After obtaining commitment from senior management, which of the following should be completed NEXT when establishing an information security program? 

Answer options:

A. Define security metrics
B. Conduct a risk assessment
C. Perform a gap analysis
D. Procure security tools

B

When establishing an information security program, conducting a risk assessment is key to identifying the needs of the organization and developing a security strategy. Defining security metrics, performing a gap analysis and procuring security tools are all subsequent considerations.