A company plans to begin selling services in a new country that has recently enacted a data protection law. What should the security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
Before you measure the gap, you need to know which ruler you're holding. Legal counsel tells you whether the law even reaches what you'll do there and what it really requires; then the gap analysis has a real target. The trap is jumping straight to the gap analysis because it sounds so methodical.
Full Explanation
Legal and regulatory requirements drive security obligations, but only once their applicability and scope are understood. A new data protection law may apply differently depending on the data processed, where it is stored, the type of customers and whether processing is performed locally or remotely. The security manager should therefore first work with legal counsel to determine whether the law applies to the planned operations and what specific obligations result. A gap analysis is the natural next step, but performing it before applicability is established risks measuring against requirements that do not apply or missing ones that do. Designing and implementing controls is later still, since controls should address the gaps that the analysis identifies, prioritized by risk. Appointing a local data protection officer may be required by some laws, but making that appointment before knowing whether this law demands it assumes an answer the organization has not yet obtained. Exam caveat: on CISM, interpreting law is legal counsel's role; the security manager identifies requirements and translates them into security implications. Operational check: obtain a written applicability opinion from counsel that lists the obligations, then use it as the baseline for the gap analysis.