Start by listing all assets that require safeguarding. This includes physical items like equipment and facilities, as well as intangible assets such as sensitive data. Organize assets by their importance, which will help shape your security plan.