A CIO has recently been made aware of a new regulatory requirement that may affect IT-enabled business activities. Which of the following should be…

The most critical first step when faced with a new regulatory requirement is to fully understand its scope, implications, and potential impact. The CIO, while an expert in IT, is not typically a legal or regulatory expert. Therefore, the initial and most prudent action is to consult with internal or external legal and risk management professionals. These experts can accurately interpret the regulation and advise on its applicability to the organization's IT-enabled business activities. This foundational understanding is a prerequisite for any subsequent actions, such as assessing resource needs, modifying projects, or briefing executive leadership.

A. Revising initiatives is a reactive measure that should only be undertaken after the new requirement is fully understood and its impact has been properly assessed.

B. Confirming resource adequacy is part of the planning and implementation phase of the response, which cannot be accurately performed without first understanding the compliance work required.

D. The board provides strategic oversight and direction. The CIO should first perform due diligence by understanding the issue with expert help before presenting an informed analysis and recommendation to the board.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 4: Risk Optimization

Task Statement R1 states the need to ensure IT-related risk is "identified

analyzed

mitigated

managed

monitored

and reported." The analysis

which involves understanding the requirement

must precede mitigation (revising initiatives) and management (allocating resources). Consulting legal experts is a key part of the analysis for regulatory risk.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The management objective APO12 Manage Risk includes practice APO12.02 Collect data

which involves identifying "relevant external environment trends (e.g.

legal

regulatory...)" to enable risk identification. This identification and data collection to understand the requirement is the initial step before developing a response.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The governance objective EDM03 Ensure Risk Optimization includes practice EDM03.01 Evaluate risk management. This involves directing the analysis of the potential impact of external business and regulatory changes on enterprise IT risk. This directive to analyze precedes any action on resource allocation or project changes.