A newly approved information security strategy contains 14 initiatives spanning three years. The information security manager must convert the strategy into an actionable roadmap. Several initiatives are interdependent: a data classification program must precede a data loss prevention deployment, and an identity governance rollout depends on completing an HR system integration owned by another department. When developing the roadmap, what should the information security manager do FIRST?