--- title: "Any significant changes in nature or size of business anticipated next 12 months (M&A, consolidation)?" url: https://insuranceposture.com/questions/business-profile/significant-changes-nature-size-business-anticipated-next-12-months category: "Business and financial profile" canonical_key: q_fin_006 evidence_state: attested updated: 2026-08-24 --- # Any significant changes in nature or size of business anticipated next 12 months (M&A, consolidation)? URL: https://insuranceposture.com/questions/business-profile/significant-changes-nature-size-business-anticipated-next-12-months Section: Business and financial profile Evidence state: Attested, not tenant-verifiable Acquisitions import an environment nobody has assessed, and they are the single most common way a well-controlled estate acquires a serious weakness. ## What the carrier is actually asking The carrier is asking whether mergers, acquisitions, disposals, consolidation, or significant growth are anticipated. It affects the risk profile, the named insured, and how the policy responds to entities that join mid-term. ## Why it is underwritten An acquired company arrives with its own controls, its own incidents, and often its own unmanaged directory. Integration commonly connects the two environments before anyone has assessed the new one. Carriers ask because acquisitions produce claims at a rate out of proportion to their frequency. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is a forward-looking disclosure and the useful accompaniment is your integration approach. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Corporate plans | Anticipated transactions and their expected timing | Disclosed to the extent confidentiality permits. Attested | | Policy terms | Automatic acquisition provisions and their thresholds | What the policy covers automatically and above what size notification is required | | Diligence | Security due diligence in the transaction process | Whether security is assessed before completion rather than after integration | | Integration | How environments are connected | Whether the acquired environment is assessed and remediated before trust is established | | Growth | Significant headcount or revenue growth | Growth that changes the risk profile even without a transaction | **Do not federate before you assess** The standard integration sequence connects directories early to make collaboration work. If the acquired environment is already compromised, that connection extends the compromise into yours. Assessing first, and connecting through a controlled boundary, is slower and considerably safer. ## What a defensible yes requires - Anticipated transactions are disclosed to the extent permitted. - The policy automatic acquisition threshold is known and adequate. - Security due diligence occurs before completion. - Integration connects environments only after assessment. - The carrier is notified of transactions that exceed the automatic threshold. ## How this answer goes wrong An acquisition completes mid-term, the environments are federated within a month, and the carrier is told at renewal. If an incident originates in the acquired environment during that period, the coverage question depends entirely on the automatic acquisition wording that nobody read. ## If this answer turns out to be wrong Revenue and record counts are the rating base, so a misstatement here is material as arithmetic, and it is the category where insurers have historically reached for rescission. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [how rescission voids a policy from inception](https://insuranceposture.com/glossary/rescission). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### What if a deal is confidential? Disclose at the level confidentiality allows, and tell your broker. They can arrange terms without publishing details. ### Are acquisitions covered automatically? Usually below a size threshold, with notification required above it. Check the threshold before you need it. ### What should security diligence cover? Incident history, identity posture, backup state, and internet exposure. Those four predict most of what you are about to inherit. ### Does organic growth need disclosing? Significant growth changes revenue and headcount answers, which are rating factors. Mention it at renewal. ## Related questions - [In last 3 years, any cyber event, claim, loss, security breach, or extortion demand?](https://insuranceposture.com/questions/incident-response/last-3-years-cyber-event-claim-loss-security-breach) - [What is the Applicant's annual gross revenue (current / previous fiscal year)?](https://insuranceposture.com/questions/business-profile/applicant-s-annual-gross-revenue) - [What are the Applicant's websites / domains (main website, corporate email domains, subsidiary/franchise sites)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-websites-domains) - [What is total number of employees and contractors? How many working remotely?](https://insuranceposture.com/questions/business-profile/total-number-employees-contractors-working-remotely) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.