Oops, that's not right...

Implementing strict access controls is incorrect.
Explanation :
Identifying what data is currently being collected is crucial as a first step to understand gaps in data collection and ensure that all relevant information for defending against cyber threats is being captured.