What is the first step when creating a network security policy?

What is the first step when creating a network security policy?

A.
define what should be protected

B.
investigate how likely an attack is to occur

C.
implement measures to protect assets

D.
hire a security firm to perform penetration tests