1. Assessing Security and ComplianceRisk for Acquisitions and Mergers June 22, 2011

3. Risk Evaluation Opportunities

4. Planning Activities

5. Prioritizing Risk Review – Compliance, BC and DR, IT security

6. IT Compliance

7. Business Continuity and Disaster Recovery

8. IT Risk Assessment

9. Risk Action Plan

10. Lessons Learned2 Confidential

12. 80% of revenue coming from broadband/dial subs, 20% from business

13. Declining business – 3% monthly churn

15. STS Telecom- 3/2/2010

16. One Communications - 4/1/2011

18. Employee from ~900 to 3,300+

19. Physical locations from 4 to 100+3 Confidential

21. Voice – VOIP, Local, Long Distance, Mobile

22. Cloud Services – Cloud Hosting, Web Hosting, Security

23. Managed Services – Voice, Router, Email, Data Center Collocation4 Confidential

24. Implications 5 Confidential

26. Is this the right deal at the right valuation?

27. Pre-acquisition – Post announcement – Planning (Gap analysis)

28. What IT processes are in place?

29. What IT compliance programs are in place? Is there a gap?

30. Is there a business continuity program? Disaster recovery?

31. Post Acquisition – Integration – Execution

32. Deep dives – compliance, BC/DR, IT risk

33. Remediation roadmaps

34. Continuous improvement audits6 Confidential

36. Begin assessing risk – Interviews, review documentation

37. What are the expected interim and long term integration initiatives? (AD trust, finance, HR, email, calendar, etc)

38. Prioritize risk management

39. IT compliance (PCI, SOX, other, new?)

40. Business continuity and disaster recovery

41. Risk management7 Confidential

43. Gap analysis

45. Audit schedule

47. HIPAA?

48. CPNI?8 Confidential

50. Identify key business leaders

51. Business Impact Analysis – Identify key processes

53. Prepositioned equipment

54. Identification of seasoned, tactical leaders

55. Employee safety, wellness9 Confidential

56. Disaster Strikes April 27th - F4 tornado struck operations centers in Arab, AL and Huntsville, AL - hundreds of employees on site Tornado destroyed Jet Pep gas station on US 231, approximately .2 a mile from our local operations center 10 Confidential

57. IT Risk Evaluation Structured evaluation – Align evaluation with 27001/27002, COBIT, Shared Assessment Questionnaire Information gathering - Identify key areas for investigation (AV, network topography, network intrusion, patch management, SDLC, web application vulnerability, firewall management, change control, etc) Align team/resources Develop a prioritized remediation roadmap Architecture – evaluate integration initiatives Compliance – develop/integrate compliance program Determine audience/output for communication plan - How does your culture manage risk? Recruit allies (CIO, other major stakeholders) Confidential 11

59. Firewall

60. Intrusion Prevention

61. Denial of Service protection

62. Intrusion monitoring via event coorelation

63. Bandwidth utilization monitoring

65. Build standards

66. Physical security standards

67. Host Intrusion Detection

68. Anti-virus

69. Content filtering

71. Incident Response - Rapid Breach Response Team

72. eBCM

73. Crisis Management

74. User Management

76. Vulnerability assessments and remediation

77. Application development security framework aka AppSec

78. Centralized digital certificate management

79. Web application firewall

81. Database firewall

83. Qualifying Risk 13 Confidential

84. Risk Action Plan Synthesize information into actionable items – patch servers, fix app vulnerabilities, etc. Align with integration efforts where possible (AD migration, billing system integration, etc) Develop Remediation Roadmap Quick hits - patching servers, fixing web apps, etc Interim hits - risk reduction initiatives (prioritized risk reduction target system upgrades for key users, IPS, SIEM monitoring, process improvements ex. AV) Long term - system standardization, integration projects, cultural change Adopt standard processes, protections, guidelines, metrics Confidential 14

85. Measuring Success and Trends 15 Confidential

86. Lessons Learned Ignorance is not bliss - get in the game early Right-size your risk management plan - Communicate early and often Balance business with security Standardize the process Confidential 16