Which of the following should be the FIRST consideration for an enterprise faced with a pandemic situation resulting in a mandatory remote work environment?

In a crisis mandating a sudden shift to remote work, the most immediate and foundational priority is operational enablement. The enterprise must first ensure that its staff has the necessary technology—such as laptops, secure network access (VPN), and collaboration tools—to be productive. Without these essential resources, business operations cannot continue, rendering other important activities like policy updates or performance monitoring moot. This aligns with the CGEIT domain of IT Resource Optimization, which focuses on ensuring IT capabilities are sufficient to support the enterprise's objectives, especially during a major business disruption.

A. Reviewing and testing disaster recovery plans (DRPs) is a subsequent activity. A pandemic is a business continuity event (personnel-focused), not typically a DRP event (IT infrastructure-focused).
C. Updating and communicating remote work policies is critical for governance and security, but it is secondary to providing the actual technological capability for staff to work remotely.
D. Revising IT performance monitoring metrics is a management task that occurs after the remote work environment has been established and stabilized, not the initial enabling action. ---

1. ISACA, CGEIT Review Manual, 8th Edition (2020). Domain 2: IT Resources, Task 2.3, "Ensure that IT services and infrastructure are fit for purpose to support the enterprise in achieving its objectives." In a pandemic, the immediate objective is remote operational continuity, making the provision of suitable technology the first consideration to ensure fitness for purpose.

2. ISACA Journal, Volume 2, 2020, "Pandemic Preparedness and Its Impact on IT Audit Plans," page 1. The article states, "The first order of business was to ensure that employees could work from home... This meant ensuring that employees had the right equipment (e.g., laptops, monitors) and that the enterprise had sufficient network bandwidth and virtual private network (VPN) licenses." This directly identifies technology provisioning as the initial step.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer. Chapter 3, "IT Resource Management," discusses the fundamental need to manage and provide IT infrastructure and applications as a prerequisite for delivering value. In a crisis, this translates to the immediate provisioning of resources to enable the new operating model.