When updating the information security policy to accommodate a new regulation, the information security manager should FIRST:

Reviewing KRIs is a monitoring activity that comes after understanding the impact of the regulation and updating policies/controls.

Consulting process owners is important for implementing changes, but it follows the initial identification of gaps and required changes.

Updating KPIs is a step in measuring the effectiveness of the new policy, which occurs after the policy has been updated and implemented.

Performing a gap analysis is the essential first step because it systematically compares the new regulation against the existing information security policy and controls to identify what changes are needed to achieve compliance. This analysis reveals specific areas where the current policy is insufficient or where new controls must be implemented to meet the regulatory mandates.