Which of the following should be done FIRST when developing a data protection management plan?