When assessing the impact of a new regulatory requirement, which of the following should be the FIRST course of action? 

Answer options:

A. Update affected IT policies.
B. Implement new regulatory requirements.
C. Assess the budget impact of the new regulation.
D. Map the regulation to business processes.

D