Which of the following should be done FIRST when establishing an information security governance framework?

Evaluate information security tools and skills relevant for the environment.

Gain an understanding of the business and cultural attributes.

Contract a third party to conduct an independent review of the program.

Conduct a cost-benefit analysis of the framework.