The primary function of an IT governance committee is to ensure that IT activities align with and support the enterprise's strategic objectives. When faced with a significant change, such as increased social media usage, the committee's first responsibility is to understand the potential consequences for the business. Initiating a business impact assessment allows the committee to identify and evaluate both the risks (e.g., data leakage, reputational damage) and the opportunities (e.g., marketing, customer engagement) associated with this trend. This strategic assessment provides the necessary context for all subsequent actions, including policy review and control implementation.

A. recommend blocking access to social media. This is a tactical control decision, not a strategic first step. It is premature to recommend a solution without first assessing the business impact and risks.
B. review current level of social media usage. While gathering data on usage levels is important, it is a component of the impact assessment, not the primary first task. The impact is more critical than the volume of use.
D. reassess the enterprise's bring your own device (BYOD) policy. This is too narrow. Increased social media usage can occur on corporate-owned devices as well, making the issue broader than just the BYOD policy.

1. ISACA, CGEIT Review Manual, 8th Edition. Domain 4: Risk Optimization, Task Statement 4.3 states a key governance task is to "Ensure that actual IT risk and its potential impact on the enterprise’s goals and objectives are understood." This directly supports initiating an impact assessment as the first step.

2. ISACA, CGEIT Review Manual, 8th Edition. Domain 1: Governance of Enterprise IT, Task Statement 1.5 discusses ensuring that "IT-enabled investments are managed through their economic life cycle to deliver demonstrable value." Understanding the business impact of social media is crucial to evaluating its value and associated risks.

3. De Haes, S., & Van Grembergen, W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5. Springer International Publishing. Chapter 3, "COBIT 5 Principles," emphasizes the principle of "Meeting Stakeholder Needs," which involves translating stakeholder needs into actionable enterprise goals. The first step is always to understand the business context and impact before defining policies or controls.