Which statement is correct about security planning?

A. choosing colors without business goals B. launching before requirements are known C. identifying threats and choosing protections before launch D. deleting all planning documents