What is the FIRST step that should be considered in a Data Loss Prevention (DLP) program?

Configuration management addresses maintaining secure and consistent system settings, but it is a technical control that comes after data has been classified and policies have been defined, not before.

Information Rights Management enforces access and usage controls on classified data, but it is a protective mechanism applied after data has already been identified and categorized through classification.

Policy creation is an essential DLP step, but policies can only be written effectively after data has been classified, because the policies must reference specific data types and sensitivity levels to be actionable.

Data classification is the first step in a DLP program because you must identify and categorize data by its sensitivity level (e.g., public, internal, confidential, restricted) before you can determine what needs protection. Without knowing what data exists and its relative value or risk, you cannot create meaningful policies, apply rights management, or configure technical controls. All subsequent DLP activities depend on this foundational inventory and labeling effort.