CompTIA SecurityX (CAS-005) CAS-005 — Question 330

After a leak of important documents, a company decides to implement a data protection program to avoid similar incidents in the future. Which of the following should the company do first?