Which of the following activities should take place FIRST when a security patch for Internet software is received from a vendor?

A. The patch should be validated using a hash algorithm.
B. The patch should be applied to critical systems.
C. The patch should be deployed quickly to systems that are vulnerable.
D. The patch should be evaluated in a testing environment.