A merger with another organization would likely require a revision to the information security program because it can result in significant changes to the structure, size, and information systems of the merged entity. This can affect the security requirements, risk tolerance, and governance policies of the organization. To ensure that the information security program remains effective, it is important to review and revise the security policies, standards, and procedures in light of the changes brought on by the merger. The information security program should align with the new organization's risk tolerance, security requirements, and governance policies. This information can be found in the ISACA's Certified Information Security Manager (CISM) Study Manual, Section 3.1.