Which of the following should be the FIRST step in developing an information security plan?

A.
Perform a technical vulnerabilities assessment

B.
Analyze the current business strategy

C.
Perform a business impact analysis

D.
Assess the current levels of security awareness

Explanation:

Prior to assessing technical vulnerabilities or levels of security awareness, an information security
manager needs to gain an understanding of the current business strategy and direction. A
business impact analysis should be performed prior to developing a business continuity plan, but
this would not be an appropriate first step in developing an information security strategy because it
focuses on availability.