The list is pretty short compared to the audits we do every year or two. I've spent the last few years getting my company up to standard and this is the (simpli

The list is pretty short compared to the audits we do every year or two. I've spent the last few years getting my company up to standard and this is the (simplified version of the) process we undertook. 1. Do an initial internal audit against a (few) known security standard(s) that are relevant to your org (ISO27001, NIST, PCI etc). 2. Create a System Security Plan document that outlines what your intended security posture is for each control in the standard you are following and also recording what your current posture is. Record evidence in this document too (screenshots etc) along with an caveats and mitigations. 3. Once you have the results create a Security Risk Management Plan (SRMP) with a risk register annex for an itemised record of gaps. This document should outline what gaps you have and categorise according to the the risk they represent for your company using the risk matrix https://en.wikipedia.org/wiki/Risk_matrix https://en.wikipedia.org/wiki/Risk_matrix 4. Once you have the SRMP you can create a roadmap starting with the highest risk items and working down. It might take years for you to get to a good point but at least this process will focus efforts and give you a plan to tackle what seems like an insurmountable volume of work. If you read this comment and thought "We should do this" I highly recommend to contract in a security consultancy to act as your organisations CISO to help you with this process. They will provide experience, structure and knowledge that is no doubt missing from your org. Rating risks can be non-intuitive for example.