A financial services company is preparing to deploy an information rights management (IRM) solution across its SaaS collaboration platform to enforce persistent protections such as document expiration and copy/print restrictions. During planning, the security architect insists that a specific activity must be completed first to ensure the IRM policies apply the correct level of protection to each document. Which activity should be completed before the IRM controls can be effectively configured?