Which of the following should be considered FIRST when implementing a risk management program? 
A、An understanding of the organization's threat, vulnerability and risk profile 
B、An understanding of the risk exposures and the potential consequences of compromise 
C、A determination of risk management priorities based on potential consequences 
D、A risk mitigation strategy sufficient to keep risk consequences at an acceptable level