When developing a new system, detailed information security functionality should FIRST be addressed: