Which activity is the most suitable starting point for an organization developing a cybersecurity strategy?

### Why this is right A strategy must protect things the organization values. Identifying assets and business processes first gives later threat analysis and control selection a clear purpose. ### The concept Assets include information, systems, hardware, networks, people, and processes. Once they are known, an organization can ask what could harm them and what safeguards fit the risk. Installing tools before understanding the assets can leave important needs unaddressed. ### The other options - **B. Install every available security tool**: tool selection should follow risk assessment, not precede it. - **C. Wait for an incident before choosing safeguards**: this is reactive and leaves assets exposed beforehand. - **D. Focus only on threats reported by other organizations**: an organization must consider its own assets and context. ### Terms - **Asset**: something of value that an organization needs to protect. ### Remember Identify what matters before deciding how to protect it.