In Certified Security Project Manager, what is the PRIMARY purpose of conducting an initial assessment?