A new project manager is planning an information security project that spans multiple countries. What should be the first step to gather customer requirements?

The first step in gathering requirements for a multi-country project, especially one involving information security, is to conduct a stakeholder analysis. This is crucial because regional policies, laws, and cultural norms significantly impact security requirements and project scope. Identifying these influences early helps define who the key stakeholders are and what their specific needs and constraints might be. Asking stakeholders to perform their own analysis independently is inefficient and risks inconsistent or incomplete requirements. Holding a project scope review workshop or project planning meetings are important later steps, but they should occur after an initial understanding of stakeholders and their regional policy influences has been established through stakeholder analysis. Without this foundational analysis, workshops and meetings might miss critical regional considerations.