What should be an information security manager’s FIRST course of action when an organization is subject to a new regulatory requirement?