When assessing the implications of new external regulations on IT compliance, the first consideration should be the IT policies and procedures that need revision. This initial focus ensures that the foundational guidelines governing IT operations are aligned with the new regulatory requirements, forming the basis for compliance. While the resource burden for implementation, gaps in skills and experience of IT employees, and the impact on contracts with service providers are important considerations, they follow the primary step of ensuring that IT policies and procedures are in compliance with new regulations.