Arrange these broad security activities in a sensible cycle, beginning with identifying what needs protection.

### The order 1. **Identify systems, services, or information that could be lost or disrupted**: You need to understand what is at risk before choosing a safeguard. 2. **Select software or physical safeguards and procedures**: Controls should address the identified risks. 3. **Put the safeguards into use with the people responsible for them**: Controls must be operated and followed to provide protection. 4. **Review whether the safeguards still address current risks**: Security is ongoing, so changing conditions can require changes to safeguards. ### The concept The review stresses continuing security work and the roles of people, technology, and environment. This sequence applies those ideas as a practical cycle. It is not a claim that the review mandates one formal risk-management method; it is a reasoned way to apply the process principle. ### Remember Identify what matters, choose suitable safeguards, put them into practice, and keep reviewing them.