What is the FIRST step in developing the vulnerability management program?