Which of the following is the FIRST task when determining an organization’s information security profile?

A. Build an asset inventory
B. List administrative privileges
C. Establish security standards
D. Complete a threat assessment