An organization wants to integrate information security into its HR management processes. Which of the following should be the FIRST step?

Calculating ROI is a financial justification step that comes after understanding the needs and potential solutions, not the initial step.

Security awareness training is crucial but is a control implementation step that comes after understanding the risks and appropriate integration points within the processes.

The first step should be to assess the business objectives of the HR management processes. Understanding the goals and functions of each HR process (e.g., onboarding, offboarding, performance management) allows for the identification of critical information, potential risks, and the most effective points for integrating security controls that support, rather than hinder, the HR objectives.

Benchmarking against best practices helps identify gaps but should follow an initial understanding of the organization's *own* processes and objectives, otherwise the comparison may not be relevant.