A company is implementing a new cloud-based CRM system. During the risk assessment, it's identified that a data breach could result in significant financial losses and reputational damage. Which of the following is the MOST important security control to implement FIRST to mitigate this risk?