An organization uses a security standard that has undergone a major revision by the certifying authority. The old version of the standard will no longer be used for organizations wishing to maintain…

Modifying policies without first understanding the new standard and its applicability could lead to incorrect or irrelevant policy changes that do not effectively address the revised requirements.

Reviewing the new standard for applicability is the foundational first step because it establishes understanding of the changes and determines which requirements are relevant to the organization's specific context and operations. This allows for informed decision-making on necessary modifications, resources, and communication strategies before any further action can be taken.

Evaluating the cost of maintaining the certification before understanding the standard's impact and applicability is premature, as the actual cost will depend on the identified required changes.

Communicating the new standard to senior leadership is important, but meaningful communication requires an initial review of the standard to accurately convey its implications to the business.