Place the stages of developing an organizational security strategy into the correct chronological order, from first to last.

### Why this is right The sequence starts by determining what must be protected, then assesses risks to those assets. Policies guide the controls, employees learn how to follow the policies and use the controls, and monitoring supports ongoing improvement. ### The order 1. **Identify assets**: the organization first establishes what has value and needs protection. 2. **Assess risks**: threats and vulnerabilities are considered in relation to those assets. 3. **Develop policies and procedures**: the organization defines expected protective practices. 4. **Implement security controls**: safeguards put those practices into effect. 5. **Train employees**: staff learn how to follow the procedures and use the safeguards. 6. **Monitor and update**: ongoing review identifies changes and needed improvements. ### Terms - **Procedure**: an agreed set of steps for carrying out a task. ### Remember Identify what matters before choosing how to protect it.