Which activity should be finished before creating the Security readiness assessment report?

Which activity should be finished before creating the Security readiness assessment report?

A.
Technology Strategy Development

B.
Low Level Design

C.
Implementation Plan

D.
Assessment of Current security Management Procedures