Oops, that's not right...

Implementing strict access controls is incorrect.

Explanation :

Identifying what data is currently being collected is crucial as a first step to understand gaps in data collection and ensure that all relevant information for defending against cyber threats is being captured.