If you were tasked with securing a CRM system, what initial steps would you take to assess its vulnerabilities?