A CIO has recently been made aware of a new regulatory requirement that may affect IT-enabled business activities. Which of the following should be the CIO s FIRST step in deciding the appropriate res

Revising active initiatives without a clear understanding of the new requirements from experts would be premature and risks misdirection or insufficient compliance.

Confirming resource adequacy is an important subsequent step, but it can only be effectively done once the requirements are clearly understood and defined.

Upon becoming aware of a new regulatory requirement, the CIO's immediate first step must be to engage legal and risk experts to obtain a precise and comprehensive understanding of the regulation's scope, interpretation, and potential impact on IT-enabled business activities before any action is taken.

Consulting the board may be necessary for strategic direction or significant resource allocation later, but the initial, detailed understanding of legal requirements requires expert consultation.