Which activity is the most appropriate starting point for a cybersecurity strategy?

### Why this is right A strategy needs to protect what matters to the organization. Identifying assets and objectives gives later risk analysis and control choices a meaningful basis. ### The concept Assets include information, systems, devices, people, and business processes. Their value depends on the organization's needs, so the same control may be suitable in one context and wasteful in another. Once assets are known, the organization can consider threats, weaknesses, potential harm, and safeguards. ### The other options - **Buy the largest available security product suite**: products should respond to assessed needs, not substitute for knowing them. - **Block every Internet connection**: this could disrupt required operations and does not establish priorities. - **Wait for an incident before defining priorities**: this is reactive and leaves the organization unprepared. ### Terms - **Asset**: Something valuable to an organization that requires protection. - **Cybersecurity strategy**: An ongoing plan for managing protection and cyber risk. ### Remember Identify what matters before deciding how to protect it.