During an external assessment of network vulnerability, which of the following activities should be performed FIRST?

A. Collect network information
B. Implement an intrusion detection system (IDS)
C. Monitor the network
D. Review policies