When developing a security architecture, which of the following steps should be executed FIRST?

When developing a security architecture, which of the following steps should be executed FIRST?
A . Developing security procedures
B . Defining a security policy
C . Specifying an access control methodology
D . Defining roles and responsibilities

View Answer

Answer: B

Explanation:

Defining a security policy for information and related technology is the first step toward building a security architecture. A security policy communicates a coherent security standard to users, management and technical staff. Security policies will often set the stage in terms of what tools and procedures are needed for an organization. The other choices should be executed only after defining a security policy.