Câu 516: Isaca Certified in Risk and Information Systems Control

An organization is required to comply with updates to an existing data protection regulation. Which of the following should the risk practitioner recommend be doneFIRST?

1. A. Perform effectiveness testing for the organization's data protection controls.
2. B. Determine whether risk responses associated with the previous regulation are still adequate.
3. C. Perform a gap analysis to determine if additional controls are required. — đáp án hiện tại
4. D. Develop new internal control assessments for the updated regulation