Which of the following should be done FIRST when selecting performance metrics to report on the vendor risk management process?

A. Review the confidentiality requirements.
B. Identity the data owner.
C. Select the data source.
D. Identity the intended audience.