A risk practitioner is advising management on how to update the IT policy framework to account for the organization s cloud usage. Which of the following should be the FIRST step in this process?

Consulting with industry peers is a valuable input, but it occurs after understanding the internal context and identifying specific needs and gaps.

Evaluating adherence to existing policies is an ongoing compliance activity, not the initial step in a policy update process driven by new technology adoption.

Before any new policies are adopted or existing ones are revised, it's essential to understand the current state of policies, identify how they apply or fall short for cloud computing, and define the target state, thereby pinpointing the specific gaps that need to be addressed in the updated framework.

Adopting an industry-leading cloud computing framework should be considered after identifying internal needs and gaps, as a blanket adoption without a gap analysis may not fit the organization's specific context.