My advice would be prioritisation. In decreasing order: 1. Make sure intruders can't misuse your data/resources. 2. Make sure your data doesn't accidentally go

My advice would be prioritisation. In decreasing order: 1. Make sure intruders can't misuse your data/resources. 2. Make sure your data doesn't accidentally go missing or get corrupted. 3. Make sure the the resources are sufficiently set up for other people to get their jobs done. So, with a security background you have the most important of these already. The next most important is handled with backups. Then the rest is less critical. Next, you need to decide whether the system as it currently stands is basically working but needs little adjustments, or needs redesigning from scratch. Take a few months of observations before you decide this. Document the issues that you deal with. Make notes on the nature of the problem, the priority, the expected effort required to deal with it, what happened, how much effort it actually took. An issue tracker is a good way to do this, and I'd recommend using one even if it's a small company.