When building a security policy for an organization, which of these steps should you take first?

When building a security policy for an organization, which of these steps should you take first?

A.
Risk Management

B.
Risk Assessment

C.
Threat Avoidance

D.
End-user Training

E.
Threat Identification