The organization is moving several critical workloads to a public cloud platform, and the security team has limited experience with cloud environments. What should the information security manager do FIRST?

Decisions about training, hiring or sourcing should be based on a clear understanding of the gap between current capabilities and what the new environment demands. A skills inventory compared with the cloud environment's requirements shows which competencies are missing, how critical each is and how many people need it, which then informs a proportionate mix of training, recruitment and external support. Replacing staff with new hires is costly, slow and disruptive, and it discards knowledge of the organization's business and systems; without a gap analysis there is no basis for concluding replacement is needed. Enrolling everyone in a certification course spends training budget uniformly, whether or not each person's role requires the skill, and the chosen course may not address the actual gaps. Outsourcing monitoring may be a valid part of the solution, but selecting it first assumes the gap lies in monitoring and that sourcing is the best response; the organization would also still need internal skills to oversee the provider. Exam caveat: the information security manager may ultimately combine all three responses, but the analysis comes first. Operational check: confirm the gap analysis lists required competencies by role, current proficiency and the chosen remedy for each gap.