An enterprise learns that a new privacy regulation was recently published to protect customers in the event of a breach involving personally identifiable information (Pll). The IT risk management…

Evaluating risk appetite comes after understanding the risks introduced by the regulation, as appetite defines the level of risk the organization is willing to accept.

Defining risk tolerance, which specifies acceptable deviations from the risk appetite, is a later step, following the identification and assessment of new risks.

The first step for an IT risk management team when a new regulation emerges is to determine its direct impact by identifying if it introduces new risks to the organization or significantly alters the nature or severity of existing risks related to PII. This assessment informs all subsequent risk management activities.

Assigning a risk owner is important but typically follows the initial identification and assessment of the specific risks introduced by the new regulation.