A disaster recovery team has begun its initial assessment of physical security risks and associated countermeasures. which factor should always be considered first?