An organization is required to comply with updates to an existing data protection regulation. Which of the following should the risk practitioner recommend be done
FIRST?

A. Perform effectiveness testing for the organization's data protection controls.

B. Determine whether risk responses associated with the previous regulation are still adequate.

C. Perform a gap analysis to determine if additional controls are required.

D. Develop new internal control assessments for the updated regulation








 

Suggested Answer: C



This question is in CRISC exam 
For getting Risk and Information Systems Control Certificate


Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by ISACA.
The website does not contain actual questions and answers from ISACA's Certification Exams.
Trademarks, certification & product names are used for reference only and belong to ISACA.