An organization is already certified to an international security standard. Which mechanism would
BEST help to further align the organization with other data security regulatory requirements as per
new business needs?

A.
Key performance indicators (KPIs)

B.
Business impact analysis (BIA)

C.
Gap analysis

D.
Technical vulnerability assessment

Explanation:

Gap analysis would help identify the actual gaps between the desired state and the current
implementation of information security management. BIA is primarily used for business continuity
planning. Technical vulnerability assessment is used for detailed assessment of technical controls,
which would come later in the process and would not provide complete information in order to
identify gaps.