What is the first thing should be done to determine the correct controls?

[answerhappygod]

A network security engineer is defining the controls needed to protect firewalls. What is the first thing they should do to determine the correct controls?

Review existing firewall rules and controls to ensure that there has been no deterioration
Review the risk register to ensure that all risks are being managed
Contact the firewall vendor to identify commonly used controls for this technology
Identify the organization’s objectives that the controls need to support