To implement a security framework, an information security manager must FIRST develop:

A. security standards.
B. security procedures.
C. a security policy.
D. security guidelines.