Which of the below choices should an organization start with when implementing an effective risk management process?

An incident response plan is a reactive component of risk management and can only be meaningfully designed after policies define what assets and risks require protection.

Security policies define the organization's risk tolerance, objectives, and compliance obligations, providing the foundational framework from which all other risk management activities are derived. Without established policy, there is no authoritative basis for selecting controls, defining standards, or conducting meaningful reviews, making it the essential first step.

Periodic reviews are an ongoing, cyclical activity intended to assess the effectiveness of controls already in place and cannot be the starting point of a program.

Designing controls and technology standards presupposes that policies exist to specify what must be protected and to what degree, so controls must follow policy, not precede it.