A recent regulatory requirement has the potential to affect an organization's use of a third party to supply outsourced business services. Which of the following is the BEST course of action?

A gap analysis will systematically compare the new regulatory requirements against the existing third-party agreement and the third party's current practices, identifying specific areas of non-compliance and allowing the organization to determine the necessary adjustments or negotiate with the vendor.

Terminating the outsourcing agreement is a drastic measure that should only be considered after a thorough assessment and exploration of other options, not as a first step.

Identifying compensating controls is premature without first understanding the specific gaps that need to be addressed by comparing the new requirements to current practices.

While risk transfer to a third party can occur, the new regulatory requirement might affect the validity or enforceability of such clauses, and a gap analysis is still needed to understand the compliance posture before determining risk allocation.