When a new regulation affects data protection, the information security manager should FIRST:

1. APurchase new security tools
2. BRewrite all existing policies
3. CWait for the first audit
4. DDetermine its impact on the organization