Answer:
A) Understanding which information assets need protection
Explanation:
The first thing Lora must do is determine which data assets need to be protected. This applies to all security protocols, since the person in charge of the security must first know what he/she is supposed to protect in order to determine what is the best way to protect it.
Imagine if Lora didn't know what assets were important and which weren't, how could she know what thing she should be protecting?
