Before establishing IT key risk indicators, which of the following should be defined FIRST?

A. IT risk and security framework
B. IT key performance indicators
C. IT goals and objectives
D. IT resource strategy