Any significant changes in nature or size of business anticipated next 12 months (M&A, consolidation)?
Acquisitions import an environment nobody has assessed, and they are the single most common way a well-controlled estate acquires a serious weakness.
What the carrier is actually asking
The carrier is asking whether mergers, acquisitions, disposals, consolidation, or significant growth are anticipated. It affects the risk profile, the named insured, and how the policy responds to entities that join mid-term.
Why it is underwritten
An acquired company arrives with its own controls, its own incidents, and often its own unmanaged directory. Integration commonly connects the two environments before anyone has assessed the new one. Carriers ask because acquisitions produce claims at a rate out of proportion to their frequency.
Where the answer lives in Microsoft 365, Entra ID, and Azure
This is a forward-looking disclosure and the useful accompaniment is your integration approach.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Corporate plans | Anticipated transactions and their expected timing | Disclosed to the extent confidentiality permits. Attested |
| Policy terms | Automatic acquisition provisions and their thresholds | What the policy covers automatically and above what size notification is required |
| Diligence | Security due diligence in the transaction process | Whether security is assessed before completion rather than after integration |
| Integration | How environments are connected | Whether the acquired environment is assessed and remediated before trust is established |
| Growth | Significant headcount or revenue growth | Growth that changes the risk profile even without a transaction |
The standard integration sequence connects directories early to make collaboration work. If the acquired environment is already compromised, that connection extends the compromise into yours. Assessing first, and connecting through a controlled boundary, is slower and considerably safer.
What a defensible yes requires
- Anticipated transactions are disclosed to the extent permitted.
- The policy automatic acquisition threshold is known and adequate.
- Security due diligence occurs before completion.
- Integration connects environments only after assessment.
- The carrier is notified of transactions that exceed the automatic threshold.
How this answer goes wrong
An acquisition completes mid-term, the environments are federated within a month, and the carrier is told at renewal. If an incident originates in the acquired environment during that period, the coverage question depends entirely on the automatic acquisition wording that nobody read.
Frequently asked
What if a deal is confidential?
Disclose at the level confidentiality allows, and tell your broker. They can arrange terms without publishing details.
Are acquisitions covered automatically?
Usually below a size threshold, with notification required above it. Check the threshold before you need it.
What should security diligence cover?
Incident history, identity posture, backup state, and internet exposure. Those four predict most of what you are about to inherit.
Does organic growth need disclosing?
Significant growth changes revenue and headcount answers, which are rating factors. Mention it at renewal.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture