3. On the final day when the connection is officially made.