Which of the following should be done FIRST when defining responsibilities for ownership of information and systems? 

Answer options:

A. Require an inventory of information assets.
B. Identify systems that are outsourced.
C. Require an information risk assessment.
D. Ensure information is classified.

A