Which of the following is the FIRST step an organization's security professional performs when defining a cyber-security program based upon industry standards?

Mapping current security practices to frameworks is a gap analysis activity that can only be performed meaningfully after organizational objectives and scope have already been defined.

Defining the organization's objectives regarding security and risk mitigation is the foundational first step because all subsequent decisions - such as which frameworks to adopt, which controls to implement, and how to prioritize resources - must align with the organization's specific goals and risk appetite. Without established objectives, there is no basis for evaluating which standards or practices are relevant or appropriate. This aligns with the NIST Cybersecurity Framework's 'Identify' function, which emphasizes understanding business context and risk management priorities before any other activity.

Selecting security best practices is a later-stage activity that depends on having clear objectives and a gap analysis to guide which practices are most applicable to the organization.

Reviewing past security assessments is a useful input but is not the first step; it is a secondary activity that supports gap analysis and is only relevant once objectives are established.