Câu 354: Isaca Certified Information Security Manager

A new law requires an organization to implement specific security controls. Which of the following should the information security manager do FIRST?

1. A. Integrate the new requirements into the security policy.
2. B. Perform a gap analysis on the new requirements. — đáp án hiện tại
3. C. Develop a control implementation plan.
4. D. Assess the risk of noncompliance with the new requirements.