A company processes and stores sensitive data on its own systems. Which of the following steps should the company take first to ensure compliance with privacy r...