Before selecting baseline security controls, an organization should $\_\_\_\_.$

Question $16$ options:

Develop an assessment plan

Develop a system security plan

Develop a plan of action and milestones

Conduct an enterprise risk assessment.