Upcoming IT-related regulations carry costly penalties for an enterprise. The issuing regulatory agency has a history of weak enforcement. The IT steering committee should FIRST direct management to:

A. update the enterprise architecture (EA).
B. perform benchmarking activities.
C. evaluate the impact of the emerging risk.
D. develop mitigation plans for noncompliance.