An IT governance committee is reviewing its current risk management policy in light of increased usage of social media within an enterprise. The FIRST task for the governance committee is to:

Recommending to block access is a mitigation strategy and should only be considered after a thorough assessment of the impact and risks, as it might be an overreaction or unnecessary.

Reviewing the current level of social media usage is a part of gathering data for the assessment but is not the *first task* of the governance committee; the first task is to understand the implications of that usage.

Before making any decisions or changes, the IT governance committee must first understand the potential impact that increased social media usage has on the business, which includes identifying new risks (e.g., data leakage, reputational damage, productivity loss) and opportunities. This impact assessment provides the necessary data for informed risk management policy updates.

Reassessing the BYOD policy might be a related task, but the core issue is the increased usage of social media itself and its direct business impact, not solely how it interacts with BYOD devices.