ISC2 CISSP Practice Question

The correct answer is to establish an asset inventory. Before you can effectively manage, protect, and secure assets, you must first know what assets exist within the organization. An asset inventory creates the foundation for all other security controls and processes. It enables the organization to identify what needs to be protected, who owns each asset, what classification level should be applied, what controls are needed, and how the assets should be handled throughout their lifecycle. Without a proper inventory, critical assets might be overlooked in security planning, creating potential vulnerabilities. The other options represent important security practices but they logically follow after establishing what assets exist in the environment.