When assessing the impact of a new regulatory requirement, which of the following should be the FIRST course of action?

A. Update affected IT policies.
B. Implement new regulatory requirements.
C. Assess the budget impact of the new regulation.
D. Map the regulation to business processes.