A new version of an information security regulation is published that requires an organization’s compliance. The information security manager should FIRST:

A new version of an information security regulation is published that requires an organization’s compliance. The information security manager should FIRST:
A . perform an audit based on the new version of the regulation.
B . conduct a risk assessment to determine the risk of noncompliance.
C . conduct benchmarking against similar organizations.
D . perform a gap analysis against the new regulation.

View Answer

Answer: D