An organization wants to establish an information security program and has assigned a security analyst to put it in place. What is the NEXT step?
Develop and implement an information security standards manual.
security control review.
Perform a risk assessment to establish baseline security.
Implement security access control software.
Submit