A new law changes breach-reporting obligations. What should trigger reassessment?

1. The change in applicable requirements and associated response exposure
2. A new office furniture order
3. Only a change in the security team's headcount
4. Only the next annual calendar date