The correct answer is protecting critical assets or data first. If you don't do it correctly, you can endanger the data or the information that you're trying to protect and maintain and depending on the information this can be a serious problem, sometimes even a criminal offense.