When developing a risk management program, what is the FIRST activity to be performed?
A.
Threat assessment
B.
Classification of data
C.
Inventory of assets
D.
Criticality analysis
Explanation:
Identification of the assets to be protected is the first step in the development of a risk management
program. A listing of the threats that can affect the performance of these assets and criticality
analysis are later steps in the process. Data classification is required for defining access controls
and in criticality analysis.