When developing a security architecture, which of the following steps should be executed FIRST?

A.
Developing security procedures

B.
Defining a security policy

C.
Specifying an access control methodology

D.
Defining roles and responsibilities

Explanation:
Defining a security policy for information and related technology is the first step toward building a security
architecture. A security policy communicates a coherent security standard to users, management and technical
staff. Security policies will often set the stage in terms of what tools and procedures are needed for an
organization. The other choices should be executed only after defining a security policy.