Q16
Single choice
Which of the following should be done FIRST when establishing an information security governance framework?