In phase A, we start to see the interaction between the SOC and IT operations. They have to determine with the other business owners what is considered high impact applications and systems. This allows the scanning function to narrow down what their scope is so that the information they provide to the reporting function of VM provides value first before all other applications or systems: