A new security leader inherits competing technical projects with no documented business priorities. What should they do first?

1. Establish business objectives and risk priorities
2. Delegate all risk acceptance to system administrators
3. Buy the highest-rated monitoring platform
4. Require every system to use the same controls