When developing a risk management program, what is the FIRST activity to be performed?

A.
Threat assessment

B.
Classification of data

C.
Inventory of assets

D.
Criticality analysis

Explanation:
Identification of the assets to be protected is the first step in the development of a risk management program. A
listing of the threats that can affect the performance of these assets and criticality analysis are later steps in the
process. Data classification is required for defining access controls and in criticality analysis.