An organization is planning to open a new office in another country. Sensitive data will be routinely sent between two offices. What should be the information security manager’s FIRST course of action?

A. Identify applicable regulatory requirements to establish security policies.
B. Update privacy policies to include the other country’s laws and regulations.
C. Apply the current corporate security policies to the new office.
D. Encrypt the data for transfer to the head office based on security manager approval.