Which of the following is one of the first steps in implementing access controls?

A$.$ Being aware of the policies and procedures needed by the organization

B$.$ Ensuring that authentication and authorizations systems are able to handle a large$-$scale employee base

C$.$ Creating an inventory of IT assets

D$.$ Determining the risk associated with assets and data