The first step in developing an IT security plan is to ________.

• A. determine needs
• B. assess the current state of the company's security
• C. create comprehensive security
• D. prioritize security projects

Answer: (B)

A solid IT security plan starts with a snapshot of the current security posture. Gathering this baseline—what assets exist, what protections are in place, and where gaps and vulnerabilities lie—lets you understand the real risks the organization faces. With that context, you can identify what needs to be improved, set realistic objectives, and determine the scope and resources required for the plan. If you skip this step, you’d be guessing about gaps and over- or under-allocating effort; the later steps—defining needs, building a comprehensive security program, and prioritizing projects—depend on knowing the actual starting point. After establishing the current state, you can more accurately determine needs, craft a coherent security strategy, and rank initiatives by risk and impact.