When developing a security architecture, which of the following steps should be executed FIRST?

Developing security procedures 

Defining a security policy 

Specifying an access control methodology 

Defining roles and responsibilities