Which of the following would be the BEST way for an enterprise to address new legal and regulatory requirements applicable to IT?