Internal audit has reported a number of information security issues which are not in compliance with regulatory requirements.
What should the information security manager do FIRST?
A . Create a security exception
B . Perform a vulnerability assessment
C . Perform a gap analysis to determine needed resources
D . Assess the risk to business operations
Answer: C