Which of the following should be done FIRST when defining responsibilities for ownership of information and systems?

A. Require an inventory of information assets.
B. Identify systems that are outsourced.
C. Require an information risk assessment.
D. Ensure information is classified.