FIRST means the first logical step

Exam

CISA & CISM

What it means

Several options may be good actions. FIRST asks which one must happen before the others, usually understanding the situation, scope or risk before acting.

The trap answer looks like

A good action that depends on information you do not have yet.

The winning answer looks like

The step everything else depends on, usually understanding the scope, facts or risk.

Worked example

A new vulnerability affecting widely used software is announced. What should the security manager do FIRST?

❌ Patch every server tonight
✅ Determine whether and where the organization is affected

Patching may follow, but you must know your exposure first.