A new regulatory requirement affecting an organization's information security program is released. Which of the following should be the information security man...