Which of the following is a step in establishing a security policy?