The implementation of access controls FIRST requires:

A. a classification of IS resources.

B. the labeling of IS resources.

C. the creation of an access control list.

D. an inventory of IS resources.