The control framework the organization adopted three years ago has just been released in a substantially revised version. What should the information security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
When the map gets a new edition, you compare it with your old one before you change your route. A gap assessment shows you what's really different, so you can plan the move instead of ripping everything up or ignoring it.
Full Explanation
A revised framework may add, remove, merge or reword controls, and its relevance to the organization depends on which of those changes affect current practices and obligations. A gap assessment compares the existing control environment with the new version, identifies what is affected, and supports a transition plan with priorities, resources and timelines that management can approve. This approach avoids unnecessary rework and ensures meaningful changes are addressed. Rewriting all policies immediately to mirror the new structure is premature and costly; policy structure need not follow framework structure, and changes should be driven by identified gaps rather than by the release itself. Continuing with the previous version indefinitely ignores that older versions may lose support, and that customers, regulators or certification bodies may expect the revised version within a transition period; it also forgoes any improvements the revision makes. Waiting for an external audit hands discovery of gaps to an assurance function and risks findings that could have been avoided, while delaying planning until after the gap is exposed. Exam caveat: where certification is involved, transition timelines may be set externally, which makes early assessment more important. Operational check: confirm the gap assessment results and transition plan are approved and tracked to completion.