Establish a management policy framework, i.e.:
a. Formulate and approve CM policy framework in terms of objectives, tasks, and responsibilities
b. Conduct high-level cost-benefit analysis of the CM options, e.g., is it cheaper to reduce a vulnerability or to replace infrastructure and equipment; balance of investments in , protection, and , etc.
c. Define priorities
d. Make the policy framework available to all CM stakeholders