According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?

According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?
A . Identify threats, risks, impacts and vulnerabilities
B . Decide how to manage risk
C . Define the budget of the Information Security Management System
D . Define Information Security Policy

Answer: D