Exam CISM topic 1 question 299 discussion

B. but it depends on what ISACA wants you to do. I think an Ciso would better understand the risk to the business. Why would i consult legal before i understand the impact.

2.4.7 Regulations must be first evaluated by legal/general councel...

B. Perform a gap analysis Performing a gap analysis involves assessing the organization's current information security controls, policies, and practices against the new regulatory requirements. This allows the manager to identify areas where the organization may fall short of compliance and where improvements or adjustments are needed. It provides a clear understanding of what needs to be done to align with the new regulation, which is crucial before taking any further actions, such as notifying the legal department or determining the disruption to the business. Once the gap analysis is complete, the information security manager can then develop a plan to address any deficiencies and ensure compliance with the new regulatory requirements.

go with B

B. Perform a gap analysis

Gap analysis allows you to identify the controls you have in place. Therefore, you will be able to determine if current controls mitigate the risk of the new regulations

FIRST course of action when a new regulatory requirement affecting the organization's information security program is released should be to perform a gap analysis. This involves reviewing the organization's existing information security program to identify areas where it may not meet the new regulatory requirements. Once the gap analysis is complete, the information security manager can develop a plan to address any deficiencies and ensure that the organization is in compliance with the new regulatory requirement.

B. Gap analysis has to be performed first.

A gap analysis is needed to determine if there were adequate control already in place.

at first, check the gap.