All information security programs must be continuously assessed and adjusted to account for changes in the environment including the addition of new technologies, the emergence of new threats, and modifications to the business such as mergers or acquisition;