Which of the following should occur EARLIEST in a business continuity management lifecycle?

A. Defining business continuity procedures
B. Identifying critical business processes
C. Developing a training and awareness program
D. Carrying out a threat and risk assessment